EU sets digital ID rules for cross-border health data exchange

The European Commission has approved a new legal framework which spells out an interoperable cross-border ID and authentication mechanism for patients, health professionals, and healthcare providers within the context of MyHealth@EU use. MyHealth@EU is the EU infrastructure that facilitates the cross-border exchange of electronic health data among member states.

Adopted on September 21 and published in the Official Journal of the EU a day later, Commission Implementing Regulation (EU) 2026/2099 will be implemented following a phased timetable, beginning March 26, 2027. This is an implementing regulation under the European Health Data Space that connects its cross-border health-data infrastructure with the eIDAS and EUDI Digital Identity framework.

Under the rules, identity verification across the MyHealth@EU network must integrate directly with national digital ID schemes recognized under the eIDAS framework. The alignment ensures that citizens can authenticate access to medical records abroad using notified national eIDs and European Digital Identity Wallets.

Per the guidelines, all member states will have to determine a set of healthcare attributes used to identify natural persons in connection with their electronic health records for cross-border exchange, which must be notified to the Commission by March 26, 2028, and subsequently published.

By March 26, 2029, the competent authority in a person’s member state of affiliation must issue those healthcare attributes as electronic attestations of attributes to their EUDI Wallet, upon request.

With regard to authentication requirements for online patient requests, electronic identification must initially meet at least the substantial assurance level under eIDAS, with the requirement expected to move to high assurance from March 2030. Authentication must also meet at least substantial assurance for health professionals, with high assurance expected by March 2032.

The new implementing act reflects a broader policy trend toward the sectoral rollout of the EUDI Wallet, demonstrating how it is moving from a general-purpose identity tool to a specialized sectoral credential. The move comes as member states are required to offer at least one EUDI Wallet by the end of 2026.

Article Topics

cross border identity verification  |  cross-border data sharing  |  digital ID  |  eIDAS  |  EU Digital Identity Wallet  |  Europe  |  healthcare  |  legislation