European Health Data Space Regulation

(79) For the processing of electronic health data in the scope of a data permit or a health data request, health data holders, including trusted health data holders, health data access bodies and health data users should be deemed each of them, in turn, controllers for a specific part of the process and according to their respective roles therein. Health data holders should be deemed controllers for the disclosure of the requested personal electronic health data to the health data access bodies, while the health data access bodies should in turn be deemed controllers for the processing of the personal electronic health data when preparing the data and making them available to the health data users. Health data users should be deemed controllers for the processing of personal electronic health data in pseudonymised form in the secure processing environment pursuant to their data permits. Health data access bodies should be deemed processors on behalf of the health data user for the processing carried out by the health data user pursuant to a data permit in the secure processing environment as well as for the processing to generate a response to a health data request. Similarly, trusted health data holders should be deemed controllers for their processing of personal electronic health data related to the provision of electronic health data to the health data user pursuant to a data permit or a health data request. The trusted health data holders should be deemed processors for the health data user when providing data through a secure processing environment.