Towards the digitisation of health

The digital transformation of the healthcare sector is now an unstoppable reality in Europe. In this context, Spain is preparing to adapt its regulatory framework to the new Regulation (EU) 2025/327 on the European Health Data Space (EHDS) (the "EHDS Regulation") by drafting a preliminary draft Digital Health Law. The Ministry of Health has opened a public consultation to gather opinions and proposals from citizens and stakeholders, with the aim of building a robust, inclusive regulation that is adapted to current challenges.

For more information on the EHDS Regulation, we recommend consulting our previous Post | European Health Data Space Regulation and Post | EHDS FAQs: Operational and Governance Perspectives.

Why a Digital Health Law?

The EHDS Regulation, which is directly applicable in all Member States, establishes a common legal framework to ensure the interoperability and ethical and secure use of electronic health data in the European Union (EU). However, the complexity of the Spanish healthcare system—with powers distributed between the State and the autonomous communities—combined with the need to regulate organisational, technical and sanctioning aspects at the national level, makes it essential to have a regulation that specifies and adapts European obligations to our reality. In Spain, due to the distribution of healthcare competences, it is necessary to clearly define the obligations of the different administrations to ensure that anyone can exercise their rights over their electronic health data regardless of the autonomous community or healthcare provider (public or private) that treats them. A national Digital Health Law would thus allow the EHDS Regulation to be developed and complemented in those specific aspects of our healthcare system that require additional detail.

Main challenges and objectives of the future law

The future Digital Health Law aims to address the following challenges:

• Guarante rights and obligations. Ensuring that all individuals, in both the public and private sectors, can exercise the rights recognised by the EHDS Regulation over their electronic health data, clearly defining the obligations of the various administrations and healthcare providers for uniform application throughout the country.
• Governance and coordination. Establish a clear governance structure for the primary (healthcare) and secondary (research, innovation, public policy) use of health data, coordinating the functions of the competent authorities and bodies at national and regional level. The law provides for a new model in which the autonomous communities, as regional digital health authorities, are coordinated by a national authority that guarantees connection to the European MyHealth@EU network and represents Spain in European bodies, thus facilitating cross-border continuity of care. Similarly, the governance of secondary data use will be strengthened through the creation of data access bodies at the regional level and a national body, integrated into the European HealthData@EU infrastructure, to manage data access requests with ethical, legal and security guarantees.
• Interoperability and quality. Extend the regulation of interoperable digital medical records to the entire healthcare system, guaranteeing equal access to information and setting standards for content, quality and traceability that facilitate continuity of care in Spain and effective portability within the EU. This will prevent inequalities: any patient, whether treated in the public or private healthcare system, will be able to access their health information in a unified manner, and professionals will have complete, high-quality data for healthcare.
• Integration of digital technologies. Regulate the use of digital technologies in healthcare – for example, artificial intelligence, telemedicine, biometrics or even emerging neurotechnologies – ensuring transparency, traceability and the protection of the rights of patients and professionals. The rapid advancement of these tools presents great opportunities, but also risks in terms of security, ethics and privacy. The new law will establish specific rules on how these technologies can be used in clinical practice, defining the associated rights and duties and setting additional safeguards for sensitive applications.
• Incorporation of digital health products. Define the requirements for the inclusion and financing of digital solutions (mobile health applications, connected medical devices, telemonitoring systems, etc.) in the portfolio of services of the National Health System. The law will establish requirements such as interoperability and the provision of data to the national health information system, avoiding fragmentation between communities and ensuring that the introduction of these tools provides added value, patient safety and equity in access to digital innovation.
• Protection and use of personal data. Systematise the legal framework for the processing of personal health data, especially in secondary uses such as research, algorithm development or public health surveillance. The law provides for the creation of specific bodies (at regional and national level) responsible for authorising and supervising access to health data for secondary purposes, acting in a coordinated manner and in line with European networks. Likewise, the necessary ethical, legal and security guarantees will be established to protect the confidentiality of health information, setting appropriate protection measures and limitations when administrations use health data for purposes of public interest.

Consultation process and regulatory calendar

The public consultation will be open until October 20, 2025, allowing citizens, organisations and associations to contribute their opinions and suggestions via the electronic form provided by the Ministry of Health.

At the same time, the European timetable has already been set: the EHDS Regulation was published in the OJEU on 5 March 2025, enters into force twenty days later and begins to apply on 26 March 2027, with subsequent phases for categories of data and systems affected. This will ensure an orderly transition and the proper adaptation of the Spanish healthcare system to the new European requirements.