Brussels sets cross-border digital identity rules for European health data exchange

The European Commission has adopted Commission Implementing Regulation (EU) 2026/2099 of 21 September 2026, establishing an interoperable, cross-border identification and authentication mechanism for natural persons, health professionals and healthcare providers. The regulation was published in the Official Journal of the European Union, L series, on 22 September 2026, under document number 2026/2099, and carries EEA relevance. It was signed in Brussels on 21 September 2026 by Commission President Ursula von der Leyen.

The gap the regulation closes

The measure implements Article 16(2) of Regulation (EU) 2025/327 on the European Health Data Space, which amended Directive 2011/24/EU and Regulation (EU) 2024/2847. According to the recitals, a growing number of people live in one Member State but receive healthcare in another, and their electronic health records are increasingly dispersed across systems that use different identifiers for people and their records. The same fragmentation affects the means used to identify health professionals and healthcare providers.

The regulation therefore sets the requirements for identifying the actors involved in an exchange and for matching a person’s identity to their electronic health records when data travels through the MyHealth@EU platform referred to in Article 23(1) of Regulation (EU) 2025/327. The European Data Protection Supervisor was consulted under Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 5 May 2026. The measures follow the opinion of the committee established by Article 98(1) of Regulation (EU) 2025/327.

National attribute sets and the digital wallet

Under Article 3, each Member State must determine a set of healthcare attributes used to verify the identity of natural persons in connection with their electronic health records. The key obligations are:

• Member States must notify their set of healthcare attributes to the Commission by 26 March 2028, and notify later updates as soon as possible.
• The Commission publishes the national sets.
• On request, the competent authority in a person’s Member State of affiliation must issue those attributes as an electronic attestation of attributes to that person’s European Digital Identity Wallet.
• Health professionals and providers must accept attributes presented through the wallet, and must request additional information where the identification means do not supply the full set.

The mechanism must comply with Regulation (EU) No 910/2014 on electronic identification and trust services. Public sector bodies and private relying parties requiring electronic identification must accept European Digital Identity Wallets where people choose to use them.

Assurance levels and a phased timetable

Electronic identification means must provide at least the “substantial” assurance level of Article 8(2)(b) of Regulation (EU) No 910/2014. The regulation then raises the bar in stages:

• From 26 March 2030, all electronic identification means used to identify natural persons whose health data are exchanged through MyHealth@EU must reach the “high” assurance level.
• From 26 March 2032, the same “high” level applies to means used to identify and authenticate health professionals.
• Where a Member State uses a means not notified under Regulation (EU) No 910/2014, its “high” level must be confirmed by a conformity assessment body under Article 2(13) of Regulation (EC) No 765/2008 or an equivalent body.

Each Member State must also list the entity or entities responsible for identifying, authenticating and authorising health professionals and providers before an exchange is requested. National contact points for digital health must pass on the identification data of the requesting professional or provider, in line with the technical specifications in the Annex, which cover mandatory fields such as family name, given name, country code, professional identifier, professional role, provider identifier, provider name and registered address.

The regulation enters into force on the twentieth day following publication and applies from 26 March 2027, except Articles 3(3) and 5(2), which apply from 26 March 2029.

Why it matters

For patients treated outside their home country, the regulation is the technical precondition for their records to be found and read securely at the point of care, rather than depending on incompatible national identifiers. For health systems, it imposes a fixed calendar of national notifications, wallet issuance and assurance upgrades that must be met if cross-border data exchange is to work in practice.

Source: Official Journal of the European Union, L series, 22.9.2026, 2026/2099 (official reference: CELEX:L_202602099).