Health prepares law to regulate the use of big data in research and clinical trials

The Ministry of Health, through the General Secretariat for Digital Health, Information and Innovation of the National Health System, has launched a preliminary public consultation in order to gather comments and proposals from citizens, stakeholder organisations and entities in relation to the future Digital Health Bill.

This consultation will be open until 20 October 2025, and contributions can be submitted by means of the electronic form available on the Health website..

The text aims to adapt the Spanish legal system to Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space (EHDS). This regulation establishes a common legal framework for interoperability and the ethical and secure use of health data at EU level.

The law also aims to address the use of digital technologies and to establish the conditions for the processing of personal health data in the National Health System for purposes of public interest.

The regulation responds to the need to address the following challenges:

1. Ensure individuals' rights over their electronic health data: European Regulation 2025/327 gives citizens a set of rights regarding access, use and protection of their electronic health data. However, in Spain, due to the division of responsibilities, it is necessary to define the obligations of the different health authorities so that any person can exercise these rights regardless of the autonomous community in which they are located or the type of healthcare provider, public or private, that they use.
2. Establish governance of the primary use of health data: currently, the primary use of electronic health data - which takes place in direct patient care - is carried out within a national governance structure that is insufficient to ensure full interoperability and integration with European initiatives. The law establishes a new model in which the autonomous communities, as regional digital health authorities, will be coordinated by a national authority - assumed by the Ministry of Health - which will represent Spain in European bodies and will be responsible for ensuring the connection with the community network MiSalud@EU, thus enabling continuity of care for patients throughout Europe.
3. Establish governance of the secondary use of health data: in addition to its use in direct clinical care, health data has enormous value for biomedical research, technological innovation, public health surveillance and health policy formulation. However, the secondary use of these data currently lacks a legal framework that is sufficiently agile, comprehensive and interoperable with the European system. The new law will establish, in line with the European Health Data Space Regulation (EHDS), an additional organisational and regulatory framework for the processing of personal health data. To this end, regional bodies and a national body for access to health data - whose functions will be assumed by the Ministry of Health - will be set up to act in a coordinated manner and will be integrated into the European infrastructure DatosSalud@EU. This structure will make it possible to manage requests for access to data with ethical, legal and security guarantees, favouring their use in areas such as biomedical innovation, epidemiological surveillance or the development of artificial intelligence algorithms, without compromising the confidentiality of individuals. Furthermore, within the National Health System, the law shall establish specific conditions for the use of personal health data available for purposes of public interest by the health administrations, establishing the appropriate protection measures and limitations.
4. Extend the national interoperable digital health record to the private sector: currently, the interoperable digital health record operates at the level of the National Health System, but does not include private providers. This creates inequalities, as patients seen in both sectors may not have unified access to their clinical information. The new regulation aims to correct this situation by integrating private providers into the system, thus ensuring that everyone has access to their health information in a standardised way and that professionals have access to complete and quality data for care.
5. Regulate the use of digital technologies in healthcare: the rapid advance of tools such as artificial intelligence, biometrics or neurotechnologies poses opportunities, but also risks for safety, ethics and patients' rights. There is currently no national regulatory framework that explicitly regulates how these technologies can be used in care. The law incorporates specific rules defining the rights and duties of patients and professionals in the use of these tools, and establishes additional safeguards when it comes to sensitive applications, such as identification through biometric data or the use of neurotechnologies that may influence perception or behaviour.
6. Establish conditions for the uptake and funding of digital health products: digital health products - such as apps, connected devices or monitoring systems - are an increasing part of clinical practice. However, until now there has been no clear legal framework regulating their incorporation into the basic portfolio of the National Health System or their financing. The law establishes the criteria that these solutions must meet (such as interoperability and the contribution of data to the national information system), with the aim of ensuring that their use provides value, security and fair access.

Non official translation