Most EU Member States are further behind on EHDS than official statements suggest

Three EU Member States — Estonia, Finland, and Denmark — have built digital health infrastructure that genuinely works at scale. They score 80 or above on the EHDS Readiness Score. The remaining 24 do not. That gap is wider than most policy discussions acknowledge, and it matters because the European Health Data Space Regulation is now law.

The regulation entered into force in March 2025. Member States have two years to designate Health Data Access Bodies, four years to stand up Secure Processing Environments for secondary use, and an undefined but expected timeline for connecting domestic systems to the EU-wide HealthData@EU infrastructure. These are hard deadlines with real operational requirements behind them.

The gap between a political announcement and an operational system is where most implementation plans go to die.

The pattern is consistent across the middle tier. A country announces EHDS alignment. A ministry publishes a roadmap. A working group is formed. But the operational indicators — a designated and funded HDAB, a functioning Secure Processing Environment, a connected national contact point — remain unchanged. Germany has thirteen months of consultation on the Gesundheitsdatennutzungsgesetz. France has the Health Data Hub but no designated HDAB under EHDS terms. The Netherlands has strong governance frameworks but incomplete infrastructure.

The primary use asymmetry

MyHealth@EU — the cross-border infrastructure for patient summaries and ePrescription — is the most visible piece of EHDS implementation. Twenty countries are connected for patient summary exchange. But the numbers obscure a structural asymmetry: most connected countries can receive patient data from other countries but are not yet sending. Receiving is technically simpler. It requires a national contact point that can accept standardised data. Sending requires the national health record infrastructure to produce that data in the required format — a harder problem that requires domestic system integration.

Estonia, Finland, and Denmark send and receive across all four MyHealth@EU services (patient summary and ePrescription, both directions). Austria scores 20/20 on primary use infrastructure — full connectivity. But Austria scores zero on secondary use governance and zero on secondary use data infrastructure. The tracker separates these dimensions deliberately. A country that is excellent at cross-border clinical exchange may have done nothing on research data access.

Designation is not operation

The March 2027 deadline for HDAB designation will be met on paper by most countries. The question is what “designated” means in practice. Finland has Findata — a health data permit authority that has been processing applications since 2020, with dedicated staff, a published fee schedule, and a Secure Processing Environment. That is operational. France has named the Health Data Hub as its de facto authority, but the formal EHDS designation is pending, and the scope of its secondary use mandate under EHDS-specific rules is still being defined.

For the twelve countries in Tier C — scoring between 25 and 49 — designation by March 2027 is achievable as an administrative act. Naming an existing statistical office or health ministry department as the HDAB is a political decision that requires no new infrastructure. But an HDAB that cannot process applications, lacks a Secure Processing Environment, and has no published data catalogue is a designation in name only. The regulation requires more than a nameplate.

An HDAB that cannot process applications, lacks a Secure Processing Environment, and has no published data catalogue is a designation in name only.

What the scores tell us

The Tier A countries — Estonia (89), Finland (84), Denmark (80) — invested in digital health infrastructure long before the EHDS was proposed. Their high scores reflect decades of sustained investment, not rapid EHDS-specific implementation. Sweden (71) and France (69) lead Tier B, with strong foundations but gaps in specific areas. The seven Tier B countries are the ones to watch: they have the institutional capacity to reach operational readiness but need to convert political commitment into funded programmes.

Tier C is the largest group — twelve countries scoring 25–49. This is where the implementation gap is most consequential. These countries have partial infrastructure, some legislative progress, and limited secondary use capability. Poland, Italy, Spain, and Czechia are large enough that their readiness directly affects the viability of cross-border health data services. A secondary use ecosystem that works in Finland and Estonia but not in Poland and Spain is not a European Health Data Space — it is a Nordic Health Data Space with a European label.

The five Tier D countries — Malta, Cyprus, Romania, Greece, and Bulgaria — face the steepest climb. Bulgaria scores 6/100. Its digital health infrastructure is minimal, there is no secondary use framework, and EU-funded initiatives have not yet translated into operational capability. The EHDS Regulation applies equally to Bulgaria and Estonia. The implementation timelines are the same. The starting points are not.

What happens next

The first implementing act on EHR data categories was published in March 2026 — defining which health record categories fall under mandatory cross-border exchange from 2027. This is the first concrete operational rule. More will follow. Each one converts abstract regulatory language into specific technical requirements that Member States either meet or do not.

Health Edge will track each of these milestones as they occur. The tracker scores will be updated monthly for primary use infrastructure and on-event for governance changes. The gap between announced readiness and operational reality is the central story of EHDS implementation over the next four years. We intend to measure it precisely.