Challenges and proposals on the future Spanish Digital Health Law

Background

On 22 September 2025, the Ministry of Health launched the prior public consultation on the draft of Spain’s future Digital Health Law. This new law aims to align Spanish legislation to Regulation (EU) 2025/327 on the European Health Data Space (EHDS), which will be applicable from 2027 onwards.
The future Digital Health Law will establish the connection with the European EHDS platforms, facilitate the primary use of health data through an interoperable electronic health record, regulate the secondary use of health data and digital therapies, and define the rights and obligations of patients, professionals and operators.

The future Digital Health Law will establish the connection with the European EHDS platforms, facilitate the primary use of health data through an interoperable electronic health record, regulate the secondary use of health data and digital therapies, and define the rights and obligations of patients, professionals and operators.

Secondary use of data

One of the most relevant aspects of the Digital Health Law for the pharmaceutical sector is the secondary use of data.

The EHDS Regulation recognises the right to secondary use of health data, that is, the processing of data for purposes other than those for which it was originally collected. In essence, this means being able to use data obtained at a given moment for subsequent activities such as research, improving healthcare, or developing and implementing public policies.

Secondary use is particularly relevant for companies for two reasons: as data holders, they are obliged to make certain categories of information available (e.g. clinical trial data); and as researchers, they may request access to data through the mechanisms provided by the EHDS to promote innovation and research.

Challenges posed by secondary use of data and our proposals

Secondary use of health data presents two main challenges:

On one hand, it poses significant challenges in terms of confidentiality and the protection of intellectual and industrial property. Data generated by pharmaceutical companies – especially from clinical research in Spain – are protected by intellectual and industrial property rights as well as trade secret regulations. The improper disclosure of such data could amount to unfair competition and compromise the scientific integrity of clinical trials. Therefore, access to this information must be subject to legal, organisational, and technical safeguards that ensure its protection, limiting its use until the study concludes, within secure environments, and in full compliance with European and national regulations. These measures should protect both the economic interests of data holders and patient safety.

On the other hand, secondary use of data also raises governance challenges, particularly in Spain, where healthcare organisations depend on both national and regional public administrations.

In the context of the prior public consultation, our proposals regarding requests for access to data for secondary use are as follows:

1) Require that access to protected health data be always subject to legal, organisational, and technical safeguards ensuring adequate protection.

2) Incorporate the non-binding standard contractual clauses established by the EU for confidentiality agreements under the EHDS Regulation.

3) Require healthcare organisations to inform and request approval from the data holder when an access request includes data subject to industrial property rights or trade secrets.

4) Ensure that access to protected data is only authorised within secure environments as defined in the EHDS Regulation.

5) Allow data holders to challenge access to information decisions before the competent body and the ordinary courts, with suspensive effect until a final decision is issued.

6) Provide that claims concerning access to secondary health data replace administrative appeals, in accordance with Article 112 of Law 39/2015.

7) Include safeguards to prevent the improper competitive use of anonymised data that could harm data holders or competitors.

8) Establish that, in case of doubt about the adequacy of safeguards, access to data be denied.

9) Grant appropriate powers to the national access body to issue binding criteria on the application of the EHDS Regulation, ensuring consistency between regional and national bodies.

10) Ensure that national and regional access bodies include experts in data protection, bioethics, and health impact assessment in order to evaluate ethical aspects of access requests without relying solely on existing ethics committees.

Use of digital technologies in healthcare

Beyond the implementation of the EHDS Regulation, the future Digital Health Law is expected to establish the legal framework for the inclusion and financing of digital technologies as part of the healthcare services offered by the Spanish public system. The law will set out the procedures for determining the conditions for such inclusion, as well as the relevant financing mechanisms.

Our view is that the rules on potential financing of digital health products should be incorporated into the Law on Medicinal Products and Medical Devices on which the Spanish government has already worked and which could be presented to Parliament for approval in the next few months. Alternatively, these rules could be added to the Royal Decree on financing medical devices for outpatients

We also think that given that financing of digital health products and therapies is a challenge that other EU Member States have already addressed, their experience could serve as a reference for Spain. For instance, Germany’s DiGA procedure and France’s PECAN system allow for provisional inclusion followed by a more comprehensive evaluation. In Spain, initiatives already exist to define a financing model – now is the time to formally establish it, balancing agility with rigour in evaluation.