The European Commission has adopted rules requiring EU countries to issue healthcare identity attributes to European Digital Identity Wallets on request, with healthcare providers required to accept them for cross-border health-data exchanges from March 26, 2029. The regulation also sets phased deadlines for stronger electronic authentication of patients and health professionals.
Commission Implementing Regulation 2026/2099 governs identification through MyHealth@EU, the infrastructure used to exchange personal electronic health data between member states. It was published in the EU’s Official Journal on September 22 and generally applies from March 26, 2027, with later dates for the wallet requirements and higher authentication levels.
Each country must determine which healthcare attributes identify a person in connection with their electronic health records and notify the Commission by March 26, 2028. Those national sets will be published by the Commission. The attributes let providers locate records in the patient’s home health system.
From March 26, 2029, competent authorities must issue those attributes as electronic attestations to a person’s EUDI Wallet when requested. Providers requesting cross-border data must accept the wallet attestations whether the patient makes the request online or in person. The credential contains healthcare identification attributes, rather than the medical records themselves.
For online patient requests, electronic identification must initially meet at least the eIDAS assurance level called substantial. The requirement rises to high on March 26, 2030. Health professionals must also use at least substantial-assurance authentication, rising to high on March 26, 2032. These are the assurance categories established under the EU’s electronic identification and trust services framework.
Member states must designate the entities responsible for identifying, authenticating and authorizing professionals or providers before they request an exchange. National digital health contact points must pass the requesting professional’s or provider’s identification data to the receiving contact point alongside the patient’s healthcare attributes.
The rules also require checks on the identity and authority of someone seeking access as a patient’s authorized or legal representative.
Wallet integration work is already underway. Poland’s mObywatel Europa sandbox includes healthcare organizations among the sectors invited to test identity verification. Attribute issuance is also developing commercially, with Authologic registered in Poland to issue electronic attestations that can carry verified information about a wallet holder.
Sources: European Commission
–
By the ID Tech Editorial Team
