Starting in March 2029, EU hospitals will become health data holders under the European Health Data Space (EHDS) regulation. From that date, whenever a national Health Data Access Body (HDAB) approves a researcher’s application for health data, it will ask the hospital to supply that data, and the hospital will have, at most, three months to deliver it.
Most hospitals already handle research and registry requests, usually on their own terms. They negotiate the scope with the requester, agree on a format, and set a timeline that fits their team’s capacity. EHDS takes that flexibility away. Requests will arrive whenever an HDAB approves one, with the variables and format already fixed, and a hospital that misses the deadline can face fines of up to EUR 10 million.
Few hospitals have estimated what that obligation will cost them. This post breaks down where the cost of a data request comes from and why it repeats, so you can size it for your own hospital with our EHDS cost calculator before the first request arrives.
What EHDS Requires of a Health Data Holder
A health data holder is an organisation in the health or care sector that controls electronic health data covered by the regulation. For a hospital, that means the electronic health record and most of the systems around it: labs, imaging, registries and trial data.
The regulation already sets out what data holders must do, and implementing acts due in March 2027 will fill in the technical details. The duties fall into four parts:
- Describe your data. Every data holder sends its HDAB a description of the datasets it holds and checks it at least once a year, whether or not a request ever arrives, according to Article 60(3).
- Deliver on request. Hospitals must put the requested data at the HDAB’s disposal no later than three months from when the HDAB receives the request, according to Article 60(2). The HDAB’s own processing comes out of that window, so a hospital may have far less than three months to prepare the data. The HDAB can extend the deadline by up to three months in justified cases.
- Claim your costs. HDAB fees must be proportionate to the cost of making data available, and they can include compensation for the data holder. Hospitals estimate their preparation costs and send them to the HDAB, according to Article 62.
- Meet the deadline or face fines. Breaching data holder duties can bring fines of up to EUR 10 million or, for an undertaking, 2% of worldwide annual turnover, whichever is higher, according to Article 64.
Compensation covers less than it might seem. Hospitals recover their documented preparation costs through the HDAB’s fee, but the fee adds no extra staff. The hours still come from the same data team that handles today’s research and registry requests, inside the same three-month window.
Some member states may also offer hospitals a second role. Under Article 72, a hospital can apply to become a trusted health data holder. In exchange for meeting stricter requirements, it takes on more of the request process itself. A trusted data holder runs its own secure processing environment (SPE), where researchers work with the data without receiving an extract. It also reviews applications that cover only its own data, and it charges fees directly for the cost of maintaining the SPE.
Where the Cost of a Data Request Comes From
Every EHDS data request travels the same path. The hospital reads the request, finds the data, trims it to what the permit approves, reshapes and codes it, and anonymises or pseudonymises it. It then delivers the dataset to the HDAB, which gives the researcher access inside a secure processing environment.
Two of those steps carry most of the effort.
- Finding the data means tracking down every requested variable across EHR, lab, imaging, and registry systems; then working out how each one was derived.
- Reshaping and coding it means converting everything to the format the request specifies and mapping local codes to standard vocabularies.
Both steps rely on the few people who know how the hospital’s systems fit together. Neither step produces work the team can reuse on the next request. Each request names its own variables and target format, so last month’s extract rarely fits this month’s request. Unless the data is already mapped, the team tracks down the same tables and maps the same local codes all over again.
Hospitals already absorb that cost for research and registry extracts on timelines they control. EHDS has the potential to add a steady stream of requests on a three-month clock, and every one of them starts from zero without investment in technology that can bend the cost curve.
How to Estimate What EHDS Requests Will Cost Your Hospital
The EHDS cost calculator estimates the staff time those two steps take today and from 2029. It asks for:
- the data extract requests you handle today, per year
- your average cost per staff hour, including employer costs, and hours per staff day
- staff days per request today, as a low and a high estimate
- the share of today's requests you expect to move to the EHDS route
- EHDS data requests you expect per year from 2029, as a low and high guess, with annual growth
If you expect EHDS requests to take longer than today's extracts, you can set their staff days separately. The calculator assumes about 220 working days a year and shows effort before any compensation. It leaves effort blank on purpose, because every data estate is different. Base yours on your last few extracts: one quick, one hard.
Take a hospital that handles 10 research and registry extracts a year, with a staff day costing EUR 440. A quick extract takes half a day to find and reshape; a hard one takes 20. EHDS adds 3 to 12 requests in 2029, each taking 1 to 20 staff days.
Today, that work takes 5 to 200 staff days a year, or EUR 2,200 to EUR 88,000. EHDS adds another 3 to 240 staff days, or EUR 1,320 to EUR 105,600. In 2029, the total comes to 8 to 440 staff days, or EUR 3,520 to EUR 193,600.
The low end represents a manageable cost center for organizations that may not see volume requests. At the high end, EHDS more than doubles the workload and takes at least two full-time staff a year to keep up.
These figures rest on the regulation as written. The technical specifications that set data formats and terminologies are due in March 2027, so some details are still open. Work from the TEHDAS2 joint action already shows where they’re heading: fixed data formats and standard terminologies for every request. If the final specifications demand more, the reshaping and coding step grows heavier, and your real cost could land well above your high estimate. The calculator lets you set staff days for EHDS requests separately from today’s extracts for that reason.
Want to see the cost for your organization? Run your own numbers in the calculator.
Map Once, Then Run Every Request
Hospitals redo the finding and reshaping for every request because work for previous requests cannot be reused. If the data is mapped to a standard model once, every later request runs against data that’s already been found and coded.
Rhino Data Activation, built on the Rhino FCP, takes that approach. Its Data Harmonization Engine maps a hospital’s data to standard models once, inside the hospital’s own infrastructure. Each request then runs as a configured job, with a record of what was done and when, and only the dataset allowed by the permit goes to the HDAB. One large academic medical centre mapped more than 600 million records this way and now creates new target profiles in one to two days.
The first EHDS requests arrive in 2029, and budgets for that year get set well before then. Enter your own figures in the EHDS cost calculator to see what EHDS will add to your workload, then download the summary to share with your CIO or finance lead. To find out how much of that work you’d only need to do once, we invite you to plan out how you will address your first request with us in a working session.
