European Health Data Space

Sharing health data is not the problem.
Building the trust to do it, is.

nexyo delivers the trust infrastructure that turns the EHDS from legislation into clinical reality. FHIR-native, policy-driven, auditable.

Open the demo → 2-pager (PDF)
27
EU member states
obligated
74M+
Patients in DACH
(ePA + ELGA)
2029
Deadline for
primary use
60+
nexyo Hubs
in production
nexyo Trust Layer KHospital PPractice FResearch RxPharma HHDAB AIAI Agent
EHDS binding since March 2025 FHIR in 71% of EU countries Primary use from March 2029 Since 2019 IDSAGaia-XDCAT-AP
Use Cases

From legislation to clinical practice

Eight use cases: from structured referrals to AI agents. Each solves a concrete trust and contract question.

Primary Use

Structured Referral

Referral letters as FHIR bundles instead of faxes: encrypted, with patient consent, delivered in under 30 seconds.

< 30s transfer -60% queries
Secondary Use

Quality Registries & Benchmarking

Anonymized treatment outcomes in peer comparison. Medical chamber as trustee.

> 70% participation PPRL secured
Primary Use

Tumor Board & Second Opinion

Structured case discussion in encrypted Matrix rooms. DICOM images securely referenced.

3 days instead of 14 E2EE Matrix
Secondary Use

Research Data Access via HDAB

Standardized data access for research. Federated catalog, automated approval, secure processing.

Weeks instead of months 1 policy instead of n contracts
Primary Use

Cross-Border Patient Summary

Patient data available cross-border. IPS via MyHealth@EU, retrieved in seconds.

< 10s availability EUDI Wallet
Agentic

AI-assisted Diagnostics

Diagnostic agents as controlled participants with their own credentials, policies, and audit trail.

Agent VC per access AI Act compliant
Secondary Use

Pharma Real-World Evidence

Regulated evidence generation from real-world data. Pseudonymized, in secure processing environments.

Millions of records Diff. Privacy
Agentic

Public Health Surveillance

Real-time syndromic data for early detection. Surveillance agent detects anomalies before reporting chains kick in.

Hours instead of weeks Aggregates only
Regulatory Context

The EHDS regulation is mandatory for all 27 member states

Regulation (EU) 2025/327 has been in force since March 2025. Unlike a directive, it applies directly, with no national transposition required.

March 2025

Regulation enters into force

EHDS Regulation published in the Official Journal. Directly applicable in all 27 member states.

June 2025

National authorities designated

Each member state designates a National Digital Health Authority (NDHA).

March 2027

Implementing Acts & EEHRxF

Commission adopts implementing acts. European Electronic Health Record Exchange Format (EEHRxF) formally established.

March 2029

Primary use goes live

MyHealth@EU: Patient summaries, ePrescriptions, eDispensation available cross-border.

March 2031

Full deployment

Medical images, lab results, hospital discharge reports. Full interoperability.

Primary Use

MyHealth@EU

The patient at the center. A patient in Vienna should be able to access their records from Munich: structured, machine-readable, in real time. Eleven member states already exchange patient summaries.

Secondary Use

HealthData@EU

Health data for research and innovation, via Health Data Access Bodies (HDABs) as national gatekeepers. Opt-out instead of opt-in. In Germany, the GDNG enables access to data on 75 million insured people.

The Problem

Six gaps between regulation and reality

🔌

Interoperability

71% of EU countries use FHIR, but each with its own versions, profiles, and terminologies. ICD-10-GM, SNOMED CT, CDA: a tower of Babel in healthcare.

🏛

Governance

Every member state needs at least one HDAB. Most start from scratch: staff, software, and processes still have to be built. Frameworks need software to operationalize them.

✍️

Consent

Three consent models side by side (Tiered, Broad, Opt-out), but most hospitals manage consent on paper. Consent digitally linked to policy enforcement remains the exception.

🔒

Security

Ransomware attacks on hospitals tripled between 2022 and 2025. Every new EHDS API is a new attack vector. Legacy systems from the 2000s now face security requirements at financial-sector level.

🌐

Decentralization

27 member states, 27+ HDABs, thousands of data holders, hundreds of thousands of researchers, all connected via a federated network. Without standardized software infrastructure, this is unsolvable.

🤖

AI Agents

AI agents increasingly access health data autonomously, often without clear authorization, dedicated credentials, or an audit trail. Neither the GDPR nor the EHDS fully addresses this gray area.

nexyo makes trust operational: with a formula of four components.
Trust Layer

Trust is not a feeling. It is a formula.

Every component must be technically implemented, organizationally governed, and legally secured. If one is missing, trust is missing.

Trust = Identity + Agreement + Enforcement + Audit
🔑 Identity eIDAS 2.0 · EUDI Wallet W3C DID · Verifiable Credentials + 📜 Agreement ODRL-Policies Purpose · Duration Usage Contracts + 🛡 Enforcement Policy Engine (OPA) Attribute-Level Control Automatic Validation + 📋 Audit Tamper-proof Logging Compliance-Reports

Identity

Who is the participant? Four-tier Credential Cascade: eIDAS 2.0, EUDI Wallet, W3C DID, Verifiable Credentials. Every participant, human or agent, carries a cryptographically signed credential.

Agreement

Under what conditions? ODRL policies encode purpose limitation, region, duration, anonymization. Machine-readable and enforceable, replacing legal prose in PDFs.

Enforcement

Is the agreement enforced? Policy Engine (OPA) checks every access in real time. Attribute-level enforcement down to FHIR field level. Automatic consent linkage.

Audit

Is everything provable? Every access is recorded in a tamper-proof log: who, which data, under which policy, when, with what result. Directly exportable for HDABs and the EU Commission.

Credential Cascade for Health

Trust is delegated level by level: from the EU through the medical chamber down to the individual participant.

LEVEL 1 Root Trust Anchor eIDAS 2.0 EUDI Wallet EU Level LEVEL 2 Domain Issuer Medical Chamber HDAB · NDHA National Level LEVEL 3 Operational Issuer nexyo as Trust Service Provider Platform Level LEVEL 4 Participant Hospital · Practice Pharma · AI Agent Participant Level

From data exchange to automated compliance: four building blocks

Block A

FHIR-native Health Data Space Platform

Sovereign health data exchange based on the EDC connector. Register FHIR servers as assets, policy engine as proxy, automatic EEHRxF validation. Three-hub model: Trust Provider, Data Provider, Service Provider.

FHIR R4 EDC Proxy Legacy Mapping
Block B

HDAB-Enablement Platform

The operational foundation for Health Data Access Bodies: permit management, federated data catalog, researcher portal, compliance reporting, opt-out management. All in one system instead of email chains.

HealthDCAT-AP Permit Workflow Opt-out
Block C

Sovereign Data Exchange

EDC as foundation, multilateral policies instead of bilateral contracts (n instead of n²), multi-stakeholder orchestration for hundreds of participants. Gaia-X, IDSA, and iSHARE compliant.

Eclipse EDC Gaia-X iSHARE
Block D

Compliance Agent

Automates recurring compliance checks: legal basis, HDAB approval, opt-out, format conformity. The Pattern Factory codifies patterns from every engagement into automated modules.

Pattern Factory OPA ODRL
Interoperability

FHIR-native from the ground up

nexyo processes FHIR R4 natively, without an adapter, mapping layer, or conversion step. The Data Trust Hub ingests FHIR bundles directly, validates against EU profiles, and enforces terminology compliance.

Validation

Every bundle is validated against HL7 Europe EU Base and Core Profiles. Non-conformant resources are rejected with structured feedback.

Terminology

SNOMED CT, LOINC, ICD-10: the policy engine checks whether coding systems meet EEHRxF requirements and flags deviations.

De-identification

Automatic pseudonymization for secondary use. PPRL enables cross-dataset research without exposing identities.

Supported FHIR Resources

Patient Observation Condition MedicationStatement AllergyIntolerance DiagnosticReport ImagingStudy Encounter CarePlan Composition MeasureReport Bundle (IPS)

Technical Standards

HL7 FHIR R4 EEHRxF Eclipse EDC ODRL W3C DID / VC eIDAS 2.0 SNOMED CT LOINC ICD-10 Matrix Protocol Gaia-X HealthDCAT-AP
Health Data Space Sandbox

Who we build the Health Data Space for

Software instead of PowerPoint: six demo organizations let you test governance, data flows, and FHIR integration in a live sandbox.

💊

Pharma

Secure exchange of sensitive research and trial data with partners, authorities, or AI service providers, legally sound and traceable.

🩺

Medical Chambers

Transparent, rule-based data transfer across the healthcare network, fostering cooperation, quality, and data sovereignty.

🤖

AI Service Providers

Access to trustworthy, compliance-ready datasets for the safe development of medical AI solutions and digital innovations.

Health Data Space Mitglieder

Member overview in the Data Trust Hub

📊

FHIR-native

Process FHIR bundles with validation and terminology checks

🔒

Purpose Limitation & Consent

Granular control of usage, duration, and onward sharing

👤

De-identification

Pseudonymization and PPRL for research & analytics

⚡

Matrix Realtime

End-to-end encrypted communication in real time

⚙️

Automatable

Bots, webhooks, and bridges for seamless integration

📋

Audit-ready

Complete traceability for audits & compliance

Agentic Health

AI agents need a Trust Layer, just like humans

Diagnostic agents analyze imaging data, therapy agents evaluate patient histories, research agents search data catalogs. A Trust Layer is what makes audit, authorization, and routine operation possible.

nexyo Trust Hub Policy · Credentials · Audit 🤖 Diagnostics Agent Imaging, Reporting 💡 Therapy Agent Guidelines, Recommendations 🔬 Research Agent Cohorts, Studies 📈 Surveillance Agent Outbreaks, Trends

Agent Credentials

Every AI agent receives its own Verifiable Credential with purpose, organization, and access rights.

Policy Binding

ODRL policies bind directly to agent access: diagnostics allowed, training excluded. Attribute-level granularity.

EU AI Act

High-risk AI requires transparency, explainability, and human oversight. Every agent access is auditable.

Agentic Mesh

Agent-to-agent workflows: policy checks, contract acceptance, data transfer, audit, all via Matrix.

EU AI Act + EHDS = Trust Layer obligation

The AI Act classifies AI in healthcare as high-risk. Documented risk assessments, transparent decision processes, and end-to-end traceability are mandatory. Without a Trust Layer, AI agents may not be operated in healthcare.

Governance & Compliance

nexyo operationalizes EHDS governance

Six governance functions that make the EHDS manageable for data holders, HDABs, and participants.

📋

Permit-Management

Standardized approval process for secondary use. Automatic compliance checks, transparent status tracking.

🔍

Federated Data Catalog

Decentralized data catalog based on HealthDCAT-AP. Metadata aggregation across all participants, standardized data descriptions.

🛡

Policy Enforcement

ODRL policies, OPA real-time checks, attribute-level control at FHIR level. Usage rules are technically enforced.

👤

Consent & Opt-out

Digital consent management: tiered consent, broad consent, digital opt-out with real-time propagation to all data access.

📊

Audit & Reporting

Tamper-proof audit trails, automated reports for HDABs, EU Commission reporting. GDPR accountability obligations covered.

🤖

Agent Governance

AI agents as controlled participants: agent credentials, purpose-bound authorization, EU AI Act compliance, Pattern Factory.

Platform

Three layers. One Trust Layer.

Open source as foundation, proprietary intelligence as differentiation, consulting as entry point.

Layer 3

Consulting Services

EHDS readiness · FHIR migration · HDAB setup consulting · Pattern Factory input

Layer 2

nexyo Solutions (SaaS)

Data Trust Hub · Policy Engine · Federated Catalog · Compliance Platform · Agent Orchestration

Layer 1

TDS Fabric (Open Source)

Eclipse EDC · DSP/DCP · IDSA · Gaia-X · iSHARE · FHIR R4

Health Data Space: Reference Architecture

Three hub types form the federated network: Trust, Data, and Service.

TRUST PROVIDER HUB Identities · Credentials Policies · Federated Catalog Operated by nexyo DATA PROVIDER HUB Provide FHIR data under own control Hospital · Practice · Registry SERVICE PROVIDER HUB Consume data after policy approval Researcher · Pharma · AI Provider

Proven in the field.

20+

Projects delivered

60+

Hubs in production

6

EDC participants in Health Sandbox

78K+

Data assets managed

Roadmap

From sandbox to platform

2026 (Now)

Foundation

  • •Health Data Space Sandbox (6 EDC participants)
  • •Pilots with medical chambers in AT/DE
  • •FHIR certification
  • •First EHDS readiness assessments
2027–2028

Scaling

  • •HDAB Enablement Platform
  • •EU tenders for HealthData@EU nodes
  • •Compliance Agent MVP
  • •Cross-border pilots (3+ countries)
2029+

Platform

  • •Multi-country HDAB SaaS
  • •Cross-border data sharing in routine operation
  • •Agentic Health Services
  • •EU-wide MSP distribution
nexyo Health, Teilnehmer

Participant management in the Health Data Space

nexyo Health, Data Assets

Data assets: FHIR resources with policy control

nexyo Health, Connect

Secure connections between participants

Interactive Demo

nexyo Health Console: experience it live

The Health Console shows how nexyo Trust Infrastructure works in practice: analyze patient data, review governance, track compliance, all in one application.

📊

Patient Analytics

Cohort analysis, diagnosis distributions, age and gender demographics, based on FHIR R4 resources.

🛡️

Governance Dashboard

Health score, trust formula, metadata quality, and asset classification: governance at a glance.

✅

Compliance Tracking

EHDS, GDPR, Data Governance Act, AI Act: compliance scores per regulation, broken down factor by factor.

🤖

AI Health Agent

Ask questions, get answers: the agent knows patient data, standards, governance, and compliance.

How the Health Console works

Data Sources FHIR R4 Server EHR Systems Registry Data nexyo Trust Layer Identity (DID/VC) ODRL Policies Enforcement Audit Trail Health Console Patient Analytics Governance Dashboard Compliance Tracking AI Health Agent 👤 HDAB / Researcher
healthapp.nexyo.io
Launch full-screen demo ↗ Request sandbox access

The demo runs entirely on anonymized sample data.

Contact

Let's talk.

The sooner, the better.

2-pager (PDF)