A European Yellow Button to Break Silos and Empower People

EU’s EHDS Regulation grants people new digital health rights: immediate readable access, portability in the EEHRxF format, transparency, restrictions, opt-out, the ability to add notes, proxy access and rectification, with providers obliged to accept patient-supplied data. Yet access across Member States remains uneven. The xShare ‘yellow button’ enables citizens to download or share data in EEHRxF via secure links, helping connect care, research and public health workflows.

Key Points

• EHDS grants citizens new digital rights over their health data.
• People can access, port and rectify records, or add notes and proxies.
• Providers must accept and use patient-supplied data.
• Access to electronic health data still varies across EU Member States.
• xShare’s yellow button enables EEHRxF downloads and secure sharing.

The European Health Data Space (EHDS) Regulation (EUR-Lex 2025), published on 5 March 2025, introduces new digital health rights for natural persons[1] in the EU. These rights go beyond the General Data Protection Regulation (GDPR) (EUR-Lex 2016), by focusing specifically on electronic health data access, portability and control. The EHDS Regulation also explicitly specifies the format in which data are accessed and shared, called the European Electronic Health Record exchange Format (EEHRxF, ehr-exchange-format.eu). This format enables full (semantic) interoperability of health data across systems used by healthcare professionals as well as patients themselves. In this article, we explain why this format along with the xShare yellow button will not only impact significatively the communication between all people involved in the healthcare journey but will also have many other far-reaching impacts.

Key Rights of Natural Persons Under the EHDS

Like all regulations and legislative frameworks, the EHDS consists of many different articles. Many of these articles refer to patient rights. Articles 3–10 of the EHDS define the following new rights:

• The right to an immediate access to electronic health data in a readable, consolidated format.
• The right to download health data and their portability in the new format (the EEHRxF).
• The right to full transparency. Patients can view who has accessed their data, including in an emergency (“break-the-glass”) cases.
• The right to apply restrictions. Patients may limit which providers see their data.
• The right to opt out. Patients have the (reversible) ability to opt out of national electronic data services. The precise modalities remain, however, to be defined by each Member State.
• The right to contribute data. Citizens may add personal notes or health information to their own electronic health record (EHR) (the notes/information will be clearly marked as patient-supplied).
• The right to allow proxy access. Citizens may appoint authorised representatives of their own choice. Those choices should be accepted by all European Member States.
• The right to rectify information. Citizens may request corrections to inaccurate records, with providers being responsible for verifying the corrections.
• The obligation for providers to accept and integrate patient-supplied data in the EEHRxF format. Whenever an individual has downloaded data from the electronic health data access services (in the EEHRxF), they shall be able to transmit that data to a healthcare provider of their choice.

Although the EHDS provides additional rights to the European citizen, this modification does not “cancel” the rights defined in the GDPR. This is the case, for example, for rights such as: the request of erasure of personal data under certain conditions, the right to withdraw consent at any time or the right to object to or restrict the processing of personal data under certain circumstances. As experience has shown (Publications Office of the European Union 2021), the concrete and consistent implementation of these rights in the different Member States has been somewhat challenging. In this respect, the rights outlined in the EHDS Regulation seem to be more consistently implementable than in the GDPR.

The provision of healthcare remains, of course, a key responsibility of the Member States, over which the European Union (EU) has little power (this is the well-known “subsidiarity principle” which is key to the Treaty on the EU). Much will thus depend on the way in which Member States can exercise these rights in their dealings with individual healthcare provider organisations and with the services that are to be provided by the Member States.

What is the Current State of Play of Patient Access to Health Data in the EU?

The 2025 edition of the EU Commission-sponsored eHealth indicator study (European Commission 2025), based on 2024 data, mentions that – technically – 23 Member States of the EU report that at least 80% of their population has access to online access services. But the report outlines several challenges with several recommendations made to Member States. Namely:

• More efforts should be made to involve the private sector and some segments of the value chain such as nursing homes, mental health facilities or rehabilitation centres. Only nine Member States have connected all categories of healthcare providers (and thus the applications used by them).
• The delay is still too long in making data available to the patient, and certain types of data such as medical images, medical devices or implants or allergies remain either undocumented or unavailable. The number of data types available varies from two to 13 (identification and personal information are considered as data types). Prescriptions and dispensations are by far the most accessible data.
• Proxy services which allow authorised individuals to have access to data are insufficiently prioritised by Member States.
• Universal coverage and inclusiveness (covering aspects of accessibility and user friendliness) are still very much work in progress in many EU Member States.

The figure 2 provides an overview of the current situation based on the composite index of the eHealth indicator study. Seven countries (Belgium, Denmark, Estonia, Lithuania, Malta, Poland and Norway) are compliant with at least 91% of the criteria outlined in the index. The index, however, measures the accessibility of information types by the citizen without considering the format used for those data. Thus – even if most EU countries are now actively evolving positively towards the 2030 EU goal that 100% of citizens should have access to their health data by that year – the major changes introduced by the EHDS Regulation introduce important new challenges.

xShare Project: Giving the Citizen the Power and Means to Act Upon Data

Funded under the Horizon Europe scheme, the xShare project (xshare-project.eu)is both an implementation and an innovation project. It involves implementation because it anticipates the use of the EEHRxF – based on currently available HL7 FHIR specifications for the different formats (eg prescription, dispensation, patient summary, medical imaging report, laboratory report and hospital discharge report) in real life contexts. xShare is also about innovation because it creates actual possibilities for patients to have access to their data in the EEHRxF structured and coded format.

What is the xShare Yellow Button?

Thanks to the xShare yellow button, the citizen can be guaranteed to access, download and share their key health information data in the compliant EU format. This opportunity can lead to many new developments. While there is, of course, direct added value for citizens themselves, there are also advantages key actors in the healthcare system. The button is also a major element in enhancing human-machine communication, paving the way towards for example more personalised and interactive care pathways, possibly supported by artificial intelligence (AI).

The EU EHDS Regulation stipulates that it is up to each Member State to decide how to implement concretely the patient rights described at the start of this article. Typically, the access services can be implemented by a Member State, either via a central portal or via regional or local systems. The Regulation also stipulates that these services should be offered free of charge, without delay and without hindrance from the healthcare provider or the manufacturers of the systems used by that healthcare provider. Increasingly, European citizens also have access to mobile applications, developed either by public authorities or by the market, which are directly connected to validated data-sharing architecture.

Designers of the xShare yellow button have defined generic specifications which can be implemented by all systems, thus providing a very high level of agility[2] – even in countries where digital health data-sharing infrastructure is still immature. The yellow button does not cover all the spectrum of rights defined in the EHDS Regulation but focuses on a central element: the capacity of a citizen to act on their own data. The yellow button is currently being tested in eight adoption sites in Cyprus, Denmark, France, Greece, Ireland, Italy, Portugal and Spain (xShare Project 2025).

What Does the Yellow Button Allow a Person to Do?

The yellow button enables natural persons to share their health data in a new format, the EEHRxF, by offering them two main capabilities:

• Downloading of their health data: The citizen may view their health data and select from the available health data to download, optionally configuring download options (eg format, translations, pseudonymisation), and downloading the selected content to a chosen destination.
• Healthdata-sharing by using a one-time link: The button generates a Smart Health Link with the selected content. The Smart Health Link is provided to a natural person who can then access the data. Optionally, the link only remains valid for a limited time-period. This function allows the patient to share or “upload” the data.

Opening Up New Exciting Avenues

The availability of the EEHRxF and its activation by the citizen through the yellow button creates the conditions for concretely breaking down barriers between clinical care, clinical research, and public and population health. It can thus create foundational bridges between primary and secondary uses of data, with the prospect of significant efficiency and efficacy gains and the creation of new patterns of use.

The xShare project has been studying carefully all the main data elements which are necessary to support continuity of care and important requirements for clinical research and population health. The project has defined a new specification called “IPS+” (International Patient Summary+) which adds only a few additional elements to the current patient summary specification. It is important to note that the objective of the IPS+ designers was to focus on the elements which can easily be undertaken by clinicians, while having a very significant impact, and not to increase the burden on healthcare practitioners.

In the xShare project, we have made this aim of connecting the two worlds, very real and specific, and have co-created use cases together with clinical research and population health actors. We provide here three concrete examples. The cases refer to the secondary uses of data, which is yet another aspect of the benefits to be facilitated by the EHDS Regulation:

Connecting to a clinical investigator pre-screening tool:This tool is under the control of the healthcare professional. It indicates theclinical trial studies for which a patient is potentially eligible and facilitates the relationship with investigative teams. Alternatively, the EEHRxF is made available in a dedicated secure environment. If the patient agrees to take part in a study, their data are shared with the research team using the xShare yellow button. In addition, data inserted in the clinical trial tool are shared with the EEHRxF to update the patient’s patient summary, including an audit trial of the data source. A patient might, of course, also investigate the existence of any ongoing clinical trials and decide proactively to use the EEHRxF and yellow button to share their own data.

There are many other possible implications of this tool. To name only a few, they include testing a protocol feasibility via a repository of IPS+ summaries at eg a hospital, regional or national level, supporting the protocol definition or assessing a study site’s feasibility.

Working on longer-term assessments of patients’ conditions: In the public and population health domain, there are many positive implications emerging potentially from the use of the yellow button. One of them is the capacity to identify patients who meet specific clinical criteria and – thanks to the EEHRxF – to include them in a specific longitudinal cohort. Thus it offers the capacity for entry into what has been called the age of quaternary prevention.

The Global Family Doctor Association, WONCA (WONCA n. d.), explains that “quaternary prevention provides a complex but necessary approach oriented to provide person-focused care; promote equity in healthcare; prevent overdiagnosis, unnecessary interventions and avoid harm: and so, in few words, to humanise medicine. All the efforts within this global movement combine ethical sustainability with critical thinking, to oppose the vision of health as a commodity.”

In the xShare project, we explored various options – long COVID, hypertension and long-term pharmacovigilance. One example was the capacity to identify patients who have possibly been affected by long COVID. These patients are often faced with conflicting diagnoses and a lack of adequate follow-up. Identifying patients, who have either been diagnosed as having long COVID or who are affected by symptoms associated with the condition, would enable the patients to be oriented towards adapted dedicated structures, to build longitudinal cohorts and consolidate knowledge and clinical guidelines with the direct support and input of the patients. Ideally, this initiative would require access to repositories which include data from a global population. Even pending the complete implementation of the EHDS Regulation, however, the yellow button will enable citizens to become active contributors to knowledge update and consolidation and hence of treatment improvement. A second example was related to the prevalence of reported side-effects of anti-hypertensive drugs and their association with disease and drug characteristics in patients with chronic hypertension. A third example for consideration would be the impact for long-term pharmacovigilance objectives, such as those outlined by the Darwin project (darwin-eu.org) under European Medicines Agency (EMA) guidance.

Reverse engineering: Many structured data are currently only produced fora secondary non-clinical objective. As an example, data produced to feed national cancer registries are not available to the patient. If important registers were to implement the yellow button, this would allow a patient to access and possibly re-use those data – after clinical revalidation – in the context of a “survivorship passport”, such as the one implemented for children and teenagers (PanCare SurPass, pancaresurpass.eu). The rapid development of AI, as well as its possible supporting coaching role in people’s daily activities, is also adding an incentive to this potential workflow.

Conclusions

The EHDS Regulation puts the citizen at the centre and provides fundamental rights which must be implemented by each European Member State. Progress has already been made, although much remains to be done in most EU countries. Today, national or regional health data-sharing infrastructures have reached different levels of maturity. Having access to data does not guarantee that citizens can “act” on those data. The xShare yellow button, however, provides an immediate solution which allows a citizen to download and share their data in the EEHRxF with the click of a button, even when public infrastructures are not mature. It builds entirely new bridges between clinical care, clinical research and public health.

Conflict of Interest

This article is based on the work of the xShare project which is co-funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Health and Digital Executive Agency (HADEA). Neither the European Union nor the granting authority can be held responsible for them.