The EHDS proposal clearly states that “natural persons shall have the right to access their personal electronic health data” immediately, free of charge, and in an easily readable, consolidated, and accessible form [9]. This is not limited to electronic health records (EHRs) data, but considering the EHR's core role for documentation in health care, patients' ORA must be considered essential for EHDS. Article 3, paragraph 2, continues to declare that:

These include patient summaries, electronic prescriptions, electronic dispensations, medical images and image reports, laboratory results, and discharge reports.

Many European countries already have legislation stipulating that patients should have ORA [16]. In Norway, the patient is both the object and the owner of the health record. The Norwegian Patient Rights Act of 2001 states that patients have the right by law to access their health records [38], and in 2013, a White Paper stated that patients should have digital access [39]. Similar legislation is in place in all the Nordic countries [16].

In Germany, the Patient’s Rights Act of 2013 stipulates that health care professionals must document diagnosis and treatment promptly and comprehensively. It grants patients the right to fully view their records and attain an electronic copy [40], yet progress in implementing patients’ ORA has been slow. In the Netherlands, patients have had the right to a digital copy of all the information in their EHRs since 2020 [17], and different types of incentive programs have been implemented to encourage health care providers to provide such access.

Given the current challenges in implementing patients' full ORA across Europe, the EHDS proposal is ambitious. Mandating patients’ ORA is to be broadly encouraged, considering the positive experiences reported by patients with full ORA, but experiences show that regulations are often not enough to ensure implementation.

The NORDeHEALTH project has designed and tested a sociotechnical framework for studying and comparing factors that affect the implementation and adoption of patient ORA. The framework was designed based on the existing Sittig and Singh sociotechnical framework [31]. ORA-specific factors are explored related to, for example, what information patients have access to and when they can access it (immediately or with a delay), what functionality is provided (eg, being able to upload or edit information, proxy access), rules and regulations for ORA (on national or local levels), the usability of the PAEHR, technical infrastructure, and population characteristics (eg, educational levels, digital literacy, and diversity). An in-depth understanding of the local sociotechnical context is essential for comprehending the impact of ORA and being able to design successful interventions for implementing ORA. A study on the implementation of ORA in Sweden and the Netherlands identified resistance from health care professionals and technical infrastructure challenges as main barriers, whereas existing national infrastructure and program management, strong leadership, and stakeholder engagement (including both patients and health care professionals) were identified as success factors [17].

We argue that simply enabling ORA is not enough to ensure that all patients can use it. Usability is a key factor in the adoption of ORA [41]. Therefore, the NORDeHEALTH project strives to benchmark PAEHR usability [6] and investigate how it affects the acceptance and adoption of PAEHRs among different patient groups.

In the EHDS proposal, proxy access is described in Article 3, paragraph 5. Member States shall:

This includes guardians and other representatives, either automatically or upon request.

With a growing population of older people (>60 years) seeking health care services, many of whom are likely to have (multiple) chronic conditions, the demands on health and social care services are increasing [42]. However, the time that individuals with chronic conditions seek health and social care represents only a fragment of their 24/7 lived experience of coping with a chronic disease. As we grow older, we often become increasingly dependent on psychosocial and physical support outside of formal health care services, but this is far from only an issue for older people. Patients with cognitive or physical disabilities often rely on family or informal caregivers for support in managing their health. Parents, especially of children with chronic or life-threatening conditions, have an instrumental role in their children’s care and report great benefits from ORA [35] when it is available. Having a (strong) social network and informal caregivers (eg, family and friends), especially in times of life-changing illness, could mean the difference between survival and death [43]

Despite informal caregiving being an essential part of health care, it is rarely given a lot of credit. In fact, the vast majority of caregiving is informal, and it is undertaken by family members free of charge and with no support provided for them, often at great burden [44,45]. Thus, health care outcomes highly depend on the competence and ability of informal caregivers. Still, informal caregivers are often left out of the conversation [46], not the least when digitalization is introduced, and informal communication needs to be formalized.

In the NORDeHEALTH project, research into proxy access focuses on how parental ORA differs between the participating countries [25] and what this could mean for streamlining proxy access across Europe. Further studies on parental proxy access and adolescents’ ability to deny access in certain situations are in process. For general proxy access, there is even greater diversity across countries and even less research available. Internationally, when patients are given online access to their records, they are often given the option to share their records with a proxy if needed, usually a close family member such as a spouse or adult son or daughter [47]. In a US study, 2 out of 3 surveyed hospitals offered adult patients the option of granting portal access to an informal caregiver, but among hospitals that did, the process for obtaining proxy credentials was often difficult and time-consuming [48]. In the original Swedish implementation of ORA, patients could assign a proxy to be able to access their records. This function was available after secure log-in to the record, and the patient could assign access to any person in Sweden by adding the social security number of the person and choosing what parts of the PAEHR to share [49]. Despite this flexibility of the solution, the Swedish Authority for Privacy Protection requested the function be shut down, and after several appeals from Region Uppsala, the Supreme Administrative Court in Sweden finally decided to prohibit the function where patients can share their information with others, finding it to be in conflict with the Patient Data Act (a part of the Swedish Data Protection Act (2018:218) and the Swedish Data Protection Regulation (2018:219) that entered into force on May 25, 2018 [50]), which refers to allowing only patients themselves direct access to their medical records—not someone else [49].

In order to implement the EHDS proposal, it will be essential to streamline regulations for, and implementation of, proxy access across Europe. Acknowledging that different types of proxy access exist and come with their own set of challenges will also be important, distinguishing, for example, parental proxy access from other forms of proxy access.

The EHDS proposal, Article 3 §7, stresses that Member States shall ensure that:

In a US study of 22,000 patients who read their notes, 1 in 5 reported finding an error, and 40% of those perceived the error to be serious [51]. The most common errors were related to diagnoses, medical histories, medications, test results, notes on the wrong patient, and notes pertaining to the wrong side of the patient’s body (left vs right). Erroneous records may contribute to diagnostic errors that are common in health care [52]. Between 1 in 20 and 1 in every 6 medical consultations results in missed, wrong, or delayed diagnoses [53]. Most diagnostic errors relate to common conditions such as congenital heart failure, pneumonia, and urinary tract infections [54]. Research also shows repeated, missed opportunities to detect cancer [55,56].

Patients have so far had a marginal role in diagnostic processes, as acknowledged in the US National Academy of Medicine’s report “Improving Diagnosis in Health Care.” The report prompts a deeper discussion about the role of patients in closing feedback loops in care and helping to avoid mistakes that can lead to diagnostic errors, and ultimately patient harm [57]. Patient ORA is cited as a mechanism for improving diagnostic accuracy [57] and has been described by medical safety experts as a “transforming concept” in patient safety [58]. Emerging research supports these conclusions [13,59,60]. Patient ORA may help patients avoid delays and missed diagnoses by encouraging timely follow-up of recommended tests, results, and referrals [51]. Patients with ORA who identify and report errors could prevent clinicians from relying on incorrect data that may lead to poor diagnostic or treatment decisions or even legal liability [61]. A meta-analysis of 20 ORA-related randomized clinical trials (involving 17,387 patients) supports the conclusion that ORA could improve patient safety [13]. Most research to date on patients’ ORA and documentation errors has been performed in the United States with a remarkably different medico-legal system from the European one. In this respect, the NORDeHEALTH research complements the existing research and provides important evidence for the usefulness of patient ORA in patient safety work in contexts dominated by public health care provision.

In addition, most studies focus on somatic care and exclude mental health care. A recent NORDeHEALTH study made a comparison between patients who had received mental health care (the MHC group) and patients who had not (non-MHC group), regarding their experiences of finding errors or missing information in their online records [62]. MHC respondents (n=3131) experienced errors (MHC 1586/3131, 50.65% and non-MHC 3311/9203, 35.98%) and omissions (MHC 1089/3131, 34.78% and non-MHC 2427/9203, 26.37%) in the EHR at a higher rate compared with non-MHC respondents (n=9203). The statistically significant differences between the MHC and non-MHC groups remained when comparing a stratified subgroup sample adjusted for age and gender [62].

In the NORDeHEALTH patient survey [37], we explore the extent to which patients in Sweden, Norway, Finland, and Estonia find errors or missing information in their PAEHR and the action they have taken in these situations [62]. The results from these studies will help guide the further implementation of the EHDS with respect to the management of errors and missing information.

Article 3, §6 of the EHDS proposal states that:

Although the Nordic countries are advanced in providing ORA, entering health data into the EHR is not widely implemented. Swedish patients could previously comment in their EHRs [63], but this function was removed in 2022 due to technical problems related to the initial implementation of the feature. In Finland, patients can save health data to their personal health record via well-being applications, but the function is in limited use, only certain applications are accepted, and the data are not yet available to health care professionals [64]. Furthermore, patients in both Finland and Sweden have asked for more interactivity in their health records, such as the possibility to comment on the notes or request corrections [4,6].

In the NORDeHEALTH project, we explore how patient input to the EHR might become better designed to adequately meet this function. The EHR has traditionally been available to health care professionals only. Patients report many positive effects from accessing their records, yet to fully achieve the potential benefits of digitalization, we need to further explore how EHRs can shift from being solely a documentation tool for health professionals to a tool for secure collaboration and communication with patients and family caregivers. Here, national patient portals and additional digital services will complement the future development of the EHRs into collaborative, person-centered tools.

As digitalization is about more than making electronic versions of analog work, we investigate different ways to use the power of digitalization, as provided in Textbox 3.

Finally, EHDS proposes increased access control for patients. Patients should be able to request that electronic health data are made accessible to actors in the health or social security sector, and they should also have the right to restrict such access to electronic health data.

The Swedish Agency for Health and Care Services Analysis [65] reports that the majority of the population accepts and wants digital data about their own care and health to be used so that it is useful, including for safer care and research. At the same time, it is important that the data be handled securely and protected from unauthorized access.

In the NORDeHEALTH 2022 patient survey [37], questions related to sharing of the respondents’ records were asked, as well as requests for unwanted record access. Among the Swedish respondents, 4% (501/12,334) of respondents answered that they had experienced that someone had seen their health records without their consent [66], a finding that requires further analysis. Although 4% can be considered a low number, it stands in stark contrast to the clear message from policy makers that unauthorized access should not occur [9,50].

With the increasing possibilities for secondary use of health data, both by research and industry stakeholders, it will become even more important for patients to be aware of how to manage their health data, and consent to sharing it, in a safe way. Further research is needed both to understand patients' incentives for and experiences of sharing their data for secondary use and to identify interventions to increase digital health literacy regarding secondary use specifically.

Unauthorized access can reduce both patient safety and trust in health care, but it can also erode opportunities for secondary use of health data. Existing controls for information security and privacy, therefore, need to be improved in line with the EHDS proposal.