EHDS and FHIR: What DiGA Manufacturers, Hospitals and HIS Vendors Must Do by 2031

Short answer (updated November 2026). The European Health Data Space (Regulation (EU) 2025/327) applies from 26 March 2027, but the obligations for electronic health record systems come in two waves: from 26 March 2029 for patient summaries, ePrescriptions and eDispensation, and from 26 March 2031 for medical images, lab results and discharge reports. Every EHR system that processes these data must then contain two harmonised components – interoperability and logging – be tested in the EU's testing environment, carry a CE marking on self-declaration and be registered in an EU database. Medical devices such as DiGA fall under the same requirements as soon as they claim interoperability with EHR systems. In Germany, the electronic patient record (ePA) is mandatory for providers since October 2025, ISiK stage 3 is binding for hospital systems, and the EHDS implementation act (GeDIG) is in the Bundestag. The exchange format will be based on FHIR R4; the detailed implementing acts are due by March 2027.

This article maps the EU dates to German practice – ePA, ISiK, DiGA – and shows what each role should do now. It is based on the regulation, the European Commission's material and the German authorities as of autumn 2026, and draws on our own work with national e-health platforms. It is not legal advice.

What the EHDS requires, and when

The regulation entered into force on 26 March 2025. Article 105 staggers its application (Art. 105):

What an EHR system must have. Every EHR system in scope must include a European interoperability component and a European logging component (Art. 25). The interoperability component speaks the European EHR exchange format (EEHRxF); the logging component records who accessed which data. General-purpose software is excluded.

How conformity works. Manufacturers declare conformity themselves – no notified body – but only after testing in the EU's Digital Testing Environment. They then keep technical documentation for ten years, issue an EU declaration of conformity, affix the CE marking and register the system in an EU database (Art. 30).

Medical devices and DiGA. Medical devices, in-vitro diagnostics and high-risk AI systems that claim interoperability with EHR systems must meet the same interoperability and logging requirements (Art. 27). Digital health applications (DiGA) are medical devices, so this applies to them as soon as they exchange data with EHR systems.

Wellness apps are only covered if they claim interoperability: then they need a label, valid for up to three years, and registration in the EU database (Art. 47).

Implementing acts. The first ones were published in September 2026 and are in force since 11 October 2026: cross-border exchange via MyHealth@EU, the identification of patients and professionals, and the metadata standard for datasets (HealthDCAT-AP) (Produktkanzlei). The acts that matter most for vendors – the exchange format, the common specifications and the testing environment – are legally due by 26 March 2027 and were not adopted as of November 2026.

The German picture

• The ePA. The electronic patient record for everyone has been rolled out nationwide since 29 April 2025; since 1 October 2025 providers must fill it. By April 2026 about 73 million records existed, more than 100 million documents had been uploaded, and about 5.1 million people used a health ID to access their record (Gelbe Liste, citing gematik). Technically, the medication service is FHIR R4 (gematik); documents still go through a document store. The digital medication plan started as a pilot in model regions in July 2026.
• ISiK for hospitals. The gematik's FHIR specifications for hospital information systems are binding for the system types the German Hospital Federation designates. Stage 3 has been mandatory since 1 July 2025; stage 4 was discontinued; stage 5 is published, with its mandatory date still to be set (gematik).
• E-prescriptions have been mandatory since 1 January 2024.
• GeDIG, the act implementing the EHDS in Germany, was adopted by the cabinet on 15 July 2026 and had its first reading in the Bundestag in October 2026. It extends the ePA (full-text search, vaccination record), gives the gematik more powers and sets up the framework for secondary use (BMG). According to the draft, DiGA would get read access to medication data in the ePA from 2028; details may still change in parliament.
• Cross-border exchange. Seventeen EU countries and Norway already exchange patient summaries or ePrescriptions through MyHealth@EU; Germany was not live as of March 2026 (European Commission).
• DiGA. At the end of 2025 the directory listed 58 DiGA; statutory health insurance spent €171 million on them in 2025, after €106 million in 2024 (GKV-Spitzenverband). Since 1 February 2026 permanently listed DiGA must measure their success during use and report it to the BfArM.
• Hospital readiness. The third DigitalRadar measurement in 2026 put the average digital maturity of German hospitals at 55 out of 100 points, up from 33 in 2021 (DKG).

Who must do what

FHIR in practice

• The exchange format will be based on FHIR R4. The HL7 Europe Patient Summary (ballot version June 2026), developed with the EU joint action Xt-EHR and aligned with the International Patient Summary, is explicitly meant to prepare the ground for the EEHRxF (HL7 Europe). The ePA, ISiK and the European work all use R4; there is no reason to start with R5.
• Terminologies are part of interoperability. Germany has been a SNOMED International member since 2021, and the BfArM issues national SNOMED CT licences free of charge (SNOMED International); LOINC is free to use. Mapping local codes is often the longest task in a FHIR project.
• Most hospitals will not replace their core systems by 2029. A common route is a FHIR layer in front of existing systems: it translates internal data and HL7 v2 messages into FHIR resources, adds the logging the EHDS requires, and can be tested and certified on its own. This is the same integration-middleware approach we use to connect clinical systems that were never designed to talk to each other.
• Logging is a requirement in its own right. Who accessed which record, when and why must be traceable – design it as a component, not as an afterthought in the application log.

What we learned connecting systems to national e-health platforms

SDH has built software connected to national health infrastructures:

• for Medstar, the largest digital health provider in Ukraine, a cloud-based medical information system connected to the national eHealth system, whose exchange protocol is built on FHIR; an EHR app, an e-prescribing app and a medicine registry of 14,000 drugs linked to the national reimbursement programme;
• in the United Arab Emirates, an integration with the national health information system over HL7;
• middleware connecting a pharmacy robot, an ERP and a restricted national health information system, delivered in 39 weeks.

What these projects have in common is what German vendors and hospitals now face:

1. Access to the national platform is controlled and certified. Plan for test environments, certification cycles and limited integration slots; they take longer than the code.
2. The standard is a starting point, not the finish line. National profiles, mandatory fields and terminology bindings decide whether a message is accepted.
3. Integration is easier as a separate layer. A middleware that owns the mapping, the retries and the audit trail keeps the core systems stable and can be certified on its own.
4. Logging and consent must be designed in from the start. Retrofitting them into an existing system is the expensive path.

Security and NIS2

Hospitals, laboratories and certain medical-device manufacturers above the size thresholds (from 50 employees or €10 million turnover) fall under the German NIS2 Implementation Act, in force since 6 December 2025: registration with the BSI, risk management with management accountability, and incident reporting within 24 and 72 hours. For manufacturers, the Cyber Resilience Act adds vulnerability reporting for software products that are not medical devices; medical devices themselves stay under the MDR. More EHDS interfaces mean more attack surface, which is one more reason to put them in a dedicated, monitored layer.

Common misconceptions

1. "EHDS applies in 2027, so our EHR system must comply then." EHR-system obligations start in 2029 or 2031, depending on the data category.
2. "CE marking needs a notified body." It is a self-declaration, after testing in the EU testing environment.
3. "ISiK stage 4 is the target." Stage 4 was discontinued; stage 3 is binding and stage 5 comes next.
4. "The implementing acts are done." The exchange format, common specifications and testing environment are still pending.
5. "Wellness apps fall under the EHDS." Only if they claim interoperability.
6. "Germany already exchanges data through MyHealth@EU." Not yet.
7. "The ePA is fully FHIR." Only the medication service is; documents remain document-based.
8. "GeDIG is law." As of November 2026 it is still in parliament.

How we help

SDH builds healthcare software and medical integration middleware: FHIR layers over existing hospital and practice systems, connections to national platforms, logging and consent, and the documentation that conformity assessment needs. For the wider regulatory picture see our compliance calendar for software; for the integration approach, one hospital, three systems, zero manual work. Talk to us about your EHDS roadmap.

FAQ

When does the EHDS apply to EHR systems?

From 26 March 2029 for systems that process patient summaries, ePrescriptions and eDispensation, and from 26 March 2031 for medical images, lab results and discharge reports, as well as for systems already in service. The regulation as a whole applies from 26 March 2027.

Do EHR systems need a notified body under the EHDS?

No. Manufacturers declare conformity themselves after testing in the EU's Digital Testing Environment, keep technical documentation, affix the CE marking and register the system in an EU database.

Does the EHDS apply to DiGA?

Yes, if the DiGA claims interoperability with EHR systems: medical devices that do so must meet the same interoperability and logging requirements as EHR systems.

Which FHIR version does the EHDS use?

The European EHR exchange format is still being defined, but the preparatory work – the HL7 Europe Patient Summary and the Xt-EHR models – uses FHIR R4, as do the German ePA medication service and ISiK.

Which ISiK stage is mandatory?

Stage 3 has been mandatory since 1 July 2025. Stage 4 was discontinued; stage 5 is published and its mandatory date has not been set yet.

Sources

• European Commission, European Health Data Space regulation
• Regulation (EU) 2025/327, Art. 25, Art. 27, Art. 30, Art. 47, Art. 105
• European Commission (DG SANTE), EHDS and MyHealth@EU, IHE-Europe Experience Days 2026
• Produktkanzlei, MyHealth@EU and HealthDCAT-AP implementing acts, September 2026
• German Federal Ministry of Health, Cabinet adopts GeDIG, July 2026
• gematik, ISiK and ePA medication service
• Gelbe Liste, 100 million documents in the ePA, April 2026
• GKV-Spitzenverband, DiGA report 2025
• HL7 Europe, Patient Summary
• DKG, DigitalRadar 2026, June 2026
• SNOMED International, Germany's BfArM joins SNOMED International

Categories

About the author

Vasyl Kuchma

CEO, Europe Offices & Co-Founder

View full profile

CEO & Co-Founder at Software Development Hub. Innovation-driven expert with 20+ years of experience. A business practitioner with experience in creating and launching startups, an innovator and progressive-minded specialist, who helps turn raw ideas into profitable results.

View full profile