From 2032, clinicians reaching across EU borders must sign in at eIDAS “high”
On 22 September 2026 the European Commission published Implementing Regulation (EU) 2026/2099. It sets out how patients, health professionals and healthcare providers must be identified when personal health data crosses an EU border through MyHealth@EU, the infrastructure that connects national contact points for digital health. It is one of three implementing acts under the European Health Data Space Regulation published that week (DSV Europavertretung), and it puts dates on something hospitals have been able to postpone for years: how strongly a clinician has to prove who they are.
Two dates for clinicians
Article 6 covers health professionals and healthcare providers. Before requesting a cross-border exchange of a patient's data, they must be identified, authenticated and authorised. The electronic means they use must reach "at least the assurance level substantial" under the eIDAS Regulation. From 26 March 2032 it must reach "the assurance level high".
The regulation applies generally from 26 March 2027. Patients move faster: under Article 4, a patient's own online request must be backed by eID at substantial level, and from 26 March 2030 at high. Member States must also notify the healthcare attributes they use to identify people by March 2028, and from March 2029 issue them to European Digital Identity Wallets on request (Biometric Update, 25 September 2026).
Five and a half years sounds like a long runway. For a hospital that replaces its access infrastructure once a decade, it is one procurement cycle.
What "high" actually means
The levels are defined in Implementing Regulation (EU) 2015/1502. Substantial already requires "at least two authentication factors from different categories", used only under the control or possession of the person it belongs to. High adds two things. The means must protect "against duplication and tampering as well as against attackers with high attack potential", and it must be designed so the owner can reliably protect it "against use by others".
In practice that rules out most of what clinicians use today. A password plus an SMS code is two factors, but neither resists a capable attacker. A software certificate on a shared workstation can be copied. A smartcard with a PIN comes closer, but a PIN written on a sticky note next to the reader is not "reliably protected against use by others". High points towards keys generated and held in tamper-resistant hardware, unlocked only by the person who owns them.
Why a wearable fits
That is the design of the Crayonic Badge. Keys are created and kept in a secure element and never leave it. The badge is unlocked by the wearer's fingerprint on the device itself, so the second factor cannot be shared, guessed or typed into a compromised workstation. And because it is worn on the body rather than left in a reader, it stays in the owner's possession for the whole shift.
One caveat matters for anyone writing a tender or a grant application. eIDAS assurance is a property of the whole electronic identification scheme, not of one device. Identity proofing at enrolment, how the credential is issued and revoked, and how the scheme is assessed or notified all count. An authenticator built to the high-level requirements is a necessary part of the answer, and it is the part that takes longest to roll out across thousands of staff.
Not only for cross-border requests
Strictly, the regulation covers access through MyHealth@EU. But no hospital will run two login standards side by side, one for foreign patients and one for everyone else. Whatever authentication a clinician uses to reach a record from another Member State will become the authentication they use for everything. The 2032 date is, in effect, a deadline for the clinical workstation.
Questions to settle now
Which of your current clinician sign-in methods would meet substantial in March 2027, and which would not?
Are clinicians' keys held in tamper-resistant hardware, or in software on shared machines?
Is the second factor something the clinician alone controls, or a PIN that colleagues know?
Does your identity provider record assurance levels, so you can show an auditor which level each access used?
Will the authenticators you buy this year still qualify in 2032?
The European Health Data Space has moved from principle to dates. For clinician identity, the dates are 2027 and 2032. The hospitals that start on hardware-backed, personal authentication now will meet both without a second migration.
