Data that cannot be moved is data that has been lost. In 2026 interoperability ceased to be a technical postulate: it became a legal obligation, a date in the calendar, and the condition on which three billion złoty spent on digitising Polish hospitals either builds a network or buys three billion złoty worth of modern islands.

Michał P. Dybowski — co-founder and managing director of the Healthcare Poland Foundation; systems architect and health policy author. The Healthcare Poland Foundation builds a cross-border health ecosystem (including CM‑KLARA, Poliversum, the Global Healthcare Systems Hub, Just Council and CyberC4HE). · as at 13 September 2026

There is a moment in the life of every hospital that never appears in the statistics, yet says more about the system than many a report. It is the moment a patient arrives at an emergency department in a city other than the one where they are treated, and the doctor on duty — facing a person whose medical history exists, is complete and has been carefully recorded — cannot read it. Not because the data was lost. The data is there. It sits in another provider’s repository, written in another format, labelled with another vocabulary, produced by a system that cannot talk to the system in front of the doctor. Between the two runs a cable that connects nothing. And precisely there — not in the number of beds, not in the level of contributions, not in the number of scanners — the true load-bearing capacity of a health system is revealed. Because capacity is not only the ability to carry weight. It is the ability to move it from place to place without loss. And medical information that cannot be moved is information that has been lost.

This article is about interoperability and about the certification of systems that hold electronic health records — which sounds like a subject for engineers and is in fact a subject for the citizen standing in the doorway of an emergency department. It is about the fact that in 2026 Poland and the whole European Union entered the decisive phase of building a common language for health data, and that patient safety, hospital throughput, the cost of the entire system and the standing of Polish healthcare in the European network all depend on whether we learn to speak it. And it is about the fact that interoperability has stopped being a technical postulate and become a legal obligation, a date in the calendar, and the condition without which further billions spent on digitisation cannot be turned into lasting value.

Capacity you cannot see until it fails

In the series “Load-bearing capacity of the health system” we return repeatedly to a simple distinction. One can ask how many resources a system has. One can also ask how efficiently those resources circulate. The first question concerns capacity, the second throughput. Interoperability is pure efficiency leverage: it adds not one bed, not one physician, not one złoty of contribution, and yet it can radically increase what the system genuinely carries. Exactly like a bridge which, thanks to better engineering, carries more traffic without new spans.

Health data that does not flow is like water in sealed tanks standing side by side. Every tank full, and the garden dying. An oncology patient whose imaging reports must be repeated because the earlier ones cannot be read in the new centre burdens the scanner suite, the queue, the budget and their own body — with a double dose of radiation and weeks of delay. A doctor who retypes results from a printout instead of reading them loses the time the system lacks most. A payer financing the same examination twice is paying for leakage. The sum of these individual losses is enormous but dispersed, and therefore invisible — until the bridge begins to sag.

The scale of the problem in Poland is real and well recognised by the sector itself. The backbone of the national system is the P1 platform, run by the e-Health Centre — an infrastructure whose scale cannot be dismissed. And despite that scale, the exchange of complete records between hospitals still runs into the barrier of incompatible systems. Physicians working across several facilities log into several different platforms, navigate different interfaces, and meet different standards for recording the same clinical fact. This is not the failure of a single vendor. It is a structural feature of a market in which, for years, everyone built their own closed fortress.

The closed fortress and its price

The phenomenon has a name: vendor lock-in. A facility buys a hospital information system, pours years of work, data and staff habits into it, and then discovers that leaving costs so much that there is effectively no way out. Migrating data to a competing solution can be more expensive than staying with the incumbent, even when the incumbent is costly, slow and poorly connected to its surroundings. Closed, proprietary environments built by vendors are a dead end that dramatically complicates and inflates the cost of every future technological step a facility takes.

The price of that closure, however, is not borne by the hospital budget alone. The whole system pays, because one actor’s lock-in translates into leakage across the network. The patient pays, because their data cannot follow them when they follow their treatment. And the state pays, financing successive waves of digital investment without recovering their full value for as long as the islands remain islands.

This is precisely the point at which a technical problem becomes a problem of public policy: a market left to itself does not solve interoperability, because locking a customer in pays off for the individual vendor. Openness is a common good, and common goods are not delivered without a rule. That rule — after years of voluntary recommendations that proved insufficient — is now being set by European law.

The year the rule became law

On 26 March 2025 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 establishing the European Health Data Space — EHDS — entered into force; it had been published in the Official Journal of the EU on 5 March 2025.² It is the Union’s first common legal act governing both the primary and the secondary use and exchange of electronic health data, and at the same time the first European “data space” devoted to a single sector. The Regulation takes effect in stages: the general date of application is 26 March 2027, with further major milestones on 26 March 2029, 26 March 2031 and 26 March 2035. This is not a soft programme document. It is a detailed legal and technical framework that gains force through successively applicable institutional, operational and product obligations.

To understand why interoperability has stopped being a conference topic and become a boardroom topic for every hospital and every software vendor, one has to see the three streams into which EHDS divides. The first is primary use: the citizen’s right to access, control and cross-border exchange of their own health data through common European infrastructure. The second is secondary use: an orderly, tightly controlled regime for making data available for research, innovation, policy-making and regulatory activity. The third — and it is the true protagonist of this text — is the regulation of the systems that hold electronic health records, EHR systems, together with the interoperability and conformity obligations imposed on them. These three streams do not affect the same actors in the same way. That is why identifying early who is who in this puzzle matters so much.

It is worth setting aside the temptation to postpone. An analysis prepared in 2026 by lawyers at the international firm Kennedys — one of those advising the sector on EHDS readiness — puts it plainly: the transition period should be treated as implementation time, not as grounds for delay.³ An organisation that waits until 2029 to begin its analysis will leave itself too little time to rebuild products, talk to vendors, work on interoperability and allocate responsibility internally. That is a hard, practical conclusion for a Polish hospital director and a Polish system vendor just as much as for their counterparts in the Netherlands or Spain.

Who is who in the EHDS puzzle

The Regulation has no single addressee. It has roles — and the role determines which obligations and which deadlines bind a given actor. A mistake here is costly, because it leads either to preparing for conformity that is not required or, more often, to quietly overlooking conformity that is. The three roles below exhaust the typical situation on the Polish market.

What EHR system certification actually means

At the heart of the product side of EHDS lies the obligation that only records systems capable of talking to others may reach the market. The European Commission explains the logic in terms worth translating into the language of benefit: interoperability is the key, because facilities can cooperate effectively only when their systems are compatible. By imposing new obligations on manufacturers, the law brings about a situation in which only systems able to exchange data are available on the market — which makes life simpler for everyone who uses one.¹

The specifics are as follows. The manufacturer must ensure that the product meets the essential requirements set out in Annex II to the Regulation and in the common specifications. It must equip the system with two harmonised components: an interoperability component, providing the ability to import and export data in the European electronic health record exchange format, and a logging component, which generates access logs. It must test those components before placing the product on the market and include the results in the technical documentation. It must draw up an EU declaration of conformity, affix the CE marking, enter the required data in the EU database for EHR systems, and maintain complaint channels together with the duty to withdraw non-compliant products. To make all this workable, Member States will set up European digital testing environments in which a manufacturer can verify, with an automated tool, whether the harmonised components of its system comply with the Regulation.¹

The CE marking on a medical records system — until now associated with devices rather than hospital software — is the symbolic shorthand for the whole change. It begins to mean that the system allows a facility genuinely to discharge the patient rights arising from EHDS: to make data available in the European format and to ensure access logs are available. For a hospital director this is an invaluable simplification of the purchasing decision. Instead of trusting promises about “our best-in-class integration”, they will be able to look at an objective mark and know that the system they are buying will not lock them into yet another fortress. In fairness it must be added that the deferral of deadlines is not grounds for relief but grounds for starting work.

A common language: the format all of Europe speaks

Interoperability without a common language is a slogan. That language is to be the European electronic health record exchange format, EEHRxF. It is a standardised, machine-readable format spanning three layers: harmonised datasets defining the structures in which clinical content is recorded, coding systems and value sets ensuring consistency of meaning, and technical interoperability specifications.⁴ Without the third layer two systems can exchange files and still fail to understand each other — like two people exchanging letters written in different alphabets.

The calendar here is as concrete as the rest of EHDS. By 26 March 2027 the European Commission is to adopt the key implementing acts containing the detailed technical specifications of the format. From 26 March 2029 Member States must ensure cross-border exchange of the first group of priority data categories: patient summaries and e-prescriptions and e-dispensations. From 26 March 2031 medical images, laboratory results and hospital discharge reports join them.²

It is worth acknowledging here something the Polish debate mentions far too rarely: we have been speaking part of this language for years. The Polish national implementation of the HL7 CDA standard, developed by the e-Health Centre together with sector experts, has long given medical documents a unified, legally binding form — documents generated to that standard have the same legal value as paper ones.⁷ That is a foundation on which to build further, towards more modern exchange profiles. Interoperability in Poland therefore does not start from zero; it starts from a maturing base that has to be completed and tuned to the European format.

Poland is already doing it — and has already tested it

The best proof that we are discussing reality rather than a paper project is the practice of recent months. From 27 October to 28 November 2025 the e-Health Centre took part in the official cross-border pre-production test session for the Patient Summary. Over five weeks Poland tested the process both as the country issuing a Polish patient’s document and as the country receiving a foreign patient’s summary. In the issuing role Poland exchanged data with five states — Cyprus, Malta, the Netherlands, Norway and Sweden — and in the receiving role with Cyprus and Malta.⁵

This is a fact that says more than declarations. The Polish Patient Summary is built to the requirements of the MyHealth@EU network and fits into the wider EHDS strategy. It contains what saves life when a patient reaches a doctor far from home: allergies, current medication, diagnoses, past procedures, implanted devices, blood group. A physician in another EU country can, within moments, learn the health history of a person they are seeing for the first time — which means better decisions, errors avoided, the language barrier overcome, no need to repeat examinations and faster action in emergencies. Poland, which implemented the cross-border e-prescription back in 2022, is building on a proven foundation. This is precisely the point at which “what Poland offers the world” and “what the world offers Poland” meet in a single socket: our infrastructure makes our citizens’ data available abroad and receives other states’ citizens’ data here.

Billions that have to mesh

And here we come to the matter that makes this subject exceptionally current right now, in September 2026. Polish hospitals have just passed through the largest wave of digital investment in their history, financed from the National Recovery Plan. Under investment D1.1.2 — “Accelerating the digital transformation of healthcare” — the Ministry of Health allocated PLN 3,131,000,000 to the competitive call, with co-financing of up to one hundred per cent of eligible costs from RRF funds. The money went to integration with the central medical data repository, digitisation of discharge records, expansion and integration of hospital IT systems, and raising the level of cybersecurity. The basic completion deadline was set at 31 May 2026, extendable to 15 July and, at the outer limit, to 7 August 2026, with expenditure eligibility — for amended agreements — running to 31 August 2026.⁶

That means that as this text is written, the dust after the largest wave of digitisation is only now settling and the settlements are drawing to a close. And that is exactly why the question of interoperability is today a question about the return on that investment. Three billion złoty spent on systems that cannot talk to each other would yield three billion złoty worth of modern islands. The same money spent on systems compliant with a common format and exchange standards yields a network. The difference is not cosmetic — it is the difference between capacity and throughput, between holding resources and being able to use them. The good news is that the direction was chosen correctly: the call documentation confirms that the central medical data repository operates on recognised interoperability standards such as the IHE XDS.b profile — not on a proprietary solution.⁶ That is a decision which protects public money from dispersal into yet more closed fortresses.

A shield for the citizen

Behind all this legal and technical architecture stands one human being: the patient. Interoperability is in essence a quiet shield stretched over the citizen before they ever need it. It works when a paramedic at the other end of the country reads within seconds that the patient is allergic to a particular drug, and does not give them an agent that could kill. It works when someone with a chronic illness travels on holiday to another EU state and does not have to carry a folder of printouts, because their patient summary is available to the doctor they meet. It works when an oncologist in a new centre opens an imaging report from a month ago instead of sending the patient for a repeat scan. This shield protects not only health but dignity — because a person whose data follows them is treated as a subject, not as a supplicant asking for access to their own history.

The EHDS Regulation strengthens that shield directly: it gives the citizen stronger rights of access to their data, of control over it and of sharing it, including across borders. The logging component, required of every certified system, means that every reach into a patient’s records is recorded — and that builds the trust without which the digitisation of health cannot succeed.

Here, however, the honest balance demanded by a culture of rigorous debate must be kept. The openness of data and its flow raise real questions about privacy, about security, about the risk of abuse. EHDS answers them in regulatory terms — through the mechanism of consent and opt-out for secondary use, through secure processing environments, through the prohibition of re-identification — but a legal answer does not remove the need for operational vigilance. Interoperability also raises the stakes in cybersecurity: a network in which data flows more freely requires stronger safeguards at every node, as we wrote in this same series in connection with the NIS2 Directive and hospital resilience. The shield for the citizen must be coherent — there is no sense in opening the door for data if it is left open for the attacker too.

What EHDS does not do

Rigour requires marking the boundaries. Around every major regulation a mythology accretes — both enthusiastic and fearful — and both varieties obstruct sober planning. Four misunderstandings recur most often and are worth disarming at once.

The benefit is not one-sided

The virtue of this arrangement is that, viewed broadly enough, it has no losers. The software vendor gains easier access to the markets of all Member States, because harmonised requirements spare it the task of adapting its product separately for each country. Paradoxically, even the vendor that has until now profited from lock-in gains: a market in which a customer can freely change supplier is larger and more dynamic than a frozen one, and competition shifts from migration traps to quality and price — that is, to where it belongs. The facility gains lower switching costs, wider choice and the certainty a mark confers. Clinical staff gain time recovered and less frustration at every login. The payer gains watertightness, meaning an end to financing the same service twice. The regulator gains verifiability instead of declarations. And health policy gains something no single grant can buy: the ability to plan on data that can be joined and compared.

There is also a dimension here that reaches beyond national borders and touches Poland’s standing in Europe. A common format and common standards are not only an obligation but an opportunity. A country that builds interoperable infrastructure early and thoroughly becomes an attractive partner for European research consortia, for technology firms looking for a place to validate solutions, and for patients considering cross-border treatment. The Polish Patient Summary tests with five states show that we are a serious participant in this game, not a supplicant. “Healthcare Poland” as a brand for Polish health in the world has concrete material here on which to build credibility: not a slogan about digitisation, but a verified capability to issue and receive data in the European network. This is that rare point at which the interest of the citizen, of the hospital, of the state and of the economy all point the same way.

Twelve months: a checklist

Doctrine without execution is literature. The list below does not replace legal analysis or an audit — but it orders what can be done within the coming year without waiting for the implementing acts, and what will already be done once they are adopted.

Where the foundation fits in

The Healthcare Poland Foundation treats interoperability not as an IT project but as a constitutional question for the health system — and in that spirit contributes competence that joins the European layer to national practice. The HeliX project run within the foundation’s ecosystem, building a European capability to train artificial-intelligence models without moving data outside the walls of the facility, rests on exactly the logic EHDS establishes: it is not the data that should travel to the model but the model to the data, and the condition for both is a common language and verifiable conformity of systems. Experience in coordinating consortia, in working with exchange formats and in auditing health data allows the foundation to act as translator between a Brussels legal act and the reality of a Polish hospital that has just closed out an RRF project and is asking what comes next.

That role has three practical dimensions. The first is support in understanding what the facility or the vendor is within the EHDS puzzle — because that determines which obligations and which deadlines apply. The second is help in planning purchases and contracts so as not to buy today systems that will not pass certification tomorrow, and to write into vendor agreements responsibility for conformity with exchange standards and for the cost of future adaptations. The third is building international bridges — participation in tests, consortia and networks through which Polish solutions become not only compliant but visible in Europe. All three come to the same thing: turning the cable that today connects no one into a socket into which a citizen can be safely plugged, wherever they happen to be.

A bridge that carries the load

Let us return at the end to the emergency department where we began. In time, the doctor on duty will not stand helpless before a patient whose history exists but cannot be read. They will open the summary, read the allergies, see the current medication, check the latest results — and decide faster, more accurately, more safely. Not because they have gained beds or colleagues, but because information, until now imprisoned, will finally flow. That is the point of interoperability and of records-system certification: not to add spans, but to make the bridge carry a greater load without cracking.

The year 2026 is a singular moment in this story. Behind us lies the largest wave of digital investment; ahead lie the European deadlines that give it meaning: 2027 with the implementing acts and the connection of P1 to the European Health Data Space, 2029 with the first group of data exchanged across borders, 2031 with medical images and discharge reports. Poland has the foundation — the P1 platform, the national implementation of the records standard, verified cross-border tests — and it has decided to take the path of openness rather than closure. What remains is the hardest part: consistency. Because the load-bearing capacity of a health system is not settled on the day a law is passed or a grant is transferred. It is settled in thousands of everyday purchasing, contractual and implementation decisions in which someone chooses between the comfort of a closed fortress and the effort of an open network. Choosing the network is choosing the citizen. And it is the only choice a system with genuine load-bearing capacity can make.

Notes and sources