eIDAS 2.0 brings significant new obligations and opportunities to healthcare providers across Europe. Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, requires healthcare organisations to accept and support the European Digital Identity Wallet (EUDI Wallet) for patient-facing digital services, introduces stronger standards for electronic signatures on medical documents, and establishes a framework for secure, cross-border sharing of health data. For healthcare providers, this is not a distant policy question. It is an operational reality that demands attention now and through 2026 and beyond. This article walks through the key questions every healthcare organisation should be asking right now.
What changes does eIDAS 2.0 actually bring to healthcare?
eIDAS 2.0 introduces a mandatory digital identity framework that directly affects how healthcare providers verify patients, sign documents, and exchange health data across borders. Unlike the original eIDAS regulation, which was largely limited to the public sector, eIDAS 2.0 extends its reach to regulated private sector services, including healthcare. This means that healthcare organisations can no longer treat digital identity as a purely internal IT matter.
The most significant shift is the introduction of the European Digital Identity Wallet. Every EU Member State is now legally required to offer a wallet to citizens, residents, and businesses by 24 December 2026. From that date, public sector bodies must accept notified wallet credentials for online services that require electronic identification. For regulated private sector organisations in healthcare, the acceptance obligation under Article 5f applies from 24 December 2027, where strong user authentication is required by law or contract. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from this private sector obligation.
It is important to understand that 24 December 2026 is the legal deadline for Member States to meet their wallet obligations. It is not a guarantee that every national wallet will have reached the same level of maturity or that every possible cross-border use case will be fully operational throughout Europe on that date. National rollout, certification, notification, and practical interoperability are likely to develop in phases, and healthcare organisations should plan accordingly.
Beyond the wallet, eIDAS 2.0 also strengthens requirements around qualified electronic signatures (QES) and electronic seals. For healthcare, this matters when it comes to signing medical records, consent forms, referral letters, and prescriptions. The regulation sets a clear legal standard for what constitutes a trusted digital signature, and healthcare providers need to ensure their systems are aligned with those standards. Note that a QES carries the same legal effect as a handwritten signature, while a qualified electronic seal has a different legal effect and is not equivalent to a signature.
How does the EUDI Wallet affect patient identity verification?
The EUDI Wallet changes patient identity verification by giving patients a single, government-recognised digital identity they can use across healthcare services, without needing to prove themselves from scratch at every provider. For healthcare organisations, this means a verified patient identity can arrive pre-checked, with tamper-evident cryptographic binding, and ready to use, reducing friction and administrative overhead at the point of care.
Today, many healthcare providers rely on manual identity checks, physical documents, or fragmented digital login systems. These approaches are slow, error-prone, and inconsistent. The EUDI Wallet replaces this with a standardised, high-assurance identity that patients control themselves. When a patient books an appointment or accesses their health record online, they can present their wallet credential with a single interaction, sharing only the information that is actually needed, such as their name, date of birth, or insurance number, without exposing unnecessary personal data.
This selective disclosure principle is particularly relevant in healthcare, where privacy is paramount. The wallet is designed so that patients choose what they share and with whom, approving each individual presentation request in the wallet. For providers, this means receiving verified, minimal data. It also reduces the risk of data breaches, since less sensitive data is held unnecessarily. It is important to distinguish between a patient approving a data request in the wallet and consent as a legal basis under the GDPR. A relying party must have its own GDPR legal basis for processing the data received. For health data, an additional condition under Article 9(2) GDPR is required alongside that basis.
Cross-border care is another area where the EUDI Wallet is designed to make a tangible difference. The framework allows a certified wallet from one Member State to be used with an appropriate relying party in another Member State. In practice, this means a patient from Germany receiving treatment in the Netherlands could, where the relevant use case is supported, present their digital identity and relevant health credentials, such as the European Health Insurance Card, directly from their wallet. It is worth noting that not every use case will be immediately available in every Member State, that sector-specific legislation continues to apply, and that national registration requirements do not disappear because a cross-border wallet framework exists. Healthcare providers operating in border regions or serving international patients should monitor which specific use cases are supported in their jurisdiction as national implementations mature.
Which healthcare use cases are most impacted by eIDAS 2.0?
The healthcare use cases most impacted by eIDAS 2.0 are those that involve patient identity verification, digital document signing, and cross-border data exchange. These processes sit at the heart of modern healthcare delivery, and the regulation sets new expectations for how they must be handled.
- Patient onboarding and registration: Digital registration flows that currently rely on passwords or basic ID checks will need to support wallet-based identity verification at a high assurance level.
- Prescription management: Electronic prescriptions and their cross-border redemption at pharmacies were tested in the POTENTIAL pilot programme. Pharmacies and prescribing clinicians both need to be ready, though the availability of cross-border prescription functionality will depend on how individual Member States implement and certify the relevant use cases.
- Informed consent: Signing consent forms digitally requires a qualified or advanced electronic signature to carry legal weight. eIDAS 2.0 clarifies and strengthens these requirements, though national form requirements continue to apply alongside the regulation.
- Access to patient portals: Online portals where patients view records, request referrals, or communicate with clinicians must be capable of accepting EUDI Wallet credentials as a login method.
- Cross-border care: Patients travelling or living abroad need to share health credentials, including insurance status and medical history, in a way that is trusted and machine-readable across EU Member States. The EUDI Wallet framework supports this in principle, but the practical availability of specific credentials across borders will develop over time as national implementations are certified and notified.
- Staff and professional identity: Healthcare professionals accessing clinical systems or signing medical documents also fall within the scope of eIDAS 2.0, particularly where qualified signatures are required.
Organisations in the pharmaceutical sector are also affected. The POTENTIAL Large Scale Pilot, which ran from April 2023 to 2025, specifically tested e-prescriptions as a use case, which means the infrastructure for digital prescriptions has already been developed and tested at scale across Europe.
What compliance obligations do healthcare providers face under eIDAS 2.0?
Under eIDAS 2.0, healthcare providers must accept EUDI Wallet credentials for digital services within the applicable deadlines, use compliant electronic signatures for legally binding documents, and ensure their identity and data exchange processes meet the regulation’s assurance and interoperability standards. Non-compliance carries real legal and operational risk, particularly for providers handling sensitive health data under GDPR alongside eIDAS obligations.
The specific obligations depend on the nature of the service and the type of data being processed. However, most healthcare providers will need to address the following areas:
- Accepting EUDI Wallet credentials: Public-facing digital healthcare services will be required to support wallet-based authentication within the applicable deadlines: 24 December 2026 for public sector bodies, and 24 December 2027 for regulated private sector healthcare organisations where strong user authentication is required by law or contract. This means updating identity verification flows and integrating with the wallet ecosystem. Before requesting wallet data, a relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848 of 6 May 2025. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks each presentation request against this registered scope. Governance of the wallet framework is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; and relying parties such as healthcare organisations are responsible for integrating correctly within the applicable national framework. A relying party must be capable of accepting every relevant notified wallet, regardless of which provider issued it.
- Qualified electronic signatures for clinical documents: Where documents carry legal weight, such as consent forms, prescriptions, and medical certificates, providers must use signatures that meet eIDAS 2.0 standards. A QES requires a Qualified Signature Creation Device (QSCD) and a qualified certificate. This often means working with a Qualified Trust Service Provider (QTSP) that is listed on the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). Note that a QTSP is specifically required for qualified signing and qualified attestations. Wallet acceptance itself does not automatically require a QTSP.
- Data minimisation in identity checks: The regulation reinforces GDPR principles by requiring that only necessary identity attributes are requested and processed. Healthcare providers must review their data collection practices accordingly. For health data, processing must also meet a condition under Article 9(2) GDPR.
- Interoperability with EU health data infrastructure: As the European Health Data Space (EHDS) develops alongside eIDAS 2.0, healthcare providers will need to ensure their systems can exchange data in formats that are recognised and trusted across Member States. The legally binding requirements are set out in implementing acts. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements.
- Audit trails and long-term verification: Signed documents and verified identities need to be stored in a way that remains verifiable over time, which requires specific technical and archival standards.
Compliance is not a one-time project. The regulatory landscape continues to evolve, and healthcare organisations need governance structures that can adapt as new implementing acts and technical specifications are published under eIDAS 2.0.
How should healthcare organisations prepare for eIDAS 2.0 implementation?
Healthcare organisations should start preparing for eIDAS 2.0 by mapping their current digital identity and document signing processes, identifying gaps against the new requirements, and building a phased implementation plan that prioritises the highest-impact use cases first. Waiting for full regulatory clarity before acting is a risk in itself, since the infrastructure changes required take time to design and deploy.
A practical preparation approach looks like this. First, conduct an internal audit of all digital touchpoints where patients or staff are asked to verify their identity or sign documents. Understand which of these processes will fall under eIDAS 2.0 obligations, which deadline applies, whether your organisation qualifies as a public body or a regulated private sector party, and which currently fall short of the required assurance levels. This audit forms the foundation of any credible implementation roadmap.
Second, engage with qualified trust service providers early. The technical requirements for wallet integration and qualified electronic signatures are complex, and working with experienced partners reduces the risk of building solutions that do not meet the required standards. Look for providers that are already listed on the relevant national trusted lists and have demonstrated experience in regulated sectors such as healthcare digital identity.
Third, think about reusability from the start. One of the core principles behind eIDAS 2.0 is that a patient or professional who has already been verified should not need to go through the same process again for every interaction. Building identity flows that support reusable credentials will reduce costs over time and improve the patient experience significantly. For more on how this principle applies across sectors, the TrustTech approach to identity offers useful context.
Fourth, align your eIDAS 2.0 preparation with your broader data governance and GDPR compliance work. The two regulatory frameworks overlap significantly, and treating them as separate workstreams creates unnecessary duplication and risk. Involving compliance, IT, clinical, and legal stakeholders in a single programme is more effective than running parallel tracks.
Finally, stay close to the pilot programme outcomes. The POTENTIAL Large Scale Pilot tested real-world scenarios including prescription management and cross-border health credentials. The lessons from those pilots are feeding directly into the final technical specifications that healthcare providers will need to implement. Because national rollout, certification, and operational interoperability will develop at different rates across Member States, organisations should monitor developments in their own jurisdiction.
How TrustTech helps healthcare providers with eIDAS 2.0
Healthcare providers face a genuine implementation challenge: the requirements under eIDAS 2.0 are technically complex, the timelines are fixed, and the stakes, for patient trust and regulatory compliance alike, are high.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For healthcare specifically, the ID Connector handles the following:
- Verifying patient and staff identities at high assurance levels, with reusable credentials that eliminate repetitive checks across interactions
- Validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
- Checking revocation status and verifying issuer signatures against the relevant national trusted lists, which are part of the EU List of Trusted Lists (LOTL)
- Enforcing the registered attribute scope so that only attributes declared in the relying party registration under CIR (EU) 2025/848 are requested
- Connecting to a QTSP for qualified signing of consent forms, prescriptions, and clinical documents, fully aligned with eIDAS 2.0 standards
- Building a complete audit trail linking every verified identity to every signed document or decision
- Reducing onboarding friction for patients while meeting the data minimisation requirements of both eIDAS 2.0 and GDPR
TrustTech’s platform connects identity verification, reusable compliance, and trusted signatures in a single infrastructure, so healthcare organisations in both the public and regulated private sector do not need to stitch together multiple vendors to meet their obligations. Explore the TrustTech solutions for healthcare or get in touch to discuss what eIDAS 2.0 means for your specific situation.