A Luxembourg ruling could force a rethink of access rules for electronic patient files across Europe
Bulgaria’s rules on access to electronic health records are facing scrutiny at the EU’s top court after rights lawyers challenged what they describe as excessively broad access to sensitive personal data.
The case, now before the Court of Justice of the European Union (CJEU) in Luxembourg, could have significant implications for how EU member states balance digital healthcare services with privacy protections.
More than two years ago, representatives of a medical centre challenged Bulgaria’s rules on the storage and management of health data before the country’s Supreme Administrative Court. Their lawyers, human rights advocates Mihail Ekimdzhiev and Milena Dokova, requested that the dispute be referred to the CJEU for clarification under EU law.
After lengthy proceedings, Bulgaria’s Supreme Administrative Court ruled in July 2026 that there are grounds to question whether the country’s framework for protecting health data, among the most sensitive categories of personal information, complies with EU standards.
