GDPR Compliance Challenges for Interoperable Health Information Exchanges (HIEs) and Trustworthy Research Environments (TREs)

Abstract

and processors once it comes into force in the spring of 2018. Fundamentally, GDPR aims to provide a set of standardized data protection laws across EU countries. This is intended to make it easier for EU citizens to understand how their data is being used and to raise any complaints. For implementers, it has potential to reduce fragmentation and administrative burdens where business activities flow through local, regional, national and international data exchanges. A full treatment of the data protection principles that drive compliance to the GDPR is beyond the scope of this paper, but an abundance of introductory resources is available on the Internet.

Data protection issues in cross-border interoperability of Electronic Health Record systems within the European Union

“…According to Article 32 of the GDPR, systems should be properly secure with measures to ensure a security level appropriate to the concrete risks. 33 The protection against unauthorized access or unlawful processing, accidental loss, disclosure, destruction or damage, and identity theft or fraud, should be granted in each EHR system (Conley and Pocs, 2018). Auditing and archiving of the access and back-up mechanisms are common security measures for interoperable EHR systems.…”

“…34 According to Article 25 of the GDPR, EHR technologies should integrate DPbD and by default technical and organizational measures. The data protection by design obligation plays a major role in the development of EHRs (Conley and Pocs, 2018). The systems and standard formats should be designed to effectively implement the various data protection principles, to guarantee the compliance with the law, and to protect the rights of data subjects.…”

Service level agreement‐based GDPR compliance and security assurance in(multi)Cloud‐based systems

“…It is worth outlining that this paper explicitly addresses the problem of proposing a methodology to support security and privacy issues in a technical way, clearly identifying privacy and security requirements and to suggest related countermeasures. For what regards the compliance to actual regulation, like GDPR, especially in terms of legal aspects compliance, few concrete experiences are available (as an example [17]), and we hold over the topic for a future work.…”

Up-to-the-Minute Privacy Policies via Gossips in Participatory Epidemiological Studies

“…The reputation of a research institution encourages individuals to participate in research (Conley and Pocs, 2018 ). Any unaddressed concerns or privacy incidents can severely affect participation, which voluntary research on data from human subjects relies heavily upon (Kelsey, 1981 ; Couper et al, 2008 ).…”

“…Interoperability and collaboration are often required in large projects where collaborators join at a later stage (Conley and Pocs, 2018 ). Often subjects are not aware of these future collaborators.…”