# GDPR and OpenEhr.
**URL:** https://discourse.openehr.org/t/gdpr-and-openehr/15711
**Category:** Technical (archive)
**Created:** [1 September 2018 13:52 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711 "2018-09-01T13:52:11Z")
**Posts on this page:** 9
**Page:** 2
### Author:  [@Karsten\_Hilbert](https://discourse.openehr.org/u/Karsten_Hilbert)
#### Post date: [3 September 2018 13:23 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/21 "2018-09-03T13:23:02Z")
I think we agree.
Karsten
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [3 September 2018 13:25 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/22 "2018-09-03T13:25:08Z")
> In all other contexts the patient can never be forgotten or deleted. Any legal transaction is subject to archiving laws. For tax purposes the time period is 5 years in the Netherlands, I think. Only after these periods as defined by law the transactions can/must be deleted.
It is true that there are laws which make it necessary to keep certain data, good example, taxes. I business owner must keep a record of all financial transactions. I think the GDPR excludes this from its effect, because laws may not contradict each other.
Thanks for this remark
Bert
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [4 September 2018 14:40 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/23 "2018-09-04T14:40:30Z")
Dear all,
I published recently an attempt to “systematyse” the relation between openehr and gdpr.
Hope it is useful to you.
Link: [http://ebooks.iospress.nl/publication/48760](http://ebooks.iospress.nl/publication/48760)
Regards,
---
### Author:  [@yampeku](https://discourse.openehr.org/u/yampeku)
#### Post date: [4 September 2018 14:45 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/24 "2018-09-04T14:45:41Z")
Really useful resource Ricardo!
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [4 September 2018 15:21 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/25 "2018-09-04T15:21:41Z")
Thanks very much for sharing, I am sure that the chapter OpenEhr and GDPR is not yet to be closed, there is quite some work to do. Although I have difficulties estimating the consequences, because of the concise wording. I hope that the community shall find its way. OpenEhr must be able to run under jurisdiction of the GDPR, and of course also many other jurisdictions Bert
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [4 September 2018 15:52 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/26 "2018-09-04T15:52:41Z")
In my view, GDPR is a huge opportunity for openEHR.
Issues like versioning of templates and compositions allow security aligned with GDPR.
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [5 September 2018 09:15 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/27 "2018-09-05T09:15:45Z")
Thomas,
The record can stay where it was.
Only the connection of identifying patient data and the Record-ID needs to be encrypted.
De-encryption can take place using a key owned and provided by a notary public.
All must be handled by the Patient-ID server and an official functionary that is equipped to manage keys in a trusted way.
Gerard Freriks
+31 620347088
[gfrer@luna.nl](mailto:gfrer@luna.nl)
Kattensingel 20
2801 CA Gouda
the Netherlands
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [5 September 2018 15:12 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/28 "2018-09-05T15:12:41Z")
I don’t think that is enough, Gerard, if the record contains DNA material, or other identifying material.
---
### Author:  [@system](https://discourse.openehr.org/u/system)
#### Post date: [5 September 2018 17:24 UTC](https://discourse.openehr.org/t/gdpr-and-openehr/15711/29 "2018-09-05T17:24:08Z")
Lets be clear.
Each record of a patient is a unique traversal of the health and care system over time and therefor very much identifying the patient.
What we talk about is: the right to be forgotten and the circumstance that after a legal period the medical data must be destroyed in some countries.
The EHR 13606 is designed based on a set of medical-legal requirements.
I’m of the opinion that that set does not need an update because of the new privacy law.
When I’m mistaken I would like to be pointed at those missing requirements.
Gerard Freriks
+31 620347088
[gfrer@luna.nl](mailto:gfrer@luna.nl)
Kattensingel 20
2801 CA Gouda
the Netherlands
[Previous page](https://discourse.openehr.org/t/gdpr-and-openehr/15711.md?page=1)