GDPR and OpenEhr.

Technical (archive)
21

I think we agree.

Karsten

22

In all other contexts the patient can never be forgotten or deleted. Any legal transaction is subject to archiving laws. For tax purposes the time period is 5 years in the Netherlands, I think. Only after these periods as defined by law the transactions can/must be deleted.

It is true that there are laws which make it necessary to keep certain data, good example, taxes. I business owner must keep a record of all financial transactions. I think the GDPR excludes this from its effect, because laws may not contradict each other.

Thanks for this remark

Bert

23

Dear all,

I published recently an attempt to “systematyse” the relation between openehr and gdpr.

Hope it is useful to you.

Link: http://ebooks.iospress.nl/publication/48760

Regards,

24

Really useful resource Ricardo!

25

Thanks very much for sharing, I am sure that the chapter OpenEhr and GDPR is not yet to be closed, there is quite some work to do. Although I have difficulties estimating the consequences, because of the concise wording. I hope that the community shall find its way. OpenEhr must be able to run under jurisdiction of the GDPR, and of course also many other jurisdictions Bert

26

In my view, GDPR is a huge opportunity for openEHR.

Issues like versioning of templates and compositions allow security aligned with GDPR.

27

Thomas,

The record can stay where it was.
Only the connection of identifying patient data and the Record-ID needs to be encrypted.
De-encryption can take place using a key owned and provided by a notary public.

All must be handled by the Patient-ID server and an official functionary that is equipped to manage keys in a trusted way.

Gerard Freriks
+31 620347088
gfrer@luna.nl

Kattensingel 20
2801 CA Gouda
the Netherlands

28

I don’t think that is enough, Gerard, if the record contains DNA material, or other identifying material.

29

Lets be clear.
Each record of a patient is a unique traversal of the health and care system over time and therefor very much identifying the patient.

What we talk about is: the right to be forgotten and the circumstance that after a legal period the medical data must be destroyed in some countries.
The EHR 13606 is designed based on a set of medical-legal requirements.
I’m of the opinion that that set does not need an update because of the new privacy law.
When I’m mistaken I would like to be pointed at those missing requirements.

Gerard Freriks
+31 620347088
gfrer@luna.nl

Kattensingel 20
2801 CA Gouda
the Netherlands