ImageVerifierCode 换一换
格式:PDF , 页数:58 ,大小:526.94KB ,
资源ID:572483      下载积分:10000 积分
快捷下载
登录下载
邮箱/手机:
温馨提示:
快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。 如填写123,账号就是123,密码也是123。
特别说明:
请自助下载,系统不会自动发送文件的哦; 如果您已付费,想二次下载,请登录后访问:我的下载记录
支付方式: 支付宝扫码支付 微信扫码支付   
验证码:   换一换

加入VIP,免费下载
 

温馨提示:由于个人手机设置不同,如果发现不能下载,请复制以下地址【http://www.mydoc123.com/d-572483.html】到电脑端继续下载(重复下载不扣费)。

已注册用户请登录:
账号:
密码:
验证码:   换一换
  忘记密码?
三方登录: 微信登录  

下载须知

1: 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。
2: 试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。
3: 文件的所有权益归上传用户所有。
4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
5. 本站仅提供交流平台,并不能对任何下载内容负责。
6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

版权提示 | 免责声明

本文(BS EN 14484-2004 Health informatics - International transfer of personal health data covered by the EU data protection directive - High level security policy《医疗信息学 EU数据保护指令中包含的个人医疗.pdf)为本站会员(fuellot230)主动上传,麦多课文库仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文库(发送邮件至master@mydoc123.com或直接QQ联系客服),我们立即给予删除!

BS EN 14484-2004 Health informatics - International transfer of personal health data covered by the EU data protection directive - High level security policy《医疗信息学 EU数据保护指令中包含的个人医疗.pdf

1、BRITISH STANDARD BS EN 14484:2003 Health informatics International transfer of personal health data covered by the EU data protection directive High level security policy The European Standard EN 14484:2003 has the status of a British Standard ICS 35.240.80 BS EN 14484:2003 This British Standard was

2、 published under the authority of the Standards Policy and Strategy Committee on 13 January 2004 BSI 13 January 2004 ISBN 0 580 43211 4 National foreword This British Standard is the official English language version of EN 14484:2003. The UK participation in its preparation was entrusted to Technica

3、l Committee IST/35, Health informatics, which has the responsibility to: A list of organizations represented on this committee can be obtained on request to its secretary. Cross-references The British Standards which implement international or European publications referred to in this document may b

4、e found in the BSI Catalogue under the section entitled “International Standards Correspondence Index”, or by using the “Search” facility of the BSI Electronic Catalogue or of British Standards Online. This publication does not purport to include all the necessary provisions of a contract. Users are

5、 responsible for its correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change, and

6、keep the UK interests informed; monitor related international and European developments and promulgate them in the UK. Summary of pages This document comprises a front cover, an inside front cover, the EN title page, pages 2 to 55 and a back cover. The BSI copyright notice displayed in this document

7、 indicates when the document was last issued. Amendments issued since publication Amd. No. Date CommentsEUROPEANSTANDARD NORMEEUROPENNE EUROPISCHENORM EN14484 December2003 ICS35.240.80 Englishversion HealthinformaticsInternationaltransferofpersonalhealthdata coveredbytheEUdataprotectiondirectiveHigh

8、levelsecurity policy InformatiquedesantTransfertinternationaldesdonnes personellesdesantcouvertesparladirectiveeuropenne surlaprotectiondesdonnespersonellesPolitiquede scuritdehautniveau MedizinischeInformatikInternationalerAustauschvon unterdieEUDatenschutzrichtliniefallendenpersnlichen Gesundheits

9、datenGenerelleSicherheitsStatements ThisEuropeanStandardwasapprovedbyCENon13November2003. CENmembersareboundtocomplywiththeCEN/CENELECInternalRegulationswhichstipulatetheconditionsforgivingthisEurope an Standardthestatusofanationalstandardwithoutanyalteration.Uptodatelistsandbibliographicalreference

10、sconcernings uchnational standardsmaybeobtainedonapplicationtotheManagementCentreortoanyCENmember. ThisEuropeanStandardexistsinthreeofficialversions(English,French,German).Aversioninanyotherlanguagemadebytra nslation undertheresponsibilityofaCENmemberintoitsownlanguageandnotifiedtotheManagementCentr

11、ehasthesamestatusasthe official versions. CENmembersarethenationalstandardsbodiesofAustria,Belgium,CzechRepublic,Denmark,Finland,France,Germany,Greece, Hungary,Iceland,Ireland,Italy,Luxembourg,Malta,Netherlands,Norway,Portugal,Slovakia,Spain,Sweden,SwitzerlandandUn ited Kingdom. EUROPEANCOMMITTEEFOR

12、STANDARDIZATION COMITEUROPENDENORMALISATION EUROPISCHESKOMITEEFRNORMUNG ManagementCentre:ruedeStassart,36B1050Brussels 2003CEN Allrightsofexploitationinanyformandbyanymeansreserved worldwideforCENnationalMembers. Ref.No.EN14484:2003EEN14484:2003(E) 2 Contents page Foreword4 Introduction .5 1 Scope 9

13、 2 Normativereferences 9 3 Termsanddefinitions. .9 4 Abbreviatedterms . 10 5 TheEuropeanDataProtectionDirective(seeannexA) .11 5.1 General .11 5.2 Generalaims:(Article1) . 11 5.3 Scope:electronicandnonelectronic(Article3) .11 5.4 Principlesrelatingtodataquality(Article6). .11 5.5 Criteriaforlegitima

14、cy(Article7). .11 5.6 Specialcategoriesofprocessing,includingpersonalhealthdata(Article8) .12 5.7 Informationtobegiventothedatasubject(Article10) 12 5.8 Rightofaccesstodata(Article12) .12 5.9 Righttoobject(Article14) .12 5.10 Securityofprocessing(Article17) 12 5.11 Judicialremedies,liabilityandsanct

15、ions(Articles22,23and24)13 5.12 SupervisoryAuthorities(Articles28and18). 13 5.13 WorkingpartyontheprotectionofIndividualswithregardtotheProcessingofPersonalData13 5.14 TransferofpersonaldatatoThirdCountries. .13 6 RequirementsforthetransferofpersonaldatatothirdCountries13 6.1 General .13 6.2 Princip

16、les(Article25) . .13 6.3 Ensuringtransfersarepermissible .14 6.4 Groundsbywhichtransferstothirdcountriesarepermissible.14 7 ASecurityPolicyforthirdcountries . 16 7.1 Therequirement. .16 7.2 Thepurposeofthesecuritypolicy 16 7.3 Thelevelofthesecuritypolicy 16 8 HighLevelSecurityPolicy:generalaspects .

17、 .17 8.1 Levelsofabstractioninensuringsecurity .17 Genericprinciples . .17 8.3 NongenericPrinciples 17 8.4 Guidelines .18 8.5 Measures 18 8.6 ElementsofaHighLevelSecurityPolicy .18 9 HighLevelSecurityPolicy:thecontent . .18 9.1 PrincipleOne:overridinggenericprinciple . 18 9.2 PrincipleTwo:chiefexecu

18、tivesupport .19 9.3 PrincipleThree:documentationofMeasuresandreview.19 9.4 PrincipleFour:DataProtectionSecurityOfficer .20 9.5 PrincipleFive:permissiontoprocess . 20 9.6 PrincipleSix:informationaboutprocessing. .21 9.7 PrincipleSeven:informationforthedatasubject . 23 9.8 PrincipleEight:prohibitionof

19、onwarddatatransferwithoutconsent23 9.9 PrincipleNine:remediesandcompensation . .24 9.10 PrincipleTen:securityofprocessing 25EN14484:2003(E) 3 9.11 PrincipleEleven:responsibilitiesofstaffandothercontractors .26 9.12 PrincipleTwelve:adequacyofthirdcountrydataprotection 26 9.13 PrincipleThirteen:additi

20、onalEUMemberStateparticularrequirements 27 10 RationaleandObservationsonMeasurestosupportPrincipleTenconcerningsecurityof processing27 10.1 General .27 10.2 Encryptionanddigitalsignaturesfortransmissiontothethirdcountry 27 10.3 Accesscontrolsanduserauthentication 27 10.4 AuditTrails . .28 10.5 Physi

21、calandenvironmentalsecurity 28 10.6 Applicationmanagementandnetworkmanagement .28 10.7 Viruses 28 10.8 Breachesofsecurity . 28 10.9 BusinessContinuityPlan . .28 10.10 Handlingparticularlysensitivedata 28 10.11 Standards29 11 Personalhealthdatainnonelectronicform 29 AnnexA (normative) EUDataProtectio

22、nDirective 30 AnnexB (informative) Usefulsourcesofadvice.5 0 B.1 EUSecurityprojects .50 B.2 CEN/ISSS .50 B.3 NonCENStandards . 50 B.4 Selectedwebsites 51 AnnexC (informative) Modeldeclaration 52 Bibliography 54EN14484:2003(E) 4 Foreword Thisdocument(EN14484:2003)hasbeenpreparedbyTechnicalCommitteeCE

23、N/TC 251“European StandardizationofHealthInformatics“,thesecretariatofwhichisheldbySIS. ThisEuropeanStandardshallbegiventhestatusofanationalstandard,eitherbypublicationofanidenticaltextor byendorsement,atthelatestbyJune2004,andconflictingnationalstandardsshallbewithdrawnatthelatestby June2004. Annex

24、Aisnormative.TheannexesBandCareinformative. AccordingtotheCEN/CENELECInternalRegulations,thenationalstandardsorganizationsofthefollowing countriesareboundtoimplementthisEuropeanStandard:Austria,Belgium,CzechRepublic,Denmark,Finland, France,Germany,Greece,Hungary,Iceland,Ireland,Italy,Luxembourg,Malt

25、a,Netherlands,Norway,Portugal, Slovakia,Spain,Sweden,SwitzerlandandtheUnitedKingdom.EN14484:2003(E) 5 Introduction Inthehealthcontext,informationaboutindividualsneedstobecollected,storedandprocessedformanypurposes, themainbeing: directdeliveryofcaree.g.patientrecords; administrativeprocessese.g.book

26、ingappointments; clinical research; statistics. Thedatarequireddependsonthepurpose.Inthecontextofidentificationofindividuals,datamaybeneeded: toallowanindividualtobereadilyanduniquelyidentifiede.g.acombinationofname,address,age,sex, identificationnumber; toconfirmthattwodatasetsbelongtothesameindivi

27、dualwithoutanyneedtoidentifytheindividual himselfe.g.forrecordlinkageand/orlongitudinalstatistics; forstatisticalpurposesbutwiththeenddesirepositivelytopreventidentificationofanyindividual. Inallofthesecircumstancesdataaboutindividualsarenow,andwillincreasinglyinthefuture,betransmitted acrossnationa

28、lbordersorbedeliberatelymadeaccessibletocountriesotherthanwheretheyarecollectedor stored.Datamaybecollectedinonecountryandstoredinanother,beprocessedinathird,andbeaccessible frommanycountriesorevenglobally.Thekeyrequirementisthatallthisprocessingshouldbecarriedoutina fashionthatisconsistentwiththe:

29、thepurposesandconsentsoftheoriginaldatacollectionand,inparticular; alldisclosuresofpersonalhealthdatashouldbetoappropriateindividualsororganisationswithin thesepurposesandconsents. Internationalhealthrelatedapplicationsrequirehealthrelateddatatobetransmittedfromonenationtoanother acrossnationalborde

30、rs.Thatisveryevidentintelemedicineorwhendataareelectronicallydispatchedfor exampleinanemailorasadatafiletobeaddedtoaninternationaldatabase.Italsooccurs,butlessobviously, whenadatabaseinonecountryisviewedfromanotherforexampleovertheInternet.Thatapplicationmay appearpassivebuttheveryactofviewinginvolv

31、esdisclosureofthatdataandisdeemedprocessing.Moreoverit requiresadownloadthatmaybeautomaticallyplacedinacacheandheldthereuntilemptiedthisalsois processingandinvolvesaparticularsecurityhazard. Thereisawiderangeinthetypesofthirdcountryorganisationthatmightbeinvolvedinreceiptofpersonalhealth datafromanE

32、UMemberStateforexample: healthcareestablishmentssuchashospitals; pharmaceuticalcompaniesinvolvedinresearch; contractorsremotelymaintaininghealthcaresystemsinEUhospitals; companiesholdingeducationaldatabasescontainingforexampleradiologicalimageswithdiagnoses andcasenotes; companiesholdingbanksofmedic

33、alrecordsforpatientsfromdifferentcountries. Inallapplicationsinvolvingpersonalhealthdatatherecanbeapotentialthreattotheprivacyofanindividual.That threatanditsextentwilldependon: theleveltowhichdataisprotectedfromunauthorisedaccessinstorageortransmission; thenumberofpersonswhohaveauthorisedaccess; th

34、enatureofthepersonalhealthdatastored; thelevelofdifficultyinidentifyinganindividualifaccesstothedataisobtained;EN14484:2003(E) 6 thedifficultyinobtainingunauthorisedaccess. Whereverhealthdataarecollected,stored,processedorpublished(includingelectronicallyontheInternet)the potentialthreattoprivacynee

35、dstobeassessedandappropriateprotectivemeasurestaken.Someformofrisk analysisshouldbeundertakentoascertaintherequiredlevelofsecuritymeasures. InadditiontothestandardsbodiesCEN,CENELEC,ISOandIECtherearethreemajortransnationalbodiesthat haveproducedinternationallyauthoritativedocumentsrelatingtosecurity

36、anddataprotection: theEuropeanUnion(EU); theOrganisationforEconomicCooperationandDevelopment(OECD); theCouncilofEurope; theUnitedNations(UN). Theprimarydocumentsfromthesebodiesare: EUDataProtectionDirective“ontheprotectionofindividualswithregardtotheprocessingofpersonal dataandfreemovementofthatdata

37、“1; OECD“GuidelinesontheProtectionofPrivacyandTransborderflowsofPersonalData“2; OECD“GuidelinesfortheSecurityofInformationSystems“3; CouncilofEurope“ConventionfortheProtectionofindividualswithregardtoAutomaticProcessingof PersonalData“No.1084; “CouncilofEuropeRecommendationR(97)5ontheProtectionofMed

38、icalData“5; UNGeneralAssembly“GuidelinesfortheRegulationofComputerisedPersonalDataFiles“6. Themeansandextentoftheprotectionaffordedtopersonalhealthdatavariesfromnationtonation7.Insome countriesthereisnationwideprivacylegislation,inotherslegislativeprovisionsmaybeatastatelevelor equivalent.Inanumbero

39、fcountriesnolegislationmayexistalthoughvariouscodesofpracticeorequivalentwill probablybeinplaceand/ormedicallawswhichlaydownadutyonmedicalpractitionerstosafeguard confidentiality. Althoughprivacylegislationindifferentpartsoftheworldmaymentionpersonalhealthdata,frequentlythereisno legislationspecific

40、tohealthexceptperhapsinrelationtogovernmentagenciesand/ormedicalresearch. TheEUDirectiveonDataProtection(seetextinannexA)aimstocreateuniformlegislativedataprotection provisionsthroughouttheEU.TheDirectivealsoappliestononcommunitycountriesoftheEuropeanEconomic AreabyvirtueoftheEEATreatyDecision83/199

41、9of25June1999.ThemajorityofcountriesofCentraland EasternEuropeandCypruswhichareapplicantstobecomemembersoftheEU,arealsolookingtointroduce legislationinconformancewiththeDirective. TheDirectivemakesitpermissibleforpersonaldatatobepassedacrossEUborders.However,thetransferof personaldatafromanEUcountry

42、toanonEUcountryiscontrolledbyArticles25and26. Inessence,subjecttospecificderogations,Article25allowstransferofpersonaldatatoathirdcountryonlyifthat thirdcountryensuresanadequatelevelofprotection. Theadequacyofprotectionistobeassessed(Article25.2)inthelightofallthecircumstanceswithparticular consider

43、ationtobegiventoparticularfactorsincluding: thenatureofthedata; thepurposeanddurationoftheproposedprocessingoperation(s); therulesoflawapplying; theprofessionalrulesandsecuritymeasureswhicharecompliedwith; thecountryconcerned. Inthehealthcontextpersonalhealthdatacanbeextremelysensitiveinnatureandisrecognisedassuchbythe Directive.Thereisextensiveguidanceavailablebothnationallyandinternationallyonsecuritymeasuresforthe protectionofpersonalhealthdata(seeannexB). Asnotedabovethereisinmanycountriesamixofgeneralandspecific

copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
备案/许可证编号:苏ICP备17064731号-1