1、BRITISH STANDARD BS EN 14484:2003 Health informatics International transfer of personal health data covered by the EU data protection directive High level security policy The European Standard EN 14484:2003 has the status of a British Standard ICS 35.240.80 BS EN 14484:2003 This British Standard was
2、 published under the authority of the Standards Policy and Strategy Committee on 13 January 2004 BSI 13 January 2004 ISBN 0 580 43211 4 National foreword This British Standard is the official English language version of EN 14484:2003. The UK participation in its preparation was entrusted to Technica
3、l Committee IST/35, Health informatics, which has the responsibility to: A list of organizations represented on this committee can be obtained on request to its secretary. Cross-references The British Standards which implement international or European publications referred to in this document may b
4、e found in the BSI Catalogue under the section entitled “International Standards Correspondence Index”, or by using the “Search” facility of the BSI Electronic Catalogue or of British Standards Online. This publication does not purport to include all the necessary provisions of a contract. Users are
5、 responsible for its correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change, and
6、keep the UK interests informed; monitor related international and European developments and promulgate them in the UK. Summary of pages This document comprises a front cover, an inside front cover, the EN title page, pages 2 to 55 and a back cover. The BSI copyright notice displayed in this document
7、 indicates when the document was last issued. Amendments issued since publication Amd. No. Date CommentsEUROPEANSTANDARD NORMEEUROPENNE EUROPISCHENORM EN14484 December2003 ICS35.240.80 Englishversion HealthinformaticsInternationaltransferofpersonalhealthdata coveredbytheEUdataprotectiondirectiveHigh
8、levelsecurity policy InformatiquedesantTransfertinternationaldesdonnes personellesdesantcouvertesparladirectiveeuropenne surlaprotectiondesdonnespersonellesPolitiquede scuritdehautniveau MedizinischeInformatikInternationalerAustauschvon unterdieEUDatenschutzrichtliniefallendenpersnlichen Gesundheits
9、datenGenerelleSicherheitsStatements ThisEuropeanStandardwasapprovedbyCENon13November2003. CENmembersareboundtocomplywiththeCEN/CENELECInternalRegulationswhichstipulatetheconditionsforgivingthisEurope an Standardthestatusofanationalstandardwithoutanyalteration.Uptodatelistsandbibliographicalreference
10、sconcernings uchnational standardsmaybeobtainedonapplicationtotheManagementCentreortoanyCENmember. ThisEuropeanStandardexistsinthreeofficialversions(English,French,German).Aversioninanyotherlanguagemadebytra nslation undertheresponsibilityofaCENmemberintoitsownlanguageandnotifiedtotheManagementCentr
11、ehasthesamestatusasthe official versions. CENmembersarethenationalstandardsbodiesofAustria,Belgium,CzechRepublic,Denmark,Finland,France,Germany,Greece, Hungary,Iceland,Ireland,Italy,Luxembourg,Malta,Netherlands,Norway,Portugal,Slovakia,Spain,Sweden,SwitzerlandandUn ited Kingdom. EUROPEANCOMMITTEEFOR
12、STANDARDIZATION COMITEUROPENDENORMALISATION EUROPISCHESKOMITEEFRNORMUNG ManagementCentre:ruedeStassart,36B1050Brussels 2003CEN Allrightsofexploitationinanyformandbyanymeansreserved worldwideforCENnationalMembers. Ref.No.EN14484:2003EEN14484:2003(E) 2 Contents page Foreword4 Introduction .5 1 Scope 9
13、 2 Normativereferences 9 3 Termsanddefinitions. .9 4 Abbreviatedterms . 10 5 TheEuropeanDataProtectionDirective(seeannexA) .11 5.1 General .11 5.2 Generalaims:(Article1) . 11 5.3 Scope:electronicandnonelectronic(Article3) .11 5.4 Principlesrelatingtodataquality(Article6). .11 5.5 Criteriaforlegitima
14、cy(Article7). .11 5.6 Specialcategoriesofprocessing,includingpersonalhealthdata(Article8) .12 5.7 Informationtobegiventothedatasubject(Article10) 12 5.8 Rightofaccesstodata(Article12) .12 5.9 Righttoobject(Article14) .12 5.10 Securityofprocessing(Article17) 12 5.11 Judicialremedies,liabilityandsanct
15、ions(Articles22,23and24)13 5.12 SupervisoryAuthorities(Articles28and18). 13 5.13 WorkingpartyontheprotectionofIndividualswithregardtotheProcessingofPersonalData13 5.14 TransferofpersonaldatatoThirdCountries. .13 6 RequirementsforthetransferofpersonaldatatothirdCountries13 6.1 General .13 6.2 Princip
16、les(Article25) . .13 6.3 Ensuringtransfersarepermissible .14 6.4 Groundsbywhichtransferstothirdcountriesarepermissible.14 7 ASecurityPolicyforthirdcountries . 16 7.1 Therequirement. .16 7.2 Thepurposeofthesecuritypolicy 16 7.3 Thelevelofthesecuritypolicy 16 8 HighLevelSecurityPolicy:generalaspects .
17、 .17 8.1 Levelsofabstractioninensuringsecurity .17 Genericprinciples . .17 8.3 NongenericPrinciples 17 8.4 Guidelines .18 8.5 Measures 18 8.6 ElementsofaHighLevelSecurityPolicy .18 9 HighLevelSecurityPolicy:thecontent . .18 9.1 PrincipleOne:overridinggenericprinciple . 18 9.2 PrincipleTwo:chiefexecu
18、tivesupport .19 9.3 PrincipleThree:documentationofMeasuresandreview.19 9.4 PrincipleFour:DataProtectionSecurityOfficer .20 9.5 PrincipleFive:permissiontoprocess . 20 9.6 PrincipleSix:informationaboutprocessing. .21 9.7 PrincipleSeven:informationforthedatasubject . 23 9.8 PrincipleEight:prohibitionof
19、onwarddatatransferwithoutconsent23 9.9 PrincipleNine:remediesandcompensation . .24 9.10 PrincipleTen:securityofprocessing 25EN14484:2003(E) 3 9.11 PrincipleEleven:responsibilitiesofstaffandothercontractors .26 9.12 PrincipleTwelve:adequacyofthirdcountrydataprotection 26 9.13 PrincipleThirteen:additi
20、onalEUMemberStateparticularrequirements 27 10 RationaleandObservationsonMeasurestosupportPrincipleTenconcerningsecurityof processing27 10.1 General .27 10.2 Encryptionanddigitalsignaturesfortransmissiontothethirdcountry 27 10.3 Accesscontrolsanduserauthentication 27 10.4 AuditTrails . .28 10.5 Physi
21、calandenvironmentalsecurity 28 10.6 Applicationmanagementandnetworkmanagement .28 10.7 Viruses 28 10.8 Breachesofsecurity . 28 10.9 BusinessContinuityPlan . .28 10.10 Handlingparticularlysensitivedata 28 10.11 Standards29 11 Personalhealthdatainnonelectronicform 29 AnnexA (normative) EUDataProtectio
22、nDirective 30 AnnexB (informative) Usefulsourcesofadvice.5 0 B.1 EUSecurityprojects .50 B.2 CEN/ISSS .50 B.3 NonCENStandards . 50 B.4 Selectedwebsites 51 AnnexC (informative) Modeldeclaration 52 Bibliography 54EN14484:2003(E) 4 Foreword Thisdocument(EN14484:2003)hasbeenpreparedbyTechnicalCommitteeCE
23、N/TC 251“European StandardizationofHealthInformatics“,thesecretariatofwhichisheldbySIS. ThisEuropeanStandardshallbegiventhestatusofanationalstandard,eitherbypublicationofanidenticaltextor byendorsement,atthelatestbyJune2004,andconflictingnationalstandardsshallbewithdrawnatthelatestby June2004. Annex
24、Aisnormative.TheannexesBandCareinformative. AccordingtotheCEN/CENELECInternalRegulations,thenationalstandardsorganizationsofthefollowing countriesareboundtoimplementthisEuropeanStandard:Austria,Belgium,CzechRepublic,Denmark,Finland, France,Germany,Greece,Hungary,Iceland,Ireland,Italy,Luxembourg,Malt
25、a,Netherlands,Norway,Portugal, Slovakia,Spain,Sweden,SwitzerlandandtheUnitedKingdom.EN14484:2003(E) 5 Introduction Inthehealthcontext,informationaboutindividualsneedstobecollected,storedandprocessedformanypurposes, themainbeing: directdeliveryofcaree.g.patientrecords; administrativeprocessese.g.book
26、ingappointments; clinical research; statistics. Thedatarequireddependsonthepurpose.Inthecontextofidentificationofindividuals,datamaybeneeded: toallowanindividualtobereadilyanduniquelyidentifiede.g.acombinationofname,address,age,sex, identificationnumber; toconfirmthattwodatasetsbelongtothesameindivi
27、dualwithoutanyneedtoidentifytheindividual himselfe.g.forrecordlinkageand/orlongitudinalstatistics; forstatisticalpurposesbutwiththeenddesirepositivelytopreventidentificationofanyindividual. Inallofthesecircumstancesdataaboutindividualsarenow,andwillincreasinglyinthefuture,betransmitted acrossnationa
28、lbordersorbedeliberatelymadeaccessibletocountriesotherthanwheretheyarecollectedor stored.Datamaybecollectedinonecountryandstoredinanother,beprocessedinathird,andbeaccessible frommanycountriesorevenglobally.Thekeyrequirementisthatallthisprocessingshouldbecarriedoutina fashionthatisconsistentwiththe:
29、thepurposesandconsentsoftheoriginaldatacollectionand,inparticular; alldisclosuresofpersonalhealthdatashouldbetoappropriateindividualsororganisationswithin thesepurposesandconsents. Internationalhealthrelatedapplicationsrequirehealthrelateddatatobetransmittedfromonenationtoanother acrossnationalborde
30、rs.Thatisveryevidentintelemedicineorwhendataareelectronicallydispatchedfor exampleinanemailorasadatafiletobeaddedtoaninternationaldatabase.Italsooccurs,butlessobviously, whenadatabaseinonecountryisviewedfromanotherforexampleovertheInternet.Thatapplicationmay appearpassivebuttheveryactofviewinginvolv
31、esdisclosureofthatdataandisdeemedprocessing.Moreoverit requiresadownloadthatmaybeautomaticallyplacedinacacheandheldthereuntilemptiedthisalsois processingandinvolvesaparticularsecurityhazard. Thereisawiderangeinthetypesofthirdcountryorganisationthatmightbeinvolvedinreceiptofpersonalhealth datafromanE
32、UMemberStateforexample: healthcareestablishmentssuchashospitals; pharmaceuticalcompaniesinvolvedinresearch; contractorsremotelymaintaininghealthcaresystemsinEUhospitals; companiesholdingeducationaldatabasescontainingforexampleradiologicalimageswithdiagnoses andcasenotes; companiesholdingbanksofmedic
33、alrecordsforpatientsfromdifferentcountries. Inallapplicationsinvolvingpersonalhealthdatatherecanbeapotentialthreattotheprivacyofanindividual.That threatanditsextentwilldependon: theleveltowhichdataisprotectedfromunauthorisedaccessinstorageortransmission; thenumberofpersonswhohaveauthorisedaccess; th
34、enatureofthepersonalhealthdatastored; thelevelofdifficultyinidentifyinganindividualifaccesstothedataisobtained;EN14484:2003(E) 6 thedifficultyinobtainingunauthorisedaccess. Whereverhealthdataarecollected,stored,processedorpublished(includingelectronicallyontheInternet)the potentialthreattoprivacynee
35、dstobeassessedandappropriateprotectivemeasurestaken.Someformofrisk analysisshouldbeundertakentoascertaintherequiredlevelofsecuritymeasures. InadditiontothestandardsbodiesCEN,CENELEC,ISOandIECtherearethreemajortransnationalbodiesthat haveproducedinternationallyauthoritativedocumentsrelatingtosecurity
36、anddataprotection: theEuropeanUnion(EU); theOrganisationforEconomicCooperationandDevelopment(OECD); theCouncilofEurope; theUnitedNations(UN). Theprimarydocumentsfromthesebodiesare: EUDataProtectionDirective“ontheprotectionofindividualswithregardtotheprocessingofpersonal dataandfreemovementofthatdata
37、“1; OECD“GuidelinesontheProtectionofPrivacyandTransborderflowsofPersonalData“2; OECD“GuidelinesfortheSecurityofInformationSystems“3; CouncilofEurope“ConventionfortheProtectionofindividualswithregardtoAutomaticProcessingof PersonalData“No.1084; “CouncilofEuropeRecommendationR(97)5ontheProtectionofMed
38、icalData“5; UNGeneralAssembly“GuidelinesfortheRegulationofComputerisedPersonalDataFiles“6. Themeansandextentoftheprotectionaffordedtopersonalhealthdatavariesfromnationtonation7.Insome countriesthereisnationwideprivacylegislation,inotherslegislativeprovisionsmaybeatastatelevelor equivalent.Inanumbero
39、fcountriesnolegislationmayexistalthoughvariouscodesofpracticeorequivalentwill probablybeinplaceand/ormedicallawswhichlaydownadutyonmedicalpractitionerstosafeguard confidentiality. Althoughprivacylegislationindifferentpartsoftheworldmaymentionpersonalhealthdata,frequentlythereisno legislationspecific
40、tohealthexceptperhapsinrelationtogovernmentagenciesand/ormedicalresearch. TheEUDirectiveonDataProtection(seetextinannexA)aimstocreateuniformlegislativedataprotection provisionsthroughouttheEU.TheDirectivealsoappliestononcommunitycountriesoftheEuropeanEconomic AreabyvirtueoftheEEATreatyDecision83/199
41、9of25June1999.ThemajorityofcountriesofCentraland EasternEuropeandCypruswhichareapplicantstobecomemembersoftheEU,arealsolookingtointroduce legislationinconformancewiththeDirective. TheDirectivemakesitpermissibleforpersonaldatatobepassedacrossEUborders.However,thetransferof personaldatafromanEUcountry
42、toanonEUcountryiscontrolledbyArticles25and26. Inessence,subjecttospecificderogations,Article25allowstransferofpersonaldatatoathirdcountryonlyifthat thirdcountryensuresanadequatelevelofprotection. Theadequacyofprotectionistobeassessed(Article25.2)inthelightofallthecircumstanceswithparticular consider
43、ationtobegiventoparticularfactorsincluding: thenatureofthedata; thepurposeanddurationoftheproposedprocessingoperation(s); therulesoflawapplying; theprofessionalrulesandsecuritymeasureswhicharecompliedwith; thecountryconcerned. Inthehealthcontextpersonalhealthdatacanbeextremelysensitiveinnatureandisrecognisedassuchbythe Directive.Thereisextensiveguidanceavailablebothnationallyandinternationallyonsecuritymeasuresforthe protectionofpersonalhealthdata(seeannexB). Asnotedabovethereisinmanycountriesamixofgeneralandspecific
