1、BRITISH STANDARD BS EN 14485:2003 Health informatics Guidance for handling personal health data in international applications in the context of the EU data protection directive The European Standard EN 14485:2003 has the status of a British Standard ICS 35.240.80 BS EN 14485:2003 This British Standa
2、rd was published under the authority of the Standards Policy and Strategy Committee on 9 January 2004 BSI 9 January 2004 ISBN 0 580 43210 6 National foreword This British Standard is the official English language version of EN 14485:2003. The UK participation in its preparation was entrusted to Tech
3、nical Committee IST/35, Health informatics, which has the responsibility to: A list of organizations represented on this committee can be obtained on request to its secretary. Cross-references The British Standards which implement international or European publications referred to in this document m
4、ay be found in the BSI Catalogue under the section entitled “International Standards Correspondence Index”, or by using the “Search” facility of the BSI Electronic Catalogue or of British Standards Online. This publication does not purport to include all the necessary provisions of a contract. Users
5、 are responsible for its correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change,
6、and keep the UK interests informed; monitor related international and European developments and promulgate them in the UK. Summary of pages This document comprises a front cover, an inside front cover, the EN title page, pages 2 to 76, an inside back cover and a back cover. The BSI copyright notice
7、displayed in this document indicates when the document was last issued. Amendments issued since publication Amd. No. Date CommentsEUROPEANSTANDARD NORMEEUROPENNE EUROPISCHENORM EN14485 December2003 ICS35.240.80 Englishversion HealthinformaticsGuidanceforhandlingpersonalhealthdata ininternationalappl
8、icationsinthecontextoftheEUdata protectiondirective InformatiquedesantGuidepourmanipulerdesdonnes personnellesdesantdansdesapplications internationalesdanslecontextedeladirectiveeuropenne surlaprotectiondesdonnespersonelles MedizinischeInformatikAnleitungzurVerwendungvon persnlichenGesundheitsdateni
9、ninternationalen AnwendungenvordemHintergrundderEU Datenschutzrichtlinie ThisEuropeanStandardwasapprovedbyCENon13November2003. CENmembersareboundtocomplywiththeCEN/CENELECInternalRegulationswhichstipulatetheconditionsforgivingthisEurope an Standardthestatusofanationalstandardwithoutanyalteration.Upt
10、odatelistsandbibliographicalreferencesconcernings uchnational standardsmaybeobtainedonapplicationtotheManagementCentreortoanyCENmember. ThisEuropeanStandardexistsinthreeofficialversions(English,French,German).Aversioninanyotherlanguagemadebytra nslation undertheresponsibilityofaCENmemberintoitsownla
11、nguageandnotifiedtotheManagementCentrehasthesamestatusasthe official versions. CENmembersarethenationalstandardsbodiesofAustria,Belgium,CzechRepublic,Denmark,Finland,France,Germany,Greece, Hungary,Iceland,Ireland,Italy,Luxembourg,Malta,Netherlands,Norway,Portugal,Slovakia,Spain,Sweden,Switzerlandand
12、Un ited Kingdom. EUROPEANCOMMITTEEFORSTANDARDIZATION COMITEUROPENDENORMALISATION EUROPISCHESKOMITEEFRNORMUNG ManagementCentre:ruedeStassart,36B1050Brussels 2003CEN Allrightsofexploitationinanyformandbyanymeansreserved worldwideforCENnationalMembers. Ref.No.EN14485:2003EEN14485:2003(E) 2 Contents pag
13、e Foreword5 Introduction .6 1 Scope 9 2 Normativereferences 9 3 Termsanddefinitions. .9 4 Abbreviatedterms . 10 5 Generalsolutionstoexchangingpersonalhealthdatabetweencompliantandnoncompliant countries.11 5.1 Generalapproach .11 6 Judgingtheadequacyofdataprotection . 11 6.1General .11 6.2 ContentPri
14、nciples .12 6.3 Procedural/EnforcementMechanisms. .14 6.4 ThirdCountriesthathaveratifiedtheCouncilofEuropeConvention108 .14 6.5 Industryselfregulation 15 7 Makingadequateprovisions. 16 7.1 Introduction .16 7.2 Meetingthe“ContentPrinciples“ 16 7.3 Providingforthe“Procedural/EnforcementMechanisms“16 7
15、.4 Overridinglaw .18 8 Permissiblederogations,Articles26.1and26.2 . .19 8.1 Article26.1 19 8.1.2 Consent.19 8.2 Article26.2 20 9 Anonymisation .20 9.1 Definitionofpersonaldata . .20 9.2 Renderingpersonaldataanonymous. 20 10 NotificationtoSupervisoryAuthorities .21 10.1 Introduction .21 10.2 Implemen
16、tationofArticles18to20 21 11 Stepsinestablishinganinternationalapplicationwithadequatedataprotectionsafeguards fromtheviewpointofanEUdatacontroller . .21 11.1 Introduction .21 11.2 StepOne:Canthedatabenonpersonal? .22 11.3 StepTwo:IstherecipientthirdcountryanEEAcountry? 23 11.4 StepThree:Istherecipi
17、entcountryrecognisedbytheCommissionashavingadequatedata protectionprovisions?. 23 11.5 StepFour:Istherecipientorganisationincompliancewitharrangementsformallyrecognised bytheCommissionasprovidingadequatedataprotectionprovisions? 23 11.6 StepFive;IftherecipientthirdcountryisnotEEA,hasitsignedtheCounc
18、ilofEurope Convention108? .23 11.7 StepSix:IstherecipientcountryapplyingtobecomeamemberoftheEU? 23 11.8 StepSeven:Canadequacyofdataprotectionbeestablished?.24 11.9 StepEight:Ifadequacyofdataprotectioncannotbeestablishedcanthederogationsin Article26.1provideasolution?. 24 11.10 StepNine:Ifadequacyofd
19、ataprotectioncannotbeestablishedcanthederogationinArticle 26.2regardingcontractualclausesprovideasolution? .26EN14485:2003(E) 3 11.11 StepTen:Iftransferofpersonaldatahealthdatatotherecipientthirdcountryispermissible hastherecipientimplementedadequatesecuritymeasuresandcantheapplicationproceed?.26 12
20、 Stepsinestablishinganinternationalapplicationwithadequatedataprotectionsafeguards fromtheviewpointofanonEUdatacontroller . 26 12.1 EstablishingdataprotectionadequacyintheEU .26 13 Modelcontractclauses . 26 Publishedmodels. 26 14 Securitymeasures .27 14.1 Introduction .27 14.2 Generalsecurity. .27 1
21、4.3 Securitycontractswithprocessorsandwithcontrollersinnoncompliantcountries28 14.4 Securitypolicy .28 14.5 Riskanalysis .28 14.6 Securityorganisationandallocationofduties . .29 14.7 Reportingofsecurityincidentsorbreaches .29 14.8 Staffandcontractorcontracts. 29 14.9 Trainingandawareness . 29 14.10
22、Transmissionofdata 29 14.11 Limitationsofpurposeandaccess . 29 14.12 Onwardtransfers 30 14.13 Audittrails .30 14.14 Loss,damageanddestruction 30 14.15 BusinessContinuityPlans . .30 14.16 NetworkSecurity .30 14.17 PatientsRights. .31 14.18 Compliance.31 14.19 Standards31 15 Declarationofgroundsonwhic
23、htransfersaretotakeplace.3 1 15.1 Statementofgrounds . 31 AnnexA (informative) Keyprimaryinternationaldocumentsondataprotection32 A.1 EUDataProtectionDirective 32 A.1.3 Rulesforlawfulnessofprocessing .32 A.1.4 Specialcategoriesofprocessing 32 A.1.5 Datasubjectsrights. .33 A.1.6 Securityofprocessing
24、34 A.1.7 SupervisoryAuthorities. 34 A.1.8 Remediesandsanctions 34 A.1.9 Transferofpersonaldatatothirdcountries 34 A.2 OrganisationforEconomicCooperationandDevelopment(OECD) 35 A.3 CouncilofEurope . 35 A.4 UnitedNationsGeneralAssembly. .36 A.4.1 General .36 A.4.2 Principlesconcerningminimumguarantees
25、thatshouldbeprovidedinanynationallegislation.36 A.4.3 ApplicationoftheGuidelinestopersonaldatafileskeptbygovernmentalinternational organisations.37 AnnexB(informative)TextofArticles25and26oftheEUDataProtectionDirective38 B.1 Article25:Principles .38 B.2 Article26:Derogations . 38 AnnexC(informative)
26、TextofArticle28oftheEUDataProtectionDirective 40 AnnexD(informative)QuestionnaireforAssessingDataProtectionAdequacy .42 AnnexE(informative)Safeharbourprivacyprinciples. 48 AnnexF(informative)Standardsandsourcesofadvice . .51 F.1 EUSecurityprojects .51 F.2 CEN/ISSS .51 F.3 NonCENStandards . 51 F.4 Se
27、lectedwebsites 52EN14485:2003(E) 4 AnnexG(informative)ModelDeclarationofGroundsuponwhichTransferofPersonalHealthDatais RegardedasinCompliancewiththeEUDataProtectionDirective.53 AnnexH(informative)Modelcontractualclausesforcontrollertocontrollertransferstoacountry withinadequatedataprotectionprovisio
28、ns . 55 H.1 Introduction .55 H.2 Modelstandardcontractualclauses .55 AnnexI(informative)Modelcontractualclausesforcontrollertoprocessortransferstoacountry withinadequatedataprotectionprovisions . 66 I.1 Introduction .66 I.2 Modelstandardcontractualclauses .66 Bibliography 75EN14485:2003(E) 5 Forewor
29、d Thisdocument(EN14485:2003)hasbeenpreparedbyTechnicalCommitteeCEN/TC251“European StandardizationofHealthInformatics“,thesecretariatofwhichisheldbySIS. ThisEuropeanStandardshallbegiventhestatusofanationalstandard,eitherbypublicationofanidenticaltextor byendorsement,atthelatestbyJune2004,andconflicti
30、ngnationalstandardsshallbewithdrawnatthelatestby June2004. TheannexesA,B,C,D,E,F,G,HandIareinformative. AccordingtotheCEN/CENELECInternalRegulations,thenationalstandardsorganizationsofthefollowing countriesareboundtoimplementthisEuropeanStandard:Austria,Belgium,CzechRepublic,Denmark,Finland, France,
31、Germany,Greece,Hungary,Iceland,Ireland,Italy,Luxembourg,Malta,Netherlands,Norway,Portugal, Slovakia,Spain,Sweden,SwitzerlandandtheUnitedKingdom.EN14485:2003(E) 6 Introduction Inthehealthcontext,informationaboutindividualsneedstobecollected,storedandprocessedformanypurposes, themainbeing: administrat
32、iveprocessese.g.bookingappointments; directdeliveryofcaree.g.patientrecords; clinical research; statistics. Thedatarequiredwilldependonthepurpose.Inthecontextofidentificationofindividuals,datamaybeneeded: toallowanindividualtobereadilyanduniquelyidentifiede.g.acombinationofname,address,age,sex, iden
33、tificationnumber; toconfirmthattwodatasetsbelongtothesameindividualwithoutanyneedtoidentifytheindividualhimself e.g.forrecordlinkageand/orlongitudinalstatistics; forstatisticalpurposeswiththedesirepositivelytopreventidentificationofanyindividual. Inallofthesecircumstancesdataaboutindividualsarenow,a
34、ndwillincreasinglyinthefuture,betransmitted acrossnationalbordersorbedeliberatelymadeaccessibletocountriesotherthanwheretheyarecollectedor stored.Datamaybecollectedinonecountryandstoredinanother,beprocessedinathird,andbeaccessible frommanycountriesorevenglobally. Internationalhealthrelatedapplicatio
35、nswillrequirehealthrelateddatatobetransmittedfromonenationto another. Thatisveryevidentintelemedicineorwhendataareelectronicallydispatchedforexampleinanemailorasadata filetobeaddedtoaninternationaldatabase.Italsooccurs,butlessobviously,whenadatabaseinonecountryis viewedfromtheotherforexampleovertheI
36、nternet.Thatapplicationmayappearpassivebuttheveryactof viewinginvolvesdisclosureofthatdataandisdeemedprocessing.Moreoveritrequiresadownloadthatmaybe automaticallyplacedinacacheandheldthereuntilemptiedthisalsoisprocessing. Inallapplicationsinvolvingpersonalhealthdatatherecanbeapotentialthreattothepri
37、vacyofanindividual.That threatanditsextentwilldependon: theleveltowhichdataisprotectedfromunauthorisedaccessinstorageortransmission; thenumberofpersonswhohaveauthorisedaccess; thenatureofthepersonaldatastored; thelevelofdifficultyinidentifyinganindividualifaccesstothedataisobtained. Whereverhealthda
38、taarecollected,stored,processedorpublished(includingelectronicallyontheInternet)the potentialthreattoprivacyneedstobeassessedandappropriateprotectivemeasurestaken.Someformofrisk analysisshouldbeundertakentoascertaintherequiredlevelofsecuritymeasures. InadditiontothestandardsbodiesCEN,CENELEC,ISOandI
39、ECtherearethreemajortransnationalbodiesthat haveproducedinternationallyauthoritativedocumentsrelatingtosecurityanddataprotection: theEuropeanUnion(EU); theOrganisationforEconomicCooperationandDevelopment(OECD); theCouncilofEurope;EN14485:2003(E) 7 theUnitedNations(UN). Theprimarydocumentsfromthesebo
40、diesare: EUDataProtectionDirective“ontheprotectionofindividualswithregardtotheprocessingofpersonal dataandfreemovementofthatdata“1; OECD“GuidelinesontheProtectionofPrivacyandTransborderflowsofPersonalData“2; OECD“GuidelinesfortheSecurityofInformationSystems“3; CouncilofEurope“ConventionfortheProtect
41、ionofindividualswithregardtoAutomaticProcessingof PersonalData“No.1084; “CouncilofEurope RecommendationR(97)5ontheProtectionofMedicalData“5; UNGeneralAssembly“GuidelinesfortheRegulationofComputerisedPersonalDataFiles“6. AnnexAprovidesasynopsisofthekeydocumentspublishedbythesebodies. Themeansandexten
42、toftheprotectionaffordedtopersonalhealthdatavariesfromnationtonation7.Insome countriesthereisnationwideprivacylegislation,inotherslegislatureprovisionsmaybeatastatelevelor equivalentandinanumbernolegislationmayexistalthoughvariouscodesofpracticeorequivalentwillprobably beinplace. Althoughprivacylegi
43、slationindifferentpartsoftheworldmaymentionpersonalhealthdata,frequentlythereisno legislationspecifictohealthexceptperhapsinrelationtogovernmentagenciesand/ormedicalresearch. TheEUDirectiveonDataProtectionaimstocreateuniformlegislativedataprotectionprovisionsthroughoutthe EU.TheDirectivealsoappliest
44、ononcommunitycountriesoftheEuropeanEconomicAreabyvirtueoftheEEA TreatyDecision83/1999of25June1999. Thepassingofpersonaldatafromanyoneoftheseconformingnationstoanother(third)countryiscontrolledby Articles25and26oftheDirectivethefulltextofwhichisinannexB.Inessence,subjecttospecificderogations, Article25allowstransfer
