EN 14485:2003

Health informatics - Guidance for handling personal health data in international applications in the context of the EU data protection directive

This European Standard provides guidance on data protection for those involved in international informatics applications which entail transmission of person health data from an EU Member State to a non-EU Member State.  Its purpose is to assist in the application of the EU Directive on Data Protection [1].

Medizinische Informatik - Anleitung zur Verwendung von persönlichen Gesundheitsdaten in internationalen Anwendungen vor dem Hintergrund der EU-Datenschutzrichtlinie

Informatique de santé - Guide pour manipuler des données personnelles de santé dans des applications internationales dans le contexte de la directive européenne sur la protection des données personelles

Zdravstvena informatika – Navodilo za ravnanje z osebnimi zdravstvenimi podatki v mednarodni uporabi in v skladu z določili Direktive EU o varstvu podatkov

General Information

• Status: Published
• Publication Date: 16-Dec-2003
• Withdrawal Date: 29-Jun-2004
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: CEN/TC 251 - Medical informatics
• Drafting Committee: CEN/TC 251/WG 1 - Information models
• Current Stage: 9060 - Closure of 2 Year Review Enquiry - Review Enquiry
• Start Date: 02-Dec-2017
• Completion Date: 02-Dec-2017
• Ref Project: SIST EN 14485:2004 - Health informatics - Guidance for handling personal health data in international applications in the context of the EU data protection directive

Standards Content (Sample)

SLOVENSKI STANDARD
01-maj-2004
=GUDYVWYHQDLQIRUPDWLND±1DYRGLOR]DUDYQDQMH]RVHEQLPL]GUDYVWYHQLPLSRGDWNL
YPHGQDURGQLXSRUDELLQYVNODGX]GRORþLOL'LUHNWLYH(8RYDUVWYXSRGDWNRY
Health informatics - Guidance for handling personal health data in international
applications in the context of the EU data protection directive
Medizinische Informatik - Anleitung zur Verwendung von persönlichen Gesundheitsdaten
in internationalen Anwendungen vor dem Hintergrund der EU-Datenschutzrichtlinie
Informatique de santé - Guide pour manipuler des données personnelles de santé dans
des applications internationales dans le contexte de la directive européenne sur la
protection des données personelles
Ta slovenski standard je istoveten z: EN 14485:2003
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN 14485
NORME EUROPÉENNE
EUROPÄISCHE NORM
December 2003
ICS 35.240.80
English version
Health informatics - Guidance for handling personal health data
in international applications in the context of the EU data
protection directive
Informatique de santé - Guide pour manipuler des données Medizinische Informatik - Anleitung zur Verwendung von
personnelles de santé dans des applications persönlichen Gesundheitsdaten in internationalen
internationales dans le contexte de la directive européenne Anwendungen vor dem Hintergrund der EU-
sur la protection des données personelles Datenschutzrichtlinie
This European Standard was approved by CEN on 13 November 2003.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the Management Centre has the same status as the official
versions.
CEN members are the national standards bodies of Austria, Belgium, Czech Republic, Denmark, Finland, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Luxembourg, Malta, Netherlands, Norway, Portugal, Slovakia, Spain, Sweden, Switzerland and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36  B-1050 Brussels
© 2003 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 14485:2003 E
worldwide for CEN national Members.

Contents
page
Foreword.5
Introduction .6
1 Scope .9
2 Normative references .9
3 Terms and definitions.9
4 Abbreviated terms .10
5 General solutions to exchanging personal health data between compliant and non-compliant
countries.11
5.1 General approach .11
6 Judging the adequacy of data protection .11
6.1 General.11
6.2 Content Principles.12
6.3 Procedural/Enforcement Mechanisms.14
6.4 Third Countries that have ratified the Council of Europe Convention 108 .14
6.5 Industry self-regulation.15
7 Making adequate provisions.16
7.1 Introduction .16
7.2 Meeting the "Content Principles" .16
7.3 Providing for the "Procedural/Enforcement Mechanisms".16
7.4 Overriding law .18
8 Permissible derogations, Articles 26.1 and 26.2 .19
8.1 Article 26.1 .19
8.1.2 Consent.19
8.2 Article 26.2 .20
9 Anonymisation .20
9.1 Definition of personal data .20
9.2 Rendering personal data anonymous.20
10 Notification to Supervisory Authorities.21
10.1 Introduction .21
10.2 Implementation of Articles 18 to 20 .21
11 Steps in establishing an international application with adequate data protection safeguards
from the view point of an EU data controller .21
11.1 Introduction .21
11.2 Step One: Can the data be non-personal?.22
11.3 Step Two: Is the recipient third country an EEA country? .23
11.4 Step Three: Is the recipient country recognised by the Commission as having adequate data
protection provisions?.23
11.5 Step Four: Is the recipient organisation in compliance with arrangements formally recognised
by the Commission as providing adequate data protection provisions? .23
11.6 Step Five; If the recipient third country is not EEA, has it signed the Council of Europe
Convention 108?.23
11.7 Step Six: Is the recipient country applying to become a member of the EU? .23
11.8 Step Seven: Can adequacy of data protection be established?.24
11.9 Step Eight: If adequacy of data protection cannot be established can the derogations in
Article 26.1 provide a solution?.24
11.10 Step Nine: If adequacy of data protection cannot be established can the derogation in Article
26.2 regarding contractual clauses provide a solution? .26
11.11 Step Ten: If transfer of personal data health data to the recipient third country is permissible
has the recipient implemented adequate security measures and can the application proceed?.26
12 Steps in establishing an international application with adequate data protection safeguards
from the viewpoint of a non-EU data controller .26
12.1 Establishing data protection adequacy in the EU.26
13 Model contract clauses .26
Published models.26
14 Security measures.27
14.1 Introduction .27
14.2 General security.27
14.3 Security contracts with processors and with controllers in non-compliant countries.28
14.4 Security policy.28
14.5 Risk analysis.28
14.6 Security organisation and allocation of duties .29
14.7 Reporting of security incidents or breaches .29
14.8 Staff and contractor contracts.29
14.9 Training and awareness .29
14.10 Transmission of data .29
14.11 Limitations of purpose and access .29
14.12 Onward transfers .30
14.13 Audit trails .30
14.14 Loss, damage and destruction.30
14.15 Business Continuity Plans .30
14.16 Network Security.30
14.17 Patients Rights.31
14.18 Compliance.31
14.19 Standards.31
15 Declaration of grounds on which transfers are to take place.31
15.1 Statement of grounds .31
Annex A (informative)  Key primary international documents on data protection.32
A.1 EU Data Protection Directive .32
A.1.3 Rules for lawfulness of processing .32
A.1.4 Special categories of processing.32
A.1.5 Data subject's rights.33
A.1.6 Security of processing .34
A.1.7 Supervisory Authorities.34
A.1.8 Remedies and sanctions .
...