CLOUD COMPUTING FOR E HEALTH DATA PROTECTION ISSUES & OPPORTUNITIES

Transcript

1 CLOUD COMPUTING FOR E HEALTH DATA PROTECTION ISSUES & OPPORTUNITIES Cloud Computing for Digital Healthcare 18 October2011, Castelfranco Veneto Avv. Dr. Paolo Balboni ICT Legal Consulting European Privacy Association e Istituto Italiano Privacy paolo.balboni@ictlegalconsulting.com

2 Intro: Challenges High quality services are to be delivered (Gov reputation is at stake) vs. Increasing pressure to cut public expenditure Bottom line: public finance is to be spent wisely 2

3 Intro: Solutions TECHNOLOGY e-health services (e.g., EHR, EHF, online scheduling of reservation of health examination, provision to the patients of the related examination records online) can provide solutions to said challenges One step further: Is e-health ready to go cloud? 3

4 Structure of the Presentaiton 1. e-health Scenario 2. EU regulatory background 3. Key legal issues 4. Focus on data protection & data security 5. Opportunities & recommendations 4

5 e Health Scenario A number of Italian LHAs are contemplating to jointly enter into an agreement with a national telecommunication company for the creation of their own cloud. LHAs plan to migrate to the cloud services such as EHR, EHF, online scheduling of reservation of health examination, provision to the patients of the related examination records online, and, other less critical services, e.g., back-end services, human resources, payroll, e-learning 5

6 EU Regulatory Background Better informed, More efficient, Patient focused, a European market E-Health action plan: COM(2004) 356 e-health - making healthcare better for European citizens: an action plan for a European e-health Area i2010 Subgroup on ehealth Lead Market Initiative - ehealth Article 29 WP (WP 131/2007) Working Document on the processing of personal data relating to health in electronic health records (EHR) COM(2008) 414 Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the application of patients' rights in cross-border healthcare COM(2008) 415 A Community framework on the application of patients' rights in cross-border healthcare Study on the Legal Framework for Interoperable ehealth in Europe (2009) European Commission consultation on the ehealth Action Plan (ehap)

7 Key Legal Issues Gov sovereignty: law enforcement access, confidentiality Data protection and data security Interoperability - Transfer back - Vendor lock-in CSP professional negligence Subcontracting of cloud services & CSP change of control 7

8 Focus on: Data Protection Data Controller - Data Processor Applicability of EU Data Protection Directive Appropriate security measures - data integrity - identity management - access control Data transfer to countries outside the EEA Data subject s right of access to data 8

9 Appropriate Security Measures ID management No possible use of cloud services in e-health if CSP cannot assure rigorous ID management system enabling only selected subjects and to the extent their profile allows them Access control Traceability of who does what in the cloud environment (comprehensive logging), preventing unauthorized access or alteration of EHR data Data integrity deploying present state of art technology, encryption not only for transfer but also for storage 9

10 Opportunities Efficiency & interoperability Information / data security Better data protection compliance (through Privacy by Design) 10

11 Recommendations EU MSs Data protection law to be harmonized Data protection roles to be clarified Rules for international data transfer to be streamlined to fully guarantee patients rights in global cross-border healthcare Clear homogeneous appropriate security measures through the EU MSs to be established Patient/data subject s rights to be harmonized 11

12 Thanks for your attention! Q&A Cloud Computing for Digital Healthcare, 18 October2011, Castelfranco Veneto Avv. Dr. Paolo Balboni ICT Legal Consulting European Privacy Association e Istituto Italiano Privacy paolo.balboni@ictlegalconsulting.com

13 Introduzione: Who is who Paolo Balboni Direttore dell European Privacy Association, Cloud Computing Sector Director e Responsabile Affari Esteri dell Istituto Italiano Privacy, Avvocato del Foro di Milano specializzato in Diritto delle nuove tecnologie e tutela dei dati personali Paolo Balboni è socio fondatore dello studio legale ICT Legal Consulting. Svolge attività di consulenza legale, a favore di multinazionali, principalmente in tema di protezione dei dati personali, contratti informatici, commercio elettronico, cloud computing, responsabilità dei fornitori di servizi Web 2.0, responsabilità dei fornitori di contenuti su internet e terminali mobili, firme elettroniche, conservazione sostitutiva, proprietà intellettuale. Assiste altresì persone celebri su questioni relative a privacy e diritti d autore. Vanta una considerevole esperienza nei settori: IT, media & entertainment, e-health, moda e bancario. Autore del libro Trustmarks in E-commerce, Paolo Balboni è Ricercatore associato presso l Università di Tilburg (Olanda) dove insegna il corso di master Liability of Web 2.0 Service Providers ; nonché Assistente alla cattedra di Diritto di internet all Università di Bologna (Italia). Consulente legale scelto per i progetti dell European Network and Information Security Agency (ENISA) su Cloud Computing Risk Assessment, Security and Resilience in Gov Clouds e Common Assurance Maturity Model Beyond the Cloud (CAMM), Paolo Balboni è spesso coinvolto in studi della Commissione europea relativi a nuove tecnologie e tutela dei dati personali, nonché relatore a convegni internazionali su tali temi. Laureato in giurisprudenza all Università di Bologna nel 2002, ha conseguito il dottorato (Ph.D.) in Diritto comparato delle nuove tecnologie all Università di Tilburg nel Parla correntemente l italiano, l inglese e l olandese ed ha una buona conoscenza di tedesco, francese e spagnolo. 13