General Data Protection Regulation (GDPR) Toolkit for Digital Health

R. Hussein; D. Wurhofer; E.-M. Strumegger; A. Stainer-Hochgatterer; S.T. Kulnik; R. Crutzen; J. Niebauer

doi:10.3233/SHTI220066

General Data Protection Regulation (GDPR) Toolkit for Digital Health

R. Hussein
, D. Wurhofer
, E.-M. Strumegger
, A. Stainer-Hochgatterer
, S.T. Kulnik
, R. Crutzen
, J. Niebauer

Creative Technologies

Ludwig Boltzmann Institute for Digital Health and Prevention
CAPHRI Department of Health Promotion, Maastricht University
Institute of Sports Medicine, Prevention and Rehabilitation, Paracelsus Medical University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

The General Data Protection Regulation (GDPR) entered into force on May 25, 2018. Compliance with GDPR is especially relevant to the Digital Health (DH) domain, as it is common to process highly sensitive personal data regarding a person's health. However, GDPR compliance is a very challenging process since it requires implementing several technical and organizational measures to maintain compliance. With the aim to facilitate this process, we reviewed the published best practices in GDPR compliance. Then, we customized the findings to fit into the DH domain and created a toolkit for GDPR implementation and compliance. The Activity Planning Tool (APT) is provided as an example of how this toolkit could be utilized in new application development in mobile health in Austria. In the case of our APT, the toolkit was very helpful in integrating the GDPR technical requirements in addition to creating the corresponding compliance impact assessment, processing agreements, privacy policy, data flowcharts, and compliance checklists. © 2022 International Medical Informatics Association (IMIA) and IOS Press.

Original language	English
Title of host publication	MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation
Subtitle of host publication	Proceedings of the 18th World Congress on Medical and Health Informatics
Publisher	IOS Press BV
Pages	222-226
Number of pages	5
Volume	290
ISBN (Electronic)	978-1-64368-265-5
ISBN (Print)	978-1-64368-264-8
DOIs	https://doi.org/10.3233/SHTI220066
Publication status	Published - 2022
Event	18th World Congress on Medical and Health Informatics: One World, One Health - Global Partnership for Digital Innovation, MEDINFO 2021 - Virtual Duration: 2 Oct 2021 → 4 Oct 2021 https://imia-medinfo.org/medinfo21/

Publication series

Name	Studies in Health Technology and Informatics
ISSN (Print)	0926-9630
ISSN (Electronic)	1879-8365

Conference

Conference	18th World Congress on Medical and Health Informatics: One World, One Health - Global Partnership for Digital Innovation, MEDINFO 2021
Abbreviated title	MEDINFO 2021
Period	2/10/21 → 4/10/21
Internet address	https://imia-medinfo.org/medinfo21/

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 3 Good Health and Well-being

Keywords

Consent
Data Protection
Digital Health
Health care
Medical informatics
Activity planning
Application development
Best practices
Digital health
General data protection regulations
New applications
Organisational
Planning tools
Regulation compliance
Sensitive data
adult
Austria
checklist
conference paper
data protection
human
privacy
sensitive personal information
computer security
Computer Security
Humans

Classification according to Österreichische Systematik der Wissenschaftszweige (ÖFOS 2012)

Not applicable

Applied Research Level (ARL)

Not applicable

Research focus/foci

Not applicable

Access to Document

10.3233/SHTI220066

https://www.scopus.com/inward/record.uri?eid=2-s2.0-85131469049&doi=10.3233%2fSHTI220066&partnerID=40&md5=2347ee749061439f7a8561af6a16f178

Cite this

Hussein, R., Wurhofer, D., Strumegger, E.-M., Stainer-Hochgatterer, A., Kulnik, S. T., Crutzen, R., & Niebauer, J. (2022). General Data Protection Regulation (GDPR) Toolkit for Digital Health. In MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation: Proceedings of the 18th World Congress on Medical and Health Informatics (Vol. 290, pp. 222-226). (Studies in Health Technology and Informatics). IOS Press BV. https://doi.org/10.3233/SHTI220066

Hussein, R. ; Wurhofer, D. ; Strumegger, E.-M. et al. / General Data Protection Regulation (GDPR) Toolkit for Digital Health. MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation: Proceedings of the 18th World Congress on Medical and Health Informatics. Vol. 290 IOS Press BV, 2022. pp. 222-226 (Studies in Health Technology and Informatics).

@inproceedings{6cfadbef94fe41ca829b9f406e88c879,

title = "General Data Protection Regulation (GDPR) Toolkit for Digital Health",

abstract = "The General Data Protection Regulation (GDPR) entered into force on May 25, 2018. Compliance with GDPR is especially relevant to the Digital Health (DH) domain, as it is common to process highly sensitive personal data regarding a person's health. However, GDPR compliance is a very challenging process since it requires implementing several technical and organizational measures to maintain compliance. With the aim to facilitate this process, we reviewed the published best practices in GDPR compliance. Then, we customized the findings to fit into the DH domain and created a toolkit for GDPR implementation and compliance. The Activity Planning Tool (APT) is provided as an example of how this toolkit could be utilized in new application development in mobile health in Austria. In the case of our APT, the toolkit was very helpful in integrating the GDPR technical requirements in addition to creating the corresponding compliance impact assessment, processing agreements, privacy policy, data flowcharts, and compliance checklists. {\textcopyright} 2022 International Medical Informatics Association (IMIA) and IOS Press.",

keywords = "Consent, Data Protection, Digital Health, Health care, Medical informatics, Activity planning, Application development, Best practices, Digital health, General data protection regulations, New applications, Organisational, Planning tools, Regulation compliance, Sensitive data, adult, Austria, checklist, conference paper, data protection, human, privacy, sensitive personal information, computer security, Computer Security, Humans",

author = "R. Hussein and D. Wurhofer and E.-M. Strumegger and A. Stainer-Hochgatterer and S.T. Kulnik and R. Crutzen and J. Niebauer",

note = "Conference code: 179966 Cited By :1 Export Date: 14 December 2023 Correspondence Address: Hussein, R.; Ludwig Boltzmann Institute for Digital Health and Prevention, Lindhofstrasse 22, Austria; email: [email protected] Funding details: Ludwig Boltzmann Gesellschaft, LBG Funding text 1: This GDPR compliance activity was conducted within the scope of the Co-production of home-based digital support for cardiac patients (CODIS) project, funded by the Ludwig Boltzmann Gesellschaft (LBG) Open Innovation in Science (OIS) Center under the {\textquotedblleft}Research Enrichment Fund: COVID-19 Support Measures{\textquotedblright}. References: EU Data Protection Rules [Internet], , https://ec.europa.eu/info/law/lawtopic/data-protection/eu-data-protection-rules\_en, European Commission-European Commission. [cited 2021 April 9]; Mondschein, C.F., Monda, C., The eu's general data protection regulation (gdpr) in a research context (2019) Fundamentals of Clinical Data Science [Internet], , https://pubmed.ncbi.nlm.nih.gov/31314241/, Kubben P, Dumontier M, Dekker A, editors. Cham (CH): Springer [cited 2021 April 10]; General Data Protection Regulation (GDPR) Compliance Guidelines [Internet], , https://gdpr.eu/, GDPR. eu. [cited 2021 April 9]; GDPR Guide [Internet]. French Data Protection Authority (CNIL), , https://www.cnil.fr/en/home, [cited 2021 April 9]; (2018) Understanding the General Data Protection Regulation (GDPR). Deloitte Malta Risk Advisory; EBooks for Health and Medical App Security [Internet], , https://www.chino.io/blog/healthcare-app-development-resources/, [cited 2021 April 9]; GDPR Checklist-Cloud Security Checklist for GDPR Compliance [Internet], , https://tresorit.com/gdpr/gdpr-checklist, [cited 2021 April 9]; Mustafa, U., Pflugel, E., Philip, N., A novel privacy framework for secure m-health applications: The case of the GDPR (2019) 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3), pp. 1-9; Muchagata, J., Ferreira, A., Translating GDPR into the mHealth practice (2018) 2018 International Carnahan Conference on Security Technology (ICCST), pp. 1-5; Crutzen, R., Ygram Peters, G.-J., Mondschein, C., Why and how we should care about the general data protection regulation (2019) Psychol Health., 34 (11), pp. 1347-1357; 18th World Congress on Medical and Health Informatics: One World, One Health - Global Partnership for Digital Innovation, MEDINFO 2021, MEDINFO 2021 ; Conference date: 02-10-2021 Through 04-10-2021",

year = "2022",

doi = "10.3233/SHTI220066",

language = "English",

isbn = " 978-1-64368-264-8",

volume = "290",

series = "Studies in Health Technology and Informatics",

publisher = "IOS Press BV",

pages = "222--226",

booktitle = "MEDINFO 2021: One World, One Health {\textendash} Global Partnership for Digital Innovation",

address = "Netherlands",

url = "https://imia-medinfo.org/medinfo21/",

}

Hussein, R, Wurhofer, D, Strumegger, E-M, Stainer-Hochgatterer, A, Kulnik, ST, Crutzen, R & Niebauer, J 2022, General Data Protection Regulation (GDPR) Toolkit for Digital Health. in MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation: Proceedings of the 18th World Congress on Medical and Health Informatics. vol. 290, Studies in Health Technology and Informatics, IOS Press BV, pp. 222-226, 18th World Congress on Medical and Health Informatics: One World, One Health - Global Partnership for Digital Innovation, MEDINFO 2021, 2/10/21. https://doi.org/10.3233/SHTI220066

General Data Protection Regulation (GDPR) Toolkit for Digital Health. / Hussein, R.; Wurhofer, D.; Strumegger, E.-M. et al.
MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation: Proceedings of the 18th World Congress on Medical and Health Informatics. Vol. 290 IOS Press BV, 2022. p. 222-226 (Studies in Health Technology and Informatics).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - General Data Protection Regulation (GDPR) Toolkit for Digital Health

AU - Hussein, R.

AU - Wurhofer, D.

AU - Strumegger, E.-M.

AU - Stainer-Hochgatterer, A.

AU - Kulnik, S.T.

AU - Crutzen, R.

AU - Niebauer, J.

N1 - Conference code: 179966 Cited By :1 Export Date: 14 December 2023 Correspondence Address: Hussein, R.; Ludwig Boltzmann Institute for Digital Health and Prevention, Lindhofstrasse 22, Austria; email: [email protected] Funding details: Ludwig Boltzmann Gesellschaft, LBG Funding text 1: This GDPR compliance activity was conducted within the scope of the Co-production of home-based digital support for cardiac patients (CODIS) project, funded by the Ludwig Boltzmann Gesellschaft (LBG) Open Innovation in Science (OIS) Center under the “Research Enrichment Fund: COVID-19 Support Measures”. References: EU Data Protection Rules [Internet], , https://ec.europa.eu/info/law/lawtopic/data-protection/eu-data-protection-rules_en, European Commission-European Commission. [cited 2021 April 9]; Mondschein, C.F., Monda, C., The eu's general data protection regulation (gdpr) in a research context (2019) Fundamentals of Clinical Data Science [Internet], , https://pubmed.ncbi.nlm.nih.gov/31314241/, Kubben P, Dumontier M, Dekker A, editors. Cham (CH): Springer [cited 2021 April 10]; General Data Protection Regulation (GDPR) Compliance Guidelines [Internet], , https://gdpr.eu/, GDPR. eu. [cited 2021 April 9]; GDPR Guide [Internet]. French Data Protection Authority (CNIL), , https://www.cnil.fr/en/home, [cited 2021 April 9]; (2018) Understanding the General Data Protection Regulation (GDPR). Deloitte Malta Risk Advisory; EBooks for Health and Medical App Security [Internet], , https://www.chino.io/blog/healthcare-app-development-resources/, [cited 2021 April 9]; GDPR Checklist-Cloud Security Checklist for GDPR Compliance [Internet], , https://tresorit.com/gdpr/gdpr-checklist, [cited 2021 April 9]; Mustafa, U., Pflugel, E., Philip, N., A novel privacy framework for secure m-health applications: The case of the GDPR (2019) 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3), pp. 1-9; Muchagata, J., Ferreira, A., Translating GDPR into the mHealth practice (2018) 2018 International Carnahan Conference on Security Technology (ICCST), pp. 1-5; Crutzen, R., Ygram Peters, G.-J., Mondschein, C., Why and how we should care about the general data protection regulation (2019) Psychol Health., 34 (11), pp. 1347-1357

PY - 2022

Y1 - 2022

N2 - The General Data Protection Regulation (GDPR) entered into force on May 25, 2018. Compliance with GDPR is especially relevant to the Digital Health (DH) domain, as it is common to process highly sensitive personal data regarding a person's health. However, GDPR compliance is a very challenging process since it requires implementing several technical and organizational measures to maintain compliance. With the aim to facilitate this process, we reviewed the published best practices in GDPR compliance. Then, we customized the findings to fit into the DH domain and created a toolkit for GDPR implementation and compliance. The Activity Planning Tool (APT) is provided as an example of how this toolkit could be utilized in new application development in mobile health in Austria. In the case of our APT, the toolkit was very helpful in integrating the GDPR technical requirements in addition to creating the corresponding compliance impact assessment, processing agreements, privacy policy, data flowcharts, and compliance checklists. © 2022 International Medical Informatics Association (IMIA) and IOS Press.

AB - The General Data Protection Regulation (GDPR) entered into force on May 25, 2018. Compliance with GDPR is especially relevant to the Digital Health (DH) domain, as it is common to process highly sensitive personal data regarding a person's health. However, GDPR compliance is a very challenging process since it requires implementing several technical and organizational measures to maintain compliance. With the aim to facilitate this process, we reviewed the published best practices in GDPR compliance. Then, we customized the findings to fit into the DH domain and created a toolkit for GDPR implementation and compliance. The Activity Planning Tool (APT) is provided as an example of how this toolkit could be utilized in new application development in mobile health in Austria. In the case of our APT, the toolkit was very helpful in integrating the GDPR technical requirements in addition to creating the corresponding compliance impact assessment, processing agreements, privacy policy, data flowcharts, and compliance checklists. © 2022 International Medical Informatics Association (IMIA) and IOS Press.

KW - Consent

KW - Data Protection

KW - Digital Health

KW - Health care

KW - Medical informatics

KW - Activity planning

KW - Application development

KW - Best practices

KW - Digital health

KW - General data protection regulations

KW - New applications

KW - Organisational

KW - Planning tools

KW - Regulation compliance

KW - Sensitive data

KW - adult

KW - Austria

KW - checklist

KW - conference paper

KW - data protection

KW - human

KW - privacy

KW - sensitive personal information

KW - computer security

KW - Computer Security

KW - Humans

U2 - 10.3233/SHTI220066

DO - 10.3233/SHTI220066

M3 - Conference contribution

SN - 978-1-64368-264-8

VL - 290

T3 - Studies in Health Technology and Informatics

SP - 222

EP - 226

BT - MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation

PB - IOS Press BV

T2 - 18th World Congress on Medical and Health Informatics: One World, One Health - Global Partnership for Digital Innovation, MEDINFO 2021

Y2 - 2 October 2021 through 4 October 2021

ER -

Hussein R, Wurhofer D, Strumegger EM, Stainer-Hochgatterer A, Kulnik ST, Crutzen R et al. General Data Protection Regulation (GDPR) Toolkit for Digital Health. In MEDINFO 2021: One World, One Health – Global Partnership for Digital Innovation: Proceedings of the 18th World Congress on Medical and Health Informatics. Vol. 290. IOS Press BV. 2022. p. 222-226. (Studies in Health Technology and Informatics). doi: 10.3233/SHTI220066

General Data Protection Regulation (GDPR) Toolkit for Digital Health

Abstract

Publication series

Conference

UN SDGs

Keywords

Classification according to Österreichische Systematik der Wissenschaftszweige (ÖFOS 2012)

Applied Research Level (ARL)

Research focus/foci

Access to Document

Fingerprint

Cite this