Electronic Health Records: Privacy and Security Issues in a Comparative Perspective

Click to increase image sizeClick to decrease image size Notes 1. "As a result of increasing interconnectivity, information systems and networks are now exposed to a growing number and a wider variety of threats and vulnerabilities. This raises new issues for security." OECD Guidelines for the Security of Information Systems and Networks, July 25, 2002, at p. 7, available at www.oecd.org/dataoecd/16/22/15582260.pdf. 2. Although not the subject of this article, it is important to note that countries are also enacting cybercrime legislation to make clear that certain online activities are illegal and to assist law enforcement in efforts to prosecute cyber criminals. To that end, the Privacy and Computer Crime Committee of the American Bar Association Section of Science & Technology Law has recently undertaken a project to develop a Model Cybercrime Law for the UN International Telecommunication Union's (ITU) Cybersecurity Work Programme to Assist Developing Countries. See also the International Guide to Combating Cybercrime published by this Committee, available at http://www.abanet.org/dch/committee.cfm?com=ST202003. 3. See the Appendix for a compilation of some of the key laws and regulations governing information security. 4. See, e.g., EU Data Protection Directive and HIPAA, cited in the Appendix. 5. See, e.g., E-SIGN, UETA, and UN Convention cited in the Appendix. 6. See, e.g., Kimberly Kiefer and Randy V. Sabett, Openness of Internet Creates Potential for Corporate Information Security Liability, BNA Privacy & Security Law Report, Vol. 1, No. 25 at 788 (June 24, 2002); Alan Charles Raul, Frank R. Volpe, and Gabriel S. Meyer, Liability for Computer Glitches and Online Security Lapses, BNA Electronic Commerce Law Report, Vol. 6, No. 31 at 849 (August 8, 2001); Erin Kenneally, The Byte Stops Here: Duty and Liability for Negligent Internet Security, Computer Security Journal, Vol. XVI, No. 2, 2000. 7. See, e.g., Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007); Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006); and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005) (all affirming a negligence cause of action). See also, In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007) (rejecting a negligence claim due to the economic loss doctrine, but allowing a negligent misrepresentation claim to proceed). 8. See, e.g., American Express v. Vinhnee, 2005 Bankr. Lexis 2602 (9th Cir. Bk. App. Panel, 2005); Lorraine v. Markel, 2007 U.S. Dist. Lexis 33020 (D. MD. May 4, 2007). 9. Available at www.pcisecuritystandards.org. 10. Available at www.cabforum.org. 11. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC 27001"), available for purchase at http://www.standards-online.net/InformationSecurityStandard.htm. 12. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 13. See statutes listed in the Appendix. 14. See statutes listed in the Appendix. 15. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. 1320d-2 and 1320d-4, (providing that "each person … who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards: (A) to ensure the integrity and confidentiality of the information; (B) to protect against any reasonably anticipated: (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person," at 42 U.S.C. 1320d-2(d)(2). 16. Gramm-Leach-Bliley Financial Services Modernization Act ("GLB"), Pub. L. No. 106-102, 113 Stat. 1338 (November 12, 1999), at §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, providing that "[E]ach financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." 17. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC). 18. Final HIPAA Security Regulations, 45 C.F.R. Part 164. 19. There have also been efforts in the United States to pursue comprehensive federal privacy similar to the approach taken by many other countries. See e.g., Microsoft position paper at www.microsoft.com/presspass/download/features/2005/PrivacyLegislationCallWP.doc. Although it remains to be seen whether that approach will ultimately be adopted, it is clear that the combination of U.S. state and federal law has, in effect, imposed a comprehensive obligation of security with respect to all personal information held by all companies. 20. See, e.g., FTC enforcement actions regarding In the Matter of Sunbelt Lending Services, Inc.; In the Matter of Petco Animal Supplies, Inc.; In the Matter of MTS, Inc., d/b/a Tower records/Books/Video; In the matter of Guess?, Inc.; FTC V. Microsoft; and In the Matter of Eli Lilly and Company cited in the Appendix. 21. See, e.g., FTC enforcement actions regarding In the Matter of CardSystems Solutions, Inc.; United States v. ChoicePoint, Inc.; In the Matter of DSW Inc.; and In the Matter of BJ's Wholesale Club, Inc. cited in the Appendix. 22. See list in the Appendix. 23. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). 24. 205 Mich. App. Lexis 353 at ∗16 (Mich. App. 2005). 25. 2006 U.S. Dist. Lexis 4846 at ∗9 (D. Minn. 2006). 26. Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). 27. In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007), at pp. 28–29. 28. Ibid. 29. The Homeland Security Act of 2002 defines the term "information system" to mean "any equipment or interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information, and includes—(A) computers and computer networks; (B) ancillary equipment; (C) software, firmware, and related procedures; (D) services, including support services; and (E) related resources." Homeland Security Act of 2002, Pub. L. 107-296, at Section 1001(b), amending 44 U.S.C. § 3532(b)(4). 30. See, e.g., Australia, Information Privacy Principles under the Privacy Act 1988, Principle No. 4, available at www.privacy.gov.au/publications/ipps.html; AICPA and the Canadian Institute of Chartered Accountants (CICA), Generally Accepted Privacy principles, Principle No. 8, available at http://infotech.aicpa.org/Resources/Privacy/Generally+Accepted+Privacy+Principles; APEC, Privacy principles, Principle No. 7, available at http://austlii.edu.au/∼graham/APEC/APECv10.doc; US-EU Safe Harbor Privacy Principles, available at www.export.gov/safeharbor/SHPRINCIPLESFINAL.htm; Direct Marketing Association, Online Marketing Guidelines, available at www.the-dma.org/guidelines/onlineguidelines.shtml. 31. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 32. EU Data Protection Directive, Preamble at Para. 46. 33. EU Data Protection Directive, Article 17(1). 34. See statutes listed in the Appendix. 35. See statutes listed in the Appendix. 36. See generally, Bruce H. Nearon, Jon Stanley, Steven W. Teppler, and Joseph Burton, Life after Sarbanes-Oxley: The Merger of Information Security and Accountability, Jurimetrics Journal, Vol. 45, 379–412 (2005). 37. American Express v. Vinhnee, 336 B.R. 437; 2005 Bankr. Lexis 2602 (9th Cir. December 16, 2006). 38. Ibid., at p. 444. 39. Ibid., at p. 445. 40. Ibid., at pp. 446–447. 41. Ibid., at p. 449. 42. See, e.g., National Association of Corporate Directors, Information Security Oversight (2007). 43. Sarbanes-Oxley Act, Section 302. 44. See, e.g., GLB Security Regulations (Federal Reserve) 12 C.F.R. 208, Appendix D-2.III(A). 45. HIPAA Security Regulations, 45 C.F.R. Section 164.308(a)(2). 46. See, FTC Decisions and Consent Decrees listed in the Appendix, including Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. 27(a), p. 7; Eli Lilly Decision at II.A. 47. FISMA, 44 U.S.C. 3544(a). 48. E. Michael Power and Roland L. Trope, Sailing in Dangerous Waters: A Director's Guide to Data Governanc e , American Bar Association (2005), p. 13; Roland L. Trope, "Directors' Digital Fiduciary Duties," IEEE Security & Privacy, January/February 2005 at p. 78. 49. Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). 50. Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005), at pp. 11–13 (noting that harm was foreseeable, but Board took no action). 51. Securing Cyberspace: Business Roundtable's Framework for the Future, Business Roundtable, May 19, 2004 at pp. 1, 2; available at www.businessroundtable.org/pdf//20040518000CyberSecurityPrinciples.pdf. The Business Roundtable is an association of chief executive officers of leading U.S. corporations with a combined workforce of more than 10 million employees in the United States. See www.businessroundtable.org. 52. Information Security Governance: A Call to Action, Corporate Governance Task Force Report, National Cyber Security Partnership, April 2004, pp. 12–13, available at www.cyberpartnership.org/InfoSecGov4_04.pdf. The National Cyber Security Partnership (NCSP) is led by the Business Software Alliance (BSA), the Information Technology Association of America (ITAA), TechNet, and the U.S. Chamber of Commerce in voluntary partnership with academicians, CEOs, federal government agencies, and industry experts. Following the release of the 2003 White House National Strategy to Secure Cyberspace and the National Cyber Security Summit, this public–private partnership was established to develop shared strategies and programs to better secure and enhance America's critical information infrastructure. Further information is available at www.cyberpartnership.org. 53. GLB Security Regulations (OCC), 12 C.F.R. Part 30, Appendix B, Part III.A and Part III.F. 54. See, e.g., Homeland Security Act of 2002 (Federal Information Security Management Act of 2002) 44 U.S.C. Section 3542(b)(1); GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part II.B; HIPAA Security Regulations, 45 C.F.R. Section 164.306(a)(1); Microsoft Consent Decree at II, p. 4. 55. See, e.g., 44 USC 3532(b)(1), emphasis added. See also FISMA, 44 U.S.C. Section 3542(b)(1). Most of the foreign privacy laws also focus their security requirements from this perspective. This includes, for example, the EU Privacy Directive, Finland's Privacy Law, Italy's Privacy Law, and the UK Privacy Law. Also in this category is the Canadian Privacy Law. 56. Although they often focus on categories of security measures to address. See, e.g., HIPAA Security Regulations, 45 C.F.R. Part 164. 57. See, e.g., FDA regulations at 21 C.F.R. Part 11 (procedures and controls); SEC regulations at 17 C.F.R. 257.1(e)(3) (procedures); SEC regulations at 17 C.F.R. 240.17a-4 (controls); GLB regulations (FTC) 16 C.F.R. Part 314 (safeguards); Canada, Personal Information Protection and Electronic Documents Act, Schedule I, Section 4.7 (safeguards); EU Data Privacy Directive, Article 17(1) (measures) available at http://europa.eu.int/comm/internal_market/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf. 58. See, e.g., HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; COPPA, 15 U.S.C. 6502(b)(1)(D), and COPPA regulations 16 C.F.R. 312.8; IRS Rev. Proc. 97-22, sec. 4.01(2); SEC regulations 17 C.F.R. 257. See also UCC Article 4A, Section 202 ("commercially reasonable" security procedure), and Microsoft Consent Decree. 59. "Appropriate" security required by: HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; EU Data Protection Directive, Article 17(1). 60. EU Data Protection Directive, Article 17(1) (emphasis added) 61. See, e.g., Belgium—Belgian Law of 8 December 1992 on Privacy Protection in relation to the Processing of Personal Data, as modified by the law of 11 December 1998 Implementing Directive 95/46/EC, and the law of 26 February 2003, Chapter IV, Article 16(4); Denmark—Act on Processing of Personal Data,; Act No. 429 of 31 May 2000 (unofficial English translation), Title IV, Part 11, Section 41(3); Estonia—Personal Data Protection Act; Passed February12, 2003 (RT1 I 2003, 26, 158), entered into force October 1, 2003, Chapter 3, Sections 19(2); Greece—Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended by Laws 2819/2000 and 2915/2001); Article 10(3); Ireland—Data Protection (Amendment) Act 2003; Section 2.-(1)(d) and First Schedule Article 7; Lithuania—Law on Legal Protection of Personal Data, January 21, 2003, No. IX-1296, Official translation, with amendments April 13, 2004, Article 24(1); Netherlands—25 892—Rules for the protection of personal data (Personal Data Protection Act) (Unofficial translation); Article 13; Portugal—Act on the Protection of Personal Data (transposing into the Portuguese legal system Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), Article 14(1); Slovakia—Act No 428 of July 3, 2002 on personal data protection; Section 15(1); Sweden—Personal Data Act (1998:204); issued April 29, 1998, Section 31; and UK—Data Protection Act 1998, Schedule 1, Part I, Seventh Principle. 62. See, e.g., Finland—The Finnish Personal Data Act (523/1999), given on 22.4.1999, Section 32(1); Germany—Federal Data Protection Act as of January 1, 2003, Section 9; Hungary—Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest, Article 10(1); Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, Sections 31 and 33; Spain—Organic Law 15/1999 of December 13 on the Protection of Personal Data, Article 9. 63. 5 USC Sec. 552a. 64. 5 U.S.C. § 552a (d)(10) (emphasis added). 65. 42 U.S.C. 1320d-2(d)(2). 66. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC) (emphasis added). 67. Cal. Civil Code § 1798.81.5(b). 68. See UN Convention at Article 9(3), 9(4), and 9(5). 69. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005). See text at footnotes 157–169, infra. February 1, 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift May 16 C.F.R. Part 44 U.S.C. Section 45 C.F.R. 164. See of the on by of the Technology and Homeland Security of the Committee on the United States 21, 2007 at p. (noting that FTC under the GLB Act as a for the obligation to maintain reasonable and appropriate available at See also, of the the on Information and the Committee on U.S. House of on April 21, 2004, at p. 5 (noting that is an of reasonable and appropriate measures in of the available at See, e.g., FTC Decisions and Consent Decrees listed in the Appendix. See, e.g., National Association of Insurance for Information Model available at in at See, e.g., Consent Decrees listed in the Appendix. 78. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. 353 (Mich. App. February 15, 2005). Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006). Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). Committee on available at See, e.g., Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, B, § Act No 428 of July 2002 on personal data § the Appendix, Act, B, Section Act, Section the Appendix, Act, Article Act, Section Act, 16(4); Act, Section 41(3); Act, Section Act, Section 32(1); Act, Section 9; Act, Article 10(3); Act, Article 10(1); Act, Article 24(1); Act, Article 13; Act, Article 14(1); Act, Section 15(1); Act, Article 9; Act, Section 31; UK Act, Schedule 1, Part I, Seventh Act, Article 7. the Appendix, Act, Schedule 2, Section Act, Act, Schedule 1, 4.7 Principle 7, Act, Section Act, Section Act, B, Sections and Act, Sections 17 and the Appendix, Act, Section A Security § Act, Section Decree the Appendix, Decree the Appendix, Act, Section Principle 4; Act, Article Act, Article Act, Sections and Act, Section Act, Section Act, Section Act, B, Sections and Act, Sections 17 and Bruce & Digital Security in a & at p. See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. p. Eli Lilly Decision at II.B; GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at See, e.g., FISMA, 44 U.S.C. Sections and GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., In Electronic July 30, Financial Council, 2; available at See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part Eli Lilly Decision at II.B; HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., United States v. Cir. See, e.g., Inc. v. also v. or of to with and of See, e.g., HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part and Part FISMA, 44 U.S.C. Sections and Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of HIPAA Security Regulations, 45 CFR Section and and on HIPAA Security of & Section of Science & Technology Law, No. April 2003, at p. 2, available at See, e.g., HIPAA regulations 45 C.F.R. Sections and GLB Regulations, 12 C.F.R. 208, Appendix and 12 C.F.R. Part 30, Appendix B, Part Microsoft Consent at p. 4. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Sections and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. p. 5 and Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. HIPAA Security Regulations, 45 C.F.R. Sections and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, and 26, pp. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., FISMA, 44 U.S.C. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, Para. p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4. FISMA, 44 U.S.C. Section Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at Microsoft Consent Decree at p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. See, e.g., of the of the of National on 21, at See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). See Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). See Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 at (D. Minn. February 7, 2006) that a was the to and a of a was not a of a of reasonable The Financial is a of U.S. federal agencies, that the Board of of the Reserve Insurance the National the of the of the and the of Thrift on on in an Internet 8, 2006 at p. available at on on in an Internet 8, 2006 at p. available at Guide for the Guidelines Information Security December available at Information Security July available at See National Institute of and Management Guide for Information Technology No. available at ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC ISO/IEC § for is the and of International and is of a of the of with and a in that the The American National Institute the United States. See, The also in and in related to including The of make its with the United States. See ISO/IEC 27001, § (emphasis added). ISO/IEC 27001, § ISO/IEC 27001, § ISO/IEC 27001, § 164. ISO/IEC 27001, § ISO/IEC 27001, §§ and 6. ISO/IEC 27001, §§ and 8. ISO/IEC 27001, §§ ISO/IEC that with an International not in from legal p. 1. EU Data Protection Directive, Article 8. Article Data Protection on the processing of personal data to health in health February 15, at pp. available at (emphasis in See list of state laws in Report, Security and Laws of 15, 2005 at Appendix available at Code, § Rev. Stat. Available at www.pcisecuritystandards.org. See list in the Appendix. See, e.g., 16 CFR Section Health Insurance Portability and Accountability Act Security Regulations, 45 C.F.R. § HIPAA security regulations to in the Act Security Regulations, 12 C.F.R. Part 30 Appendix B, Part security regulations to information in the financial Homeland Security Act of 2002 § 1001(b), amending 44 U.S.C. § and § amending 44 U.S.C. § information and information systems from unauthorized and regulations, 21 C.F.R. Part 11. See, e.g., Cal. Civil Code § 1798.81.5(b). See April 2, the Matter of of the Act of of Information and Information Services, No. No. April 2, at available at (hereinafter Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). in an Internet 12, 2005 available at This was by an on on in an Internet 8, available at of No. 25, The is an See, e.g., HIPAA Security Regulations, 45 C.F.R. § at p. 6. Ibid., at p. 3. Ibid. v. National 2007 U.S. App. Lexis 2007), at p. 13. See, e.g., on of Security Breach Personal of Privacy of April 2006 (hereinafter at pp. at note , at p. a of such in the United States and a of the number of individuals Privacy at IRS Rev. Proc. § See list of statutes in the Appendix. on for Access to Information and Part of A to Appendix, at 12 C.F.R. Part 30 (OCC), 12 C.F.R. Part (Federal Reserve System), 12 C.F.R. Part (FDIC), and 12 C.F.R. Part 568 (Office of Thrift 29, Vol. No. 29, at p. (hereinafter the maintains personal information that the not in the laws the to the or of the information, than the individuals of any of the security of the See, e.g., Code § Rev. Stat. § Code, § Stat. § Code § 2007 The also any combination of of information that to or the such as and or and See, e.g., Breach to the of & Financial Services, December 15 USC Section This that with the of at 15 USC Section and are of in this and are of in this See, and of a Duty to Information Security Computer & L. See and to Law the Protection of Personal BNA Privacy & Security Law Report, 19, p. May See at on the of the Framework for Electronic and Services, with focus on the 26, available at Science and Technology Committee, House of Internet of July 24, at Para. of the Privacy of Canada, for in to Privacy available at See Privacy Breach of the Privacy available at Privacy available at See, of the Privacy to the Law of February at available at Available at Available at to information to state

The process of establishing normative acts in the European Union does not occur out of nowhere, but in the context of specific social needs. That was the case of the genesis of establishing legal regulations regarding the protection of personal data in the European Union. Socio-economic integration, which resulted from the functioning of internal market in the European Union, has led to a significant increase in cross-border transfers of personal data. It led to situation in which various economic operators or state institutions of the Member States have increasingly processed the personal data of the EU citizens. Within time, these data have become an equally valuable commodity - not to say even more valuable – compared to goods and services (Costa-Cabral, and Lynskey Orla, 2017, p. 11). Making use of personal data on a large scale especially by public and private entities, associations and companies over time has posed a threat to the security of personal data. This has made it necessary to introduce legal protection measures for personal data in the European Union that would eliminate the negative effects of any form of personal data processing. The purpose of this article is to evaluate legal regulations regarding legislative protection of personal data in the European Union against the background of EU Regulation 2016/679 of the European Parliament and the Council with respect to the protection of individuals due to processing personal data, its free movement and repealing Directive 95/46/EC (hereinafter referred to as Regulation 2016/679). Due to initially adopted purpose of the considerations there arose a problem which was formulated in the form of a question: Do the legal measures introduced by the Regulation constitute an effective tool for the protection of personal data in the event of a violation of the law by personal data administrators and entities while processing such data? The presented purpose of the considerations and the research problem determined the order of the analysis.

Over Troubled Water: E-Health Platforms and the Protection of Personal Data: The Case of Portugal

On its Judgment 76/2019, of 22 May, the Spanish Tribunal Constitucional has declared the invalidity of Section 58 bis of the Organic Law 5/1985, of 19 June, on the general electoral system, as incorporated by the Organic Law 5/2018, of 5 December, on personal data protection and safeguard of digital rights. In accordance to Recital 56 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, the Section mentioned above stated the possibility for the political parties to compile personal data on people's political opinion in the course of the electoral process. The unconstitutionality of such a provision has been declared because (1) the reasons of public interest for the processing of personal data on people's political opinion had not been identified, (2) the legal provision lacked certainty and predictability as required by the Spanish Constitution, and (3) appropriate safeguards had not been established. This brief comment on the Judgment argues that the Spanish Tribunal Constitucional has come to the right decision and tries to identify the public interest that would enable the Spanish legislator to regulate such a processing of personal data.

Through electronic health record implementation, national healthcare systems are aiming for care integration and enhancement. However, the path to large-scale electronic health record implementation is seldom smooth, involving multiple stakeholders with diverse interests and influences. This study proposes a framework that draws on both stakeholder and institutional theories to understand the complex dynamics of stakeholder interactions and institutional pressures over time during electronic health record systems implementation. This framework is utilized to analyze the national electronic health record programs of Singapore and England, which provide contrasting perspectives on how two top-down system implementations took place with different outcomes. Our results suggest that in the Singapore case, the presence of boundary spanners, supporting implementation agency that included IT staff from healthcare organizations, and greater engagement with medical professionals were associated with more positive dynamics of stakeholder interactions (e.g. limited pushback from professionals or the press) during electronic health record implementation than in England. Differences in the healthcare structures and systems, electronic health record project organization, and the combined influences of institutional pressures shed light on the varying implementation paths and outcomes in the two cases. This study adds to the health information technology literature through a comparative examination of the organizational and social processes during complex national healthcare integration projects. It also contributes to the institutional and stakeholder literatures in several ways, in particular by depicting the processes and outcomes of the dynamics of isomorphic pressures played out under different institutional conditions. Finally, our proposed framework provides a useful conceptual tool for analyzing such complex IT implementations across multiple stakeholders.

The new Slovenian personal data protection act: Statutory limits to injunctive regulation of the internet

BackgroundThe recent, rapid development of digital technologies offers new possibilities for more efficient implementation of electronic health record (EHR) and personal health record (PHR) systems. A growing volume of healthcare data has been the hallmark of this digital transformation. The large healthcare datasets' complexity and their dynamic nature pose various challenges related to processing, analysis, storage, security, privacy, data exchange, and usability. Materials and MethodsWe performed a systematic review of systematic reviews to assess technological progress in EHR and PHR systems. We searched MEDLINE, Cochrane, Web of Science, and Scopus for systematic literature reviews on technological advancements that support EHR and PHR systems published between January 1, 2010, and October 06, 2020. ResultsThe searches resulted in a total of 2,448 hits. Of these, we finally selected 23 systematic reviews. Most of the included papers dealt with information extraction tools and natural language processing technology (n = 10), followed by studies that assessed the use of blockchain technology in healthcare (n = 8). Other areas of digital technology research included EHR and PHR systems in austere settings (n = 1), de-identification methods (n = 1), visualization techniques (n = 1), communication tools within EHR and PHR systems (n = 1), and methodologies for defining Clinical Information Models that promoted EHRs and PHRs interoperability (n = 1). ConclusionsTechnological advancements can improve the efficiency in the implementation of EHR and PHR systems in numerous ways. Natural language processing techniques, either rule-based, machine-learning, or deep learning-based, can extract information from clinical narratives and other unstructured data locked in EHRs and PHRs, allowing secondary research (i.e., phenotyping). Moreover, EHRs and PHRs are expected to be the primary beneficiaries of the blockchain technology implementation on Health Information Systems. Governance regulations, lack of trust, poor scalability, security, privacy, low performance, and high cost remain the most critical challenges for implementing these technologies.

Electronic health records implementation: An evaluation of information system impact and contingency factors

Context: This literature review mostly emphasizes on the challenges and barriers for acceptance and implementation of electronic health records (EHRs) in developing countries. Although the willingness of developing countries for acceptance and implementation of EHRs is rising, they will face some challenges and barriers which can slow down their progress due to the multidisciplinary and complexity characteristics of EHRs. Some of these challenges and barriers can be seen in the past and present histories of EHRs acceptance process in developed countries too. Familiarity with these challenges and barriers will help developing countries to have better understanding of these problems towards successful EHRs. The main goal of this survey is to study the challenges and barriers of acceptance and implementation of EHRs in the developing countries and how they can overcome such problems. Evidence Acquisition: Two databases, Pub-Med and Scopus with Combination of terms such as Electronic Health Records, Developing Countries, Barriers, Challenges, Acceptance, and Adoption were searched. Totally, 514 articles extracted. Some exclusive criteria such as date of publication (year 2000 and above) and having a close relation to the subject of the study (through abstract) were applied. The result was eight articles from Scopus and 12 articles from Pub-Med. Also, 7 articles were extracted by general search in internet. Also, 11 articles with the same search policies were selected from Journal of Health informatics for Developing Countries (JHIDC) with no exclusion criteria. Results: Developing countries must be fully aware of challenges and barriers in their way towards EHRs. They also need to study the experiences of countries which are successful in acceptance and implementation of EHRs. Developing countries also need to provide infrastructures needed for a successful implementation of EHRs. Conclusions: Despite the positive effects of EHRs in healthcare services, the acceptance rate of EHRs in developing countries and even developed countries is still low. The developing countries are facing many problems in their way toward implementing successful EHRs. Lack of infrastructures in information and communication technology, cost, and cultural resistance are considered as main barriers for developing countries in their approach to accept and implement EHRs.

Unlike conventional methods and technologies of collecting, processing and analysing the personal data of natural persons as part of law enforcement activities, the broader use of different artificial intelligence methods brings into focus the need for specific rules regulating the application of various artificial intelligence methods to protect two independent fundamental rights as regulated by EU Charter of Fundamental Rights, Art. 7 and 8 – data protection and privacy. Privacy, the protection of personal data and the security of their processing and transmission within law enforcement activities, whether it is non-automated, partially or fully automated, is prescribed by Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data. When considering personal data protection in the context of Directive 2016/680 it is referred to the protection of information on the confirmed identity of a natural person (data protection) and the protection of all information by which identity can be confirmed (privacy). Thus, this information should not be part of the defined personal data category, and all methods and technologies that can be used for direct and indirect confirmation of the identity of a natural person should be taken into account. The paper aims to determine whether there is relationship between privacy and security and whether there are differences in the personal data collection, processing and analysis methods by law enforcement authorities, when used methods are conventional or artificial intelligence. The first hypothesis emphasises causality between privacy and security when collecting, processing and analysing their personal data by conventional methods and artificial intelligence methods for law enforcement purposes. The second hypothesis implies a statistically significant difference in making personal data available to law-enforcement bodies in cases they are collected, processed and analysed by conventional methods and in cases they are collected, processed or analysed by artificial intelligence methods. The methods used are: descriptive method for describing the process of collecting, processing and analysing personal data in law enforcement activities, as well as for describing the differences between conventional and artificial intelligence methods and evaluating hypotheses; induction for creating hypothesis; deduction for observing specific relations; content analysis and synthesis in the evaluation phase; survey method; statistical and comparative method in the testing phase and for determining the compliance with the hypotheses.

Nurses and physicians’ perceptions on the Electronic Health Record implementation

ABSTRACTEarly HIV detection and treatment decreases morbidity and mortality and reduces high-risk behaviors. Many Emergency Departments (EDs) have HIV screening programs as recommended by the Centers for Disease Control and Prevention. Recent federal legislation includes incentives for electronic health record (EHR) adoption. Our objective was to analyze the impact of conversion to EHR on a mature ED-based HIV screening program. A retrospective pre- and post-EHR implementation cohort study was conducted in a large urban, academic ED. Medical records were reviewed for HIV screening rates from August 2008 through October 2013. On 1 November 2010, a comprehensive EHR system was implemented throughout the hospital. Before EHR implementation, labs were requested by providers by paper orders with HIV-1/2 automatically pre-selected on every form. This universal ordering protocol was not duplicated in the new EHR; rather it required a provider to manually enter the order. Using a chi-squared test, we compared HIV testing in the 6 months before and after EHR implementation; 55,054 patients presented before, and 50,576 after EHR implementation. Age, sex, race, acuity of presenting condition, and HIV seropositivity rates were similar pre- and post-EHR, and there were no major patient or provider changes during this period. Average HIV testing rate was 37.7% of all ED patients pre-, and 22.3% post-EHR, a 41% decline (p < 0.0001), leading to 167 missed new diagnoses after EHR. The rate of HIV screening in the ED decreased after EHR implementation, and could have been improved with more thoughtful inclusion of existing human processes in its design.

To assess the impact of electronic health record (EHR) implementation on hospital finances. We analyzed the impact of EHR implementation on bond ratings and net income from service to patients (NISP) at 32 hospitals that recently implemented a new EHR and a set of controls. After implementing an EHR, 7 hospitals had a bond downgrade, 7 had a bond upgrade, and 18 had no changes. There was no difference in the likelihood of bond rating changes or in changes to NISP following EHR go-live when compared to control hospitals. Most hospitals in our analysis saw no change in bond ratings following EHR go-live, with no significant differences observed between EHR implementation and control hospitals. There was also no apparent difference in NISP. Implementation of an EHR did not appear to have an impact on bond ratings at the hospitals in our analysis.

The aim of this study was to develop a survey tool to assess electronic health record (EHR) implementation to guide improvement initiatives. Survey tools are needed for ongoing improvement and have not been developed for aspects of EHR implementation. The Baylor EHR User Experience (UX) survey was developed to capture 5 concept domains: training and competency, usability, infrastructure, usefulness, and end-user support. Validation efforts included content validity assessment, a pilot study, and analysis of 606 nurse respondents. The revised tool was sent to randomly sampled EHR nurse-users in 11 acute care facilities. A total of 1,301 nurses responded (37%). Internal consistency of the survey tool was excellent (Cronbach's α = .892). Survey responses including 1,819 open comments were used to identify and prioritize improvement efforts in areas such as education, support, optimization of EHR functions, and vendor change requests. The Baylor EHR UX survey was a valid tool that can be useful for prioritizing improvement efforts in relation to EHR implementation.

Problem setting. The key direction of globalization of the sphere of economic relations is the further development of the information economy, which creates the prerequisites for the formation and development of the information services market. In the process of informatization of the economy, information turns into an important production resource, which gives impetus to the accelerated development of the information sector. The Basic Principles of the Development of the Information Society in Ukraine for 2007-2015 included among the main strategic goals the improvement of legislation on the regulation of information relations. In today’s conditions, the defined provisions have gained a new round of relevance, which requires further research into contractual relations in the sphere of information services as a basis for the modernization of the regulatory principles of the development of the information economy as a whole. Currently, there is a large demand for information services, among which consulting services are among the most popular. Analysis of recent researches and publications. The study of consulting activities and/or consulting services that constitute the content of such activities, contracts for the provision of the specified services is devoted to the work of a number of domestic legal scholars, among whom it is worth noting: Gontareva I. V., Goncharenko O. M., Kolomiyets M. V., Lysheniuk V. K., Sukmanova O. V., Sharkova G. Yu., Tur O. T. and others. At the same time, the integration of information and digital technologies into all spheres of economic activity and the growth of the role of information (information products) in modern economic processes contributes both to the further development of consulting and other information services, and to the formation of a new approach to the contractual and legal support for their provision. Purpose of the research is to highlight and analyze problematic issues of legal support for contractual relations for the provision of consulting services. Article’s main body. The article is devoted to important aspects of the legal regulation of contractual relations related to the provision of consulting services. The author notes the lack of a unified approach to the content of the concept of “consulting service”, as well as its relationship with the concept of “consulting service”. Theoretical approaches to the essential nature of consulting services are summarized. Particular attention is paid to the substantive component of the contract for the provision of complex consulting services. In the context of the analysis of the international consulting standard ISO 20700:2017, individual issues regarding the quality characteristics of consulting services are highlighted. Special attention is focused on the issue of ensuring that the provider of consulting services protects the rights of customers to an appropriate level of security of confidential information about them and/or their activities. The basic principles contained in the EU Regulation on the general protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR, General Data Protection Regulation, 2016/679) are examined and which organizations must adhere to when collecting, processing or storing personal data. Conclusions and prospects for development. The article is devoted to important aspects of the legal regulation of contractual relations related to the provision of consulting services. The author notes the lack of a unified approach to the content of the concept of “consulting service”, as well as its relationship with the concept of “consulting service”. Theoretical approaches to the essential nature of consulting services are summarized. Particular attention is paid to the substantive component of the contract for the provision of complex consulting services. In the context of the analysis of the international consulting standard ISO 20700:2017, individual issues regarding the quality characteristics of consulting services are highlighted. Special attention is focused on the issue of ensuring that the provider of consulting services protects the rights of customers to an appropriate level of security of confidential information about them and/or their activities. The basic principles contained in the EU Regulation on the general protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR, General Data Protection Regulation, 2016/679) are examined and which organizations must adhere to when collecting, processing or storing personal data.