ANNEX

1. Principles

(a) Citizen-centric by design

Citizens should be central to the way in which systems are designed. Such systems are to be designed to implement the principles of data protection by design and by default to meet the requirements of the General Data Protection Regulation.

(b) Comprehensiveness and machine-readability

Electronic health records should be as comprehensive as possible in order to support health and care services throughout the Union.

Health data introduced in electronic health records should be machine-readable to the extent required by reasonable intended reuse of those data. Information should be structured and codified in the most practical way possible, with a view to making health data interoperable, including across borders.

(c) Data protection and confidentiality

Electronic Health Record systems and interoperability solutions have to guarantee the confidentiality of personal health data and conform with all aspects of data protection legislation, from their design stage onward.

The fundamental right to the protection of personal data should be fully and effectively implemented, in conformity with Regulation (EU) 2016/679, including the right to transparent information, the right of access and other relevant rights listed in Chapter III. In particular, citizens should be able to exercise their right to access their health data by having access to their electronic health records, including across borders.

(d) Consent or other lawful basis

Any processing (1) of health data must be based on the explicit consent of the citizen concerned or on any other lawful basis, pursuant to Articles 6 and 9 of Regulation (EU) 2016/679.

(e) Auditability

Any processing of health data should be registered and verified for auditing purposes, using appropriate techniques, such as logging and audit trailing, to keep an accurate record of the access to electronic records, their exchange or any other processing operation.

(f) Security

Pursuant to Regulation (EU) 2016/679 and Directive (EU) 2016/1148 appropriate technical and organisational measures must be implemented to ensure that electronic health record systems are secure. Those measures should include protection against unauthorised or unlawful processing of health data and against accidental loss, destruction or damage. Entities exchanging electronic health records should ensure that personnel dealing with electronic health records systems is properly aware of cybersecurity risks and adequately trained.

(g) Identification and authentication

Strong and reliable identification and authentication of all involved parties is a key element to guarantee trust in exchanges of data between electronic health record systems.

The use of notified national electronic identifications (‘eID's) supports citizens’ cross-border identification and authentication to access their health data in full security and convenience, as well as the principle of ‘non-repudiation’ assuring the origin and integrity of such data. Through the mutual recognition of national electronic identification schemes, as foreseen in Regulation (EU) No 910/2014, citizens of one Member State may use their national electronic identifications to securely access online services provided to them in another Member State. Pursuant to Article 6 of that Regulation, online public services requiring electronic identification assurance corresponding to a certain level (‘substantial’ or ‘high’) must accept the notified electronic identification schemes of other Member States.

(h) Continuity of service

Continuity and availability of the electronic health record exchange service is essential to guarantee continuity of care. Any incidents or interruptions that may arise in the course of the use of the service should be promptly addressed in accordance with defined business continuity plans.

2. Baseline for the European electronic health record exchange format: health information domains and specifications for cross-border exchange of electronic health records

The baseline for the European electronic health record exchange format should include the health information domains and interoperability specifications (including standards, and profiles (2)) mentioned below for representing and exchanging (structured and unstructured) health data.

This baseline should be further refined and extended through a joint coordination process. Additional international standards, specifications and profiles, currently being developed, under revision or in trial implementation phase should be considered in further developing a European electronic health record exchange format.

2.1. Health information domains for cross-border exchange

The initial set of health information domains for cross-border exchange should include the following:

(i) Patient Summaries (3)

(iii) Laboratory reports

(iv) Medical images and reports

(v) Hospital discharge reports.

These health information domains have been prioritised in alignment with the eHealth Network established priorities, on the basis of current work under the eHealth Digital Services Infrastructure and clinical relevance for cross-border healthcare.

2.2. Interoperability specifications

Tables A and B contain a set of recommended interoperability specifications for content structuring and representation.

2.2.1. Table A: Content structuring and representation for health information domains for which the eHealth Network have adopted guidelines

Health information domains Clinical information for cross-border exchange Content representation for cross-border exchange Patient Summary Structured according to the provisions in the ‘GUIDELINE on the electronic exchange of health data under Cross-Border Directive 2011/24/EU Release 2 — Patient Summary for unscheduled care’ adopted by the eHealth Network on 21 November 2016 (5) Health Level Seven (HL7) Clinical Document Architecture (CDA) Release 2 (6) Level 3 and Level 1 (PDF (7)/A) ePrescription/eDispensation Structured according to the provisions in the ‘GUIDELINE on the electronic exchange of health data under Cross-Border Directive 2011/24/EU Release 2 — ePrescriptions and eDispensations’ adopted by the eHealth Network on 21 November 2016 (8) Health Level Seven (HL7) Clinical Document Architecture (CDA) Release 2 Level 3 and Level 1 (PDF (7)/A)

2.2.2. Table B: Content structuring and representation for other health information domains

Health information domain Clinical information for cross-border exchange Content representation for cross-border exchange Laboratory results Enable cross-border exchange according to the clinical information structure currently used by the sender electronic health record system, while common clinical information structures for cross-border exchange are developed and agreed. For laboratory results, medical imaging reports and hospital discharge reports Health Level Seven (HL7) Clinical Document Architecture (CDA) Release 2 Level 3 or Level 1 (PDF (9)/A) For medical imaging Digital Imaging and Communications in Medicine (DICOM) Medical imaging and reports Hospital discharge reports

2.2.3. Cross-border exchange profiles

The use of relevant ‘Integrating the Healthcare Enterprise’ profiles listed in the Annex to Decision (EU) 2015/1302 should be duly considered to facilitate the exchange of healthcare information domains across borders.

Those ‘Integrating the Healthcare Entreprise’ profiles could be used, inter alia, for patient identification, document exchange, audit trails and identity claims.

The joint coordination process should also consider other ‘Integrating the Healthcare Entreprise’ profiles currently at trial stage, or any other standards or specifications needed to address the requirements for secure health data exchange, as well as other types of message exchange patterns.

3. Future work

The aim is to deliver the right data, at the right time — for citizens and healthcare providers — and allow for the secure access, sharing and exchange of electronic health records.

As such, working towards comprehensive cross-border exchange of electronic health records in a fast changing, connected environment requires regular review of the latest technological and methodological innovations to managing data, including those related to accessing and leveraging of advanced technological infrastructures.

The refinement of the exchange format should consider the possibility offered by resource driven information models (such as Health Level Seven Fast Healthcare Interoperability Resources (HL7 FHIR©) (10)).

In order to make further progress, a review of new approaches to interoperability specifications, such as relevant Application Programming Interfaces (‘API's) and developments in digital technologies such as artificial intelligence, cloud computing, interaction technologies, high performance computing and cyber security solutions should be carried out. Evolution in other technologies such as distributed ledger technologies may have the potential to build trust amongst citizens and health care organisations provided that they comply with personal data protection rules.

The above technologies should be considered with a view to supporting innovation in health care service provision, offering new possibilities to address issues such as health data provenance, and automated integrity assurance.

(1) As defined in Article 4(2) of the General Data Protection Regulation.

(2) The way in which standards can be implemented to meet specific clinical needs.

(3) https://ec.europa.eu/health/sites/health/files/ehealth/docs/ev_20161121_co10_en.pdf

(4) https://ec.europa.eu/health/sites/health/files/ehealth/docs/ev_20161121_co091_en.pdf

(5) https://ec.europa.eu/health/sites/health/files/ehealth/docs/ev_20161121_co10_en.pdf

(6) http://www.hl7.org/implement/standards/product_brief.cfm?product_id=7

(7) Portable Document Format.

(8) https://ec.europa.eu/health/sites/health/files/ehealth/docs/ev_20161121_co091_en.pdf

(9) Portable Document Format

(10) http://hl7.org/fhir/