## 2 The TASIPPS Conceptual Framework
### The TASIPPS Framework Components
#### 2.1.3 The Privacy Module
work, data integrity plays a pivotal role in upholding the credibility of the healthcare data that will be exchanged and managed within the system. This holistic approach to data integrity involves multiple strategies. It includes mechanisms such as version control, which keeps track of data modifications over time, ensuring a clear historical record of changes. Encryption techniques (AES256) are applied to secure the data during both the transmission and storage phases, fortifying their protection against unauthorized access. Hashing algorithms and HMAC (Hash-Based Message Authentication Code) protocols are employed to guarantee that data in transit remain unmodified and untampered, with real-time alerts configured to signal any potential breaches. Maintaining data integrity also encompasses a comprehensive review of access control procedures. Rigorous authentication and authorization protocols are established, ensuring that only authorized individuals are able to interact with data. Notably, all alterations or modifications will be meticulously documented and subject to approval before implementation, bolstering accountability and traceability. By seamlessly integrating these strategies, the framework ensures data integrity. This, in turn, underpins the reliability of the healthcare data, fostering an environment of trust, precision, and security throughout the system's operations. Data Retention and Deletion: Ensuring proper data retention and deletion is crucial for maintaining compliance with regulations, protecting privacy, and managing the lifecycle of data within the proposed framework. The retention and deletion of data will be guided by the storage limitation principle (Art 5(1) (e)) of the GDPR and other industry best practice guides. Within the policy module, the retention policies for the different data classifications are outlined. In this module, data classification is implemented to differentiate between sensitive data, important data, and non-sensitive data. This framework implements auto  
Figure 6: How patients grant and decline access to their data. mated triggers on the various data classifications and initiates the deletion of data once the defined retention period expires. The framework also implements cryptographic erasure to ensure that deleted data cannot be restored. This ensures consistency and reduces the risk of human errors. Consent Management: The framework implements an explicit opt-in mechanism where individuals actively provide their consent before their data are collected or processed, as mandated by Art. 7 of the GDPR. This is achieved through checkboxes and online forms. The proposed framework offers granular consent options that allow individuals to choose which specific portions of their EHR data they are comfortable sharing and for what purposes. This initiative empowers the patient to control the extent of the data sharing. There is also a straightforward process that enables individuals to withdraw their consent at any time. The framework incorporates a centralized system to document consent. This system stores information about who provided the consent, when it was provided, and for what purpose(s). Due to the various classifications of data, a prompt is presented for subjects to re-confirm their consent if their data usage changes. Breach Notification: Implementing breach notifications requires a combination of technologies to ensure timely and accurate communication with affected individuals. This framework incorporates email notifications and system alert flags to notify participants of breaches. Within the framework's user interface, web alerts are incorporated, which appear when users log in. These deliver breach notifications and valuable information immediately upon login. The GDPR mandates that the data protection authority must be promptly informed in the event of a system breach (Art 33) and the subjects of the data must also be informed if there is a risk to their rights and freedoms (Art 34).