## 1 Damage events \"breach of the warranty objective of confidentiality\"
### TOMs  
Given that TOMs form a pivotal cornerstone of a DPIA, the subsequent paragraph provides an in-depth elaboration on this crucial aspect. As implied by the nomenclature, _technical and organizational measures_ encompass a blend of technical and organizational considerations that serve to elevate the protective mantle enshrouding patient-related data. Some of these measures possess universal applicability, transcending project-specific boundaries. Nevertheless, it is important to acknowledge that many risks warrant meticulous tailoring to the distinctive contours of each individual institute. Thus, the DPIA click&go tool has to be fed with the institute's specific DPIA snippets, especially regarding the TOMs, as the published version of the tool is solely intended to provide a semi-automated inter-institutional streamlining of the whole DPIA formulation process. Note that the ensuing descriptions of TOMs do not encapsulate the full range of possible TOMs but aim to give a broad overview of potential categories for mitigating risk strategies. Starting with the technical aspects to consider: Adequate time and expertise are essential for mapping the data flow and establishing strong technical safeguards for a project's secure launch. Regarding software coding, only trained IT experts should handle health software, and implementing a double-check process is advisable. During project planning, two critical IT areas should ideally be focused on: (1). Setting up secure networks with robust firewalls to thwart malware and prevent security vulnerabilities that could lead to data breaches. (2). Utilizing secure computers, approved by IT professionals, ideally without ports such as USB that might allow entry of malicious data or malware capable of compromising software or databases. Further general technical considerations can involve encrypted servers, automatic logouts for inactive software, routine backups, and controlled access to software overseen by a limited group of trained IT administrators. To prevent \"man-in-the-middle\" attacks at interfaces, it is recommended to restrict database access to specific IP addresses. When applicable, exploring additional security measures like an audit trail or a \"demilitarized zone\" (DMZ) might be considered. Ensuring that patient data-handling software includes functional email communication enables users to connect with experts in case of issues. Importantly, documenting all technical steps taken in a dedicated plan or equivalent documentation is imperative. In addition to the mentioned technical measures, there are organizational measures that should be considered: TOMs primarily involve clear standard operating procedures (SOPs) that give specific and legally binding action instructions to everyone involved in data handling and related activities within the project. Each part of the institutes involved should have its own SOP. Moreover, all hospitals should provide official guidelines, e.g., for password management, handling technical devices, or general data protection and security. Regular training (e.g., (bi-)annually) is a must to educate employees about data protection and the measures of the institute. Access to hospital buildings should be tightly controlled, and security measures like cameras and security staff should be in place to prevent unauthorized access to computers with patient data or servers. Another potential organizational measure stems from the ability to classify patient-related data into two distinct categories: (1). data facilitating direct patient identification, such as full name, address, birth date, health insurance number, and patient ID, referred to as identifying data (IDAT); and (2). the patient's medical data (MDAT), encompassing diagnoses, lab values, medical images, and treatment plans, among others. Segregating the storage of MDAT and IDAT, with distinct pseudonym assignments for each, provides an enhanced level of data security [23; 24].