3.4 Security for Data at Rest 1 SHALL PHI and PII stored on a smartphone is stored as encrypted values. 3 SHALL PHI and PII stored on any external server is stored as encrypted values. 4 SHALL Unless PHI and PII has been transmitted to a data set maintained by a Health Plan or Health Provider, the account holder can delete information collected through the app, including data generated by a device associated with the app. 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.4 Security for Data at Rest 1 PHI and PII stored on a smartphone is stored as encrypted values. 3 SHALL PHI and PII stored on any external server is stored as encrypted values. 4 Unless PHI and PII has been transmitted to a data set maintained by a Health Plan or Health Provider, the account holder can delete information collected through the app, including data generated by a device associated with the app. 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.5 Security for Data in Transit 1 SHALL PHI and PII transmitted between an app and an external data source, including data generated through a device associated with the app, is transmitted as encrypted values. 3 4 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.5 Security for Data in Transit 1 PHI and PII transmitted between an app and an external data source, including data generated through a device associated with the app, is transmitted as encrypted values. 3 4 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C:
3.6 Data Authenticity, Provenance and Associated Metadata 1 SHALL Apps conform to Best Practices for Data Authenticity, Provenance, and Associated Metadata (This will require an Appendix and a testing reference such as Drummond Group?) 3 SHALL [IF} [App itself originates data <see draft ISO 21089 definition of originate>] Customer has review option which includes the option to irreversibly destroy, reject or discard data. 4 SHALL [IF} [App itself only receives data as a “pass through” and cannot store data] Customer has a review option to display the data prior to executing the pass-through which includes the option to irreversibly stop and block the pass-through. 5 SHALL [IF] [App itself receives data and stores it] Customer has a review option that permits only appending data and/or free text comments to received data as author while preserving the original received data intact with original provenance. 6 (Others to follow if not deemed too much of a reach…) 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.7 In-app Payments 1 Shall In-app payments are not required in order for the app to provide its main functions. 2 Shall [IF] [App permits in-app payments] The benefits for paying for a service or feature are clearly stated in a manner which allows an account holder to make an informed decision about making or declining an in-app payment. 3 4 5 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: