Identity Protection and Pseudonymisation White Paper Proposal for 2008/09 presented to the IT Infrastructure Technical Committee A. Estelrich (GIP-DMP) S. Bittins (Fraunhofer ISST) 18th of November, 2008

IT Infrastructure Technical Committee Editors Ana Estelrich (GIP-DMP)Ana Estelrich (GIP-DMP) Prof. Klaus Pommerening (University of Mainz)Prof. Klaus Pommerening (University of Mainz) Sebastian Semler (TMF e.V.)Sebastian Semler (TMF e.V.) Sören Bittins, Jörg Caumanns (Fraunhofer ISST)Sören Bittins, Jörg Caumanns (Fraunhofer ISST)

IT Infrastructure Technical Committee Motivation Pseudonymisation is often only considered as interesting for second use scenarios but primary cases are also interestingPseudonymisation is often only considered as interesting for second use scenarios but primary cases are also interesting Primary use scenarios:Primary use scenarios: –Pseudonymisation as a potential security mechanism –Reducing the actual protection requirement by decoupling the concrete patient’s identity from the health information Secondary use scenarios (clinical research, public health):Secondary use scenarios (clinical research, public health): –Data leaves the context of the physician where they are protected by professional discretion –The utilisation of anonymisation/pseudonymisation means is mandatory for secondary use scenarios –The concrete identity of the patient is often of no interest

IT Infrastructure Technical Committee Motivation (II) In order to derive solution patterns for a flexible implementation, several models needs to be created and consideredIn order to derive solution patterns for a flexible implementation, several models needs to be created and considered Six models are suggested covering a selection of primary and secondary use casesSix models are suggested covering a selection of primary and secondary use cases

IT Infrastructure Technical Committee Pseudonymisation Models Model 0: Identity Protection for Primary UseModel 0: Identity Protection for Primary Use –Incorporates encryption & pseudonymisation for identity protection Model 1: Identity RemovalModel 1: Identity Removal –For one-time secondary use –Identity is completely anonymised (e. g. for research purposes) Model 2: Multiple data sources, one-time secondary useModel 2: Multiple data sources, one-time secondary use –Aims at linking multiple sources (e. g. XDS registries, repositories) –Incorporates one-way pseudonyms and encryption –= the secondary user cannot tell the identity but can read the data –Purpose: cancer registry

IT Infrastructure Technical Committee Pseudonymisation Models Model 3: One-Time secondary use with re-identificationModel 3: One-Time secondary use with re-identification –Incorporates two TTP, one for substituting the concrete identity, one for the actual pseudonymisation –The PID service knows the identity of the patient but contains no data –The PSEUD service can recover the PID by decrypt the PSN but does not know the concrete identity Model 4: Pseudonymous Research Data PoolModel 4: Pseudonymous Research Data Pool –Is based on Model 3 but incorporates a data pool for research –Pseudonym and medical data are permanently stored in the data pool Model 5: Central DB with many secondary usesModel 5: Central DB with many secondary uses –Potential for research involving a central (clinical) database –The clinical database contains medical data but no identities –Concrete reference to the pseudonymised medical data is established over a TTP being able to assign a PID that is connected to the data

IT Infrastructure Technical Committee Flow-of-Data (Model 2)

IT Infrastructure Technical Committee Outline Identity Protection, Pseudonymisation, Anonymisation (2-3 pages)Identity Protection, Pseudonymisation, Anonymisation (2-3 pages) Pseudonymisation Models (Use Cases) (5-10)Pseudonymisation Models (Use Cases) (5-10) Building Blocks (10-20)Building Blocks (10-20) Implementation and Deployment (10-15)Implementation and Deployment (10-15) Security Considerations (2-4)Security Considerations (2-4) Outline of a privacy Framework (2-4)Outline of a privacy Framework (2-4) Application of Pseudonymisation onto content profiles from PCC and QRPH (4-8)Application of Pseudonymisation onto content profiles from PCC and QRPH (4-8)

IT Infrastructure Technical Committee Standards and Systems ISO TC 215 Pseudonymisation for health InformaticsISO TC 215 Pseudonymisation for health Informatics TMF Pseudonymisation FrameworkTMF Pseudonymisation Framework OASIS WSFEDOASIS WSFED

IT Infrastructure Technical Committee IHE Profile Grouping XUA: for user authenticationXUA: for user authentication XPP: for authorising access to pseudonym generationXPP: for authorising access to pseudonym generation XDS: for secondary use databasesXDS: for secondary use databases XDS: as a prominent example of health resources that can be safeguarded by pseudonyms (primary use)XDS: as a prominent example of health resources that can be safeguarded by pseudonyms (primary use) ATNA: for mutual node authentication and audit trailsATNA: for mutual node authentication and audit trails PIX/PDQ: for providing patient identifiers and attributesPIX/PDQ: for providing patient identifiers and attributes

IT Infrastructure Technical Committee Expected Acceptance Data protection and extended liability issues are gradually moving into the focusData protection and extended liability issues are gradually moving into the focus Cooperative health care networks have a extremely strong demand for compliant solutionsCooperative health care networks have a extremely strong demand for compliant solutions This profile provides essential building-blocks for designing those solutionsThis profile provides essential building-blocks for designing those solutions The eCR Initiative is currently providing and using various of the components presented here for full complianceThe eCR Initiative is currently providing and using various of the components presented here for full compliance Significant potential for cross-border usabilitySignificant potential for cross-border usability May serve as a foundation for a pan-European identity protection frameworkMay serve as a foundation for a pan-European identity protection framework