The healthcare industry is currently undergoing many changes, not only in medicine but also in the information technology that serves as the underpinning of healthcare delivery. In fact, advancement in IT and electronic health records (EHRs), as well as reinforcement of professional collaboration (mentoring) and of telemedicine is leading to numerous new complexities. Electronic information is everywhere, often in more than one place at a time, and shall be accessed from everywhere thus making increasingly difficult to keep sensitive healthcare information well protected. This has led regulatory bodies in every part of the world to iron out new regulatory texts which businesses in the healthcare industry shall be compliant with. Among them, one can cite the following regulations that already cover a broad range of rules impacting the privacy and security of healthcare data. e.g.:

• Health Information Patient Accountability Act (HIPAA) see [25]
• Health Information Technology for Economic and Clinical Health (HITECH) see [26]
• General Data Protection Regulation (GDPR) see [24]

A strong underlying principle in those regulations, is that natural persons, whatever their nationality or residence, have fundamental rights and freedoms, in particular the right to the protection of their personal data. A good level of protection is provided when privacy is ensured by design or default, meaning that data protection measures are implemented across all data processing activities and endpoints and in accordance to the level of criticality of that data. As an example, "medical health," "genetic data" and "biometric data" are subject to a higher standard of protection than personal data in general. Then, security traditionally includes the attributes of "Confidentiality", "Integrity" and "Availability" but recently has been also focused on "Auditability" to demonstrate to regulators that patient safety and privacy is maintained throughout entire processing and transporting chain. Compliance and regulatory expectations demand that data access and transfer be therefore well defined and documented.

In the field of data security, the following roles are often defined:

• Controllers: natural or legal person that is responsible for handling the whole data life cycle and will have to establish or amend technical and organizational measures to ensure and prove that the processing of personal data fully complies with regulatory requirements. In practise, controllers can be e.g. hospitals, health houses or physicians…
• Processors: natural or legal person that processes medical data. A processor is required to maintain records of all its processing activities and to maintain disclosure readiness of this information to show compliance. A processor could be for instance a cloud provider offering services to a controller for data storage and processing.

In the process of transporting medical data over a 5G network, in particular if the mobile operator is responsible for any key material that can be used to decrypt the medical data, or is otherwise involved in storing or adjusting the data, then this would involve assigning a processor role to telecom operators. Also, if the operator did not provide sufficient safeguards to protect data loss or if the operator lacks behind in fixing known security holes and vulnerabilities, they may be held accountable by health data controllers and processors. Interactions between data subjects, regulators, controllers and processors are shown on the picture below:

For more information on general data requirements from regulatory bodies, see Annex A.

[7.1-1] [7.1-2] [7.1-3] [7.1-4] [7.1-5]

 

 

As a general rule, organizations involved in controlling and/or processing the data have to be careful with the data and exact in knowing where it is being stored, how it is being processed and whether consent has been given. Parsing national regulations along those lines for general data management requirements in light of the role models explained in clause 6.2, leads to the following mapping of high-level requirements on the involved actors.

Requirements	Controllers	Processors	Comment
Explicit Consent: data subjects to explicitly give their consent (declaratory statement or opt-in tick box) for processing their medical, genetic or biometric data	X
Right to Data Portability: data subjects to have their personal data sent back to them to transmit elsewhere more easily	X
Right to Be Forgotten: data subjects to have their personal data erased without undue delay	X
Right to rectification: data subjects to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her	X
Right to restriction of processing: data subjects to obtain from the controller restriction of processing under certain circumstances	X
Subject Access Rights, the request to access data must be addressed quickly (less than one month)	X
Appointment of a Data Protection Officer where medical, genetic or biometric data is processed in a large scale	X	X
Data Protection Impact Assessment: risk assessment of the impact of anticipated processing activities on personal, medical, genetic or biometric data	X	X	For telcos, this implies a certain level of security policies parametrization in order to cope with different type of data
Mandatory data breach reporting: breaches must be reported to a data protection regulator within 72 hours, and those affected by the breach must also be informed.	X	X
Anonymization: the method of processing personal data in order to irreversibly prevent identification.	X	X
Data confidentiality: protection of data from being accessed by unauthorised parties through e.g. pseudonymization and/or encryption of personal data	X	X
Data Integrity: maintenance of the accuracy and consistency of data throughout its entire life cycle	X	X
Integrity, availability and resilience of processing systems and services against accidental loss, destruction or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data	X	X	For telcos, this requirement leads to the need of having self-assessment of systems related to their ability to process the data according to regulatory rules
Existence of a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing	X	X	For telcos this means the ability to monitor and assess security policies and their efficiency
Traceability: care providers to determine the initial source of the data, and what happened to it through its various locations and transformations.	X	X	For telcos this implies enhanced logging capabilities for highly secured communication services