Re: GDPR and OpenEhr.

2018-09-03 Thread Bert Verhees
In all other contexts the patient can never be forgotten or deleted. Any > legal transaction is subject to archiving laws. For tax purposes the time > period is 5 years in the Netherlands, I think. Only after these periods as > defined by law the transactions can/must be deleted. > It is true

Re: GDPR and OpenEhr.

2018-09-03 Thread Karsten Hilbert
On Mon, Sep 03, 2018 at 03:19:04PM +0200, Bert Verhees wrote: > Karsten, you are right, a clinician, in the most countries is obliged to > keep an EHR. But the law does mostly not say he must keep it at his own > office. So if it is kept at Google or Microsoft, or some smaller PHR > provider, I

Re: GDPR and OpenEhr.

2018-09-03 Thread Bert Verhees
Karsten, you are right, a clinician, in the most countries is obliged to keep an EHR. But the law does mostly not say he must keep it at his own office. So if it is kept at Google or Microsoft, or some smaller PHR provider, I think this is fine according to the law, but still some law-changes may

Re: GDPR and OpenEhr.

2018-09-03 Thread GF
Dear colleagues, GDPR as I understand it and apply in the Netherlands gives consumers/patients several rights: inspect, change, to be forgotten. An other important topic is: the goal binding of data. Only absolutely necessary data needed to execute a specified task can be collected. With

Re: GDPR and OpenEhr.

2018-09-03 Thread Jan-Marc Verlinden
Normal process in healthcare: - The patient comes in and signs an informed consent. This is the place where the Hospital states it has to keep the records for a zillion years. Check https://gdpr-info.eu/art-6-gdpr/ - Then after a while the patient thinks "let's delete my data at the Hospital" :-),

Re: GDPR and OpenEhr.

2018-09-03 Thread Karsten Hilbert
On Mon, Sep 03, 2018 at 01:08:41PM +0200, Bert Verhees wrote: > So, on medico-legal purposes as Ian and Karsten and maybe others referred > to, a patient, if he maintains his own PHR, and he likes to delete it, he > can never sue a clinician, because, he, himself, destroyed important > evidence.

Re: GDPR and OpenEhr.

2018-09-03 Thread Jan-Marc Verlinden
Think the GDPR already provides many answers...:-), see at https://gdpr-info.eu/art-17-gdpr/ In the case of a person ("data subject") not being able to take control; normally another person is appointed to do so on behalf of the "data subject". So the same law applies.. Cheers, Jan-Marc Op ma 3

Re: GDPR and OpenEhr.

2018-09-03 Thread Bert Verhees
It would be a bad thing to let all patients be restricted in their rights because one patient, suffering in the past from depression and having a recurring cancer can get into problems. Some people are emotionally unstable, they need protection. I don't know the best way, but I would think of

Re: GDPR and OpenEhr.

2018-09-03 Thread Bert Verhees
I promised to come back to some contributions. So, on medico-legal purposes as Ian and Karsten and maybe others referred to, a patient, if he maintains his own PHR, and he likes to delete it, he can never sue a clinician, because, he, himself, destroyed important evidence. For that reason, it is