Audit in Estonia from 12 to 16 March 2018 in order to addedd the National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network

Ref. Ares(2018)2524603 - 15/05/2018 k EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY ***** ■k k k k k. ,* ■k*/k Health and food audits and analysis Director Grange, SANTE.F5 WR/ams Subject: Reference number: DG(SANTE)/2018-6522 - MR Audit in Estonia from 12 to 16 March 2018 in order to assess the National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network Dear Ms Reinhold, I enclose a copy of the final report (ref. no. DG(SANTE)/2018-6522 - MR) of the above- mentioned audit. I would like to acknowledge receipt of your letter of 26 April 2018 (ref. 6- 2/12-5) in response to the draft audit report, and I am also enclosing a table detailing how each of the comments made by your services has been taken into account in the production of the final report. I would like to take this opportunity to ask you to thank all the personnel who were involved in this audit for the assistance and co-operation shown to the team. The attached table contains the recommendations made following the above audit. I would be grateful if you could complete the table and return it to me by mail with 15 days of receipt of the final report, in accordance with the Audit Framework agreed at the eHMSEG meeting of December 2017. The Commission services are committed to a process of continuous improvement of their operations and activities and therefore, feedback from auditees is an important tool in helping us to achieve this objective. I would be grateful if you would arrange for your services to submit feedback on the audit process online using the following link https://ec.europa.eu/eusurvey/runner/FVO- FeedbackQuestionnaire-MS. In particular, I would encourage you to provide additional information by completing the comment boxes. This is especially useful, from our perspective, where your assessment of any statement is "disagree" or "strongly disagree". Your comments will be extremely useful in feeding into the Directorate-General for Health and Food Safety's continuous review of its processes, aimed at ensuring that audits are Ms Katrin Reinhold Director Health and Welfare Information Systems Centre (HWISC) Veerenni 13/Uus-Tatari 25 10134 Tallinn Estonia European Commission, Grange, Dunsany C15 DA39 , Co. Meath, Ireland - Office: GRAN 01/096 Tel.: direct line (+353 46) 9061 962, internal n°: 70962, switchboard: (+353 46) 9061 700. Fax: (+353 46) 9061 705 performed to the highest standards. The information provided by you will be treated in the strictest confidence. Please note that you will need to enter the password FVO$fb22454MS to access the online survey and only one response may be entered in respect of each audit. I would be grateful if you could ensure that the reference number quoted above is used in all correspondence. Yours sincerely, ftóbti &S Paola Colombo Director Enel. : Report DG(SANTE)/2018-6522 - MR Table for competent authority response to recommendations Commission services' response to competent authority comments on draft report Ref. Ares(2018)2524603 - 15/05/2018 Commission services' response to the competent authority's comments on draft report DG (SANTE)/2018-6522–in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network 3 May 2018 Reference in draft (Short description) Competent Commission services' Action in response to competent report authority's comments comments authority's comments Accepted Not Page Section Text Footnote accepted amended (no.) 6, 11 5.5, 8 To add to finding no 25 and to reflect in The suggested text gives a X recommendation 25, text from the Estonian self- description of actions that will be assessment, that feedback will be collected via a single taken. The plan to retain a single contact point for Estonian health care professionals. contact point is in line with ITIL. However, future actions are to be stated in the action plan while the audit report describes the situation at the time of the audit. Finding 25 correctly describes the situation as seen during the audit. 4, 9 5.3, 8 To align finding no 11 and recommendation no 11. The Finding 11 relates to two X finding states that the change management procedure readiness criteria (OS.11 and 12). should cover all changes, whilst the recommendation limits the focus on correcting the underlying cause of OS.12 relates to the need for a incidents/problems. documented change management process or procedure; OS.11 requires that changes resulting from incident and problem management are addressed through the change management 1 Commission services' response to the competent authority's comments on draft report DG (SANTE)/2018-6522–in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network 3 May 2018 Reference in draft (Short description) Competent Commission services' Action in response to competent report authority's comments comments authority's comments Accepted Not Page Section Text Footnote accepted amended (no.) procedure. The finding that change management is limited to software development orders means that the change management procedure is incomplete. The finding and recommendation are amended to reflect this. III Definitions The report explains the abbreviation eHMSEG as The Solution Provider (SANTE X „eHealth Digital Service Infrastructure Member State A4) advised the audit team that Expert Group“, however according to the Governance the correct term to be used for model for the eHDSI, adopted by the eHealth Network, eHMSEG is: the abbreviation is defined as „eHealth Member State Expert Group“ Reference: eHDSI Glossary, "eHDSI Member States Expert https://ec.europa.eu/cefdigital/wiki/display/EHOPERAT Group" IONS/eHDSI+Glossary according to the approved governance document, page 10: 2 Commission services' response to the competent authority's comments on draft report DG (SANTE)/2018-6522–in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network 3 May 2018 Reference in draft (Short description) Competent Commission services' Action in response to competent report authority's comments comments authority's comments Accepted Not Page Section Text Footnote accepted amended (no.) https://ec.europa.eu/cefdigital/wik i/display/EHOPERATIONS/eHD SI+Governance?preview=/35210 447/41287688/ev_20161121_co0 6_en.pdfhttps://ec.europa.eu/cefdi gital/wiki/display/EHOPERATIO NS/eHDSI+Governance?preview =/35210447/41287688/ev_20161 121_co06_en.pdf 3 Ref. Ares(2018)2524175 - 15/05/2018 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY Health and food audits and analysis DG(SANTE) 2018-6522 FINAL REPORT OF AN AUDIT CARRIED OUT IN ESTONIA FROM 12 MARCH 2018 TO 16 MARCH 2018 IN ORDER TO ASSESS THE ESTONIAN NATIONAL CONTACT POINT FOR eHEALTH'S READINESS FOR JOINING THE CROSS BORDER eHEALTH INFORMATION SERVICES NETWORK In response to information provided by the competent authority, any factual error noted in the draft report has been corrected.  Executive Summary This audit took place in Estonia from 12 to 16 March 2018 and was undertaken at the request of the Health and Welfare Information Systems Centre (HWISC), which operates the Estonian National Contact Point for eHealth (NCPeH). The objective of the audit was to assess the readiness of this NCPeH to join the Cross-Border eHealth Information Services network. Although the NCPeH organisation is well advanced in complying with the readiness criteria pertinent to semantics and technical interoperability, substantial work remains to be done in the areas of contractual compliance, organisation, service operations and information security. The absence of a legal basis to operate in the cross-border exchange of health data means that the NCPeH organisation cannot demonstrate its accountability towards its stakeholders at national and European Union level. Gaps identified in the information security policies and in their implementation, pose significant risks to safeguarding the confidentiality and integrity of patient data. The lack of an implemented service management plan also creates significant risks, in particular for the availability of services during routine operations. The report contains recommendations to the Estonian NCPeH organisation aimed at rectifying the shortcomings identified. I Table of Contents 1 Introduction ....................................................................................................................................1 2 Objectives and scope......................................................................................................................1 3 Readiness criteria ...........................................................................................................................1 4 Background ....................................................................................................................................1 5 Findings and Conclusions ..............................................................................................................2 5.1 Contractual compliance ...........................................................................................................2 5.2 Organisation ............................................................................................................................3 5.3 Operations and services ...........................................................................................................4 5.4 Information security ................................................................................................................5 5.5 Semantics.................................................................................................................................6 5.6 Technical .................................................................................................................................7 6 Overall Conclusion.........................................................................................................................7 7 Closing Meeting .............................................................................................................................7 8 Recommendations ..........................................................................................................................8 II ABBREVIATIONS AND DEFINITIONS USED IN THIS REPORT Abbreviation Explanation CBeHIS Cross Border eHealth Information System eDispensation Electronic data on a dispensed medication eHealth The use of ICT for health eHDSI eHealth Digital Service Infrastructure eHMSEG eHDSI Member State Expert Group ePrescription Electronic Prescription EU European Union Finding: is evidence regarding the state of a conformity or non-conformity with the readiness criteria Major finding: is evidence of a non-conformity with the readiness criteria which constitutes a potential risk to information confidentiality, integrity or availability, and therefore weakens the reliability of the NCPeH and/or the Finding CBeHIS Network. Combined major findings may constitute a critical finding Critical finding: is evidence of non-conformity with the readiness criteria which constitutes a significant risk to information confidentiality, integrity or availability, and therefore undermines the reliability of the NCPeH and/or the CBeHIS Network GDPR General Data Protection Regulation HWISC Health and Welfare Information Systems Centre ICT Information and communication technologies KPI Key Performance Indicator NCPeH National Contact Point for eHealth Responsibility assignment matrix (Responsible, Accountable, Consulted, RACI matrix Informed) III 1 INTRODUCTION This audit took place in Estonia from 12 to 16 March 2018 and was undertaken at the request of the Health and Welfare Information Systems Centre (HWISC), which operates the Estonian National Contact Point for eHealth (NCPeH), eHealth meaning the use of information and communication technologies (ICT) for health. The audit team comprised four auditors from the European Commission. An opening meeting was held in Tallinn on 12 March 2018 with representatives from the HWISC. At this meeting the audit team confirmed the objectives of and schedule for the audit. In the course of the audit, the team also met with a representative of the Ministry of Social Affairs. 2 OBJECTIVES AND SCOPE The objective of the audit was to assess the readiness of the NCPeH for joining the Cross Border eHealth Information System (CBeHIS) network, by verifying compliance with the readiness criteria agreed by the eHealth Digital Service Infrastructure (eHDSI) Member State Expert Group (eHMSEG). Particular emphasis was given to verifying that appropriate policies and processes are in place, are communicated throughout the organisation, and are being implemented in order to preserve the confidentiality, integrity and availability of information. The scope of the audit covered the organisation of the NCPeH and its activities in relation to the service implemented, this being ePrescription country B (country of dispensation), including activities carried out by sub-contracted parties. 3 READINESS CRITERIA The criteria against which the NCPeH was audited are laid down in the readiness criteria checklist (version 1.19) approved by the eHMSEG on 18 December 2017. 4 BACKGROUND On 28 February 2018, the director of the HWISC submitted a request for an initial audit of this organisation as the NCPeH of Estonia, for the service ePrescription country B. This means that Estonia intends to receive ePrescriptions from other European Union (EU) Member States 1, based on which medicines could be dispensed to EU citizens at any of the 371 registered Estonian pharmacies. EU citizens who could avail of this service will come from Member States which are preparing for the service ePrescription country A. These are Croatia, Finland and Portugal in 2018. 1 References to 'Member States' should be understood as referring to EU Member States and other countries which participate in the CBeHIS Network. 1 The audit request was accompanied by a self-assessment, based on the readiness criteria checklist, and supporting documentation. The HWISC is an agency under the umbrella of the Ministry of Social Affairs of Estonia. It was founded on 1 January 2017 as a competence centre for ICT in the health, social protection and labour field, consolidating the roles and responsibilities of the former ICT department of the Ministry of Social Affairs and the Estonian eHealth Foundation. The main responsibilities of the HWISC include: the development of information systems, databases and e-services; the maintenance of services and infrastructure; the provision of information security; and the analysis of data to support policy making, reporting, productivity monitoring and supervision. Estonia already has a system in place for electronic health records and electronic prescriptions for its citizens. According to the HWISC, almost 100% of prescription medicines are dispensed with domestically issued ePrescriptions. 5 FINDINGS AND CONCLUSIONS The terms critical finding and major finding used in this report are defined in the eHealth Audit Framework (version 1.1.0) approved by the eHMSEG on 18 December 2017; for ease of reference, the terms are described in the table of abbreviations and definitions. Conclusions of the report aim at highlighting the impact of the findings. The report focuses on the readiness criteria potentially leading to critical and major findings and which were not satisfactorily met by the NCPeH. In contrast, readiness criteria for which the NCPeH demonstrated compliance are not (or are only superficially) discussed in the report. 5.1 CONTRACTUAL COMPLIANCE This section deals with the legislative and contractual provisions necessary for the organisation to operate as an NCPeH in cross-border health services. Findings The HWISC is a legal entity, competent to contract with suppliers and health care organisations concerning the provision of services at national level. Appropriate contractual arrangements have been made with its suppliers. Nevertheless, the audit team established the following critical and major findings: 1. C.1 [critical]: Current legislation does not designate the HWISC as the national organisation responsible for exchanging ePrescriptions with other Member States. The HWISC as well as the Ministry of Social Affairs, informed the audit team that (changes to) four pieces of legislation are under preparation, all of which are needed to empower the HWISC to fulfil its role in exchanging ePrescription data with other EU Member States. The HWISC anticipates the legislation to be ready by June 2018. 2 2. C.4 [critical]: The HWISC is currently not empowered to make contracts with pharmacies for the cross-border exchange of ePrescriptions. After the legislation referred to in finding 1 will come into force, the HWISC intends to make contracts with all 371 Estonian pharmacies for the cross-border exchange of ePrescriptions. The HWISC helpdesk is responsible for making contractual arrangements with healthcare organisations. 3. C.6 and 7 [major]: The HWISC is annually consulted by the Ministry of Social Affairs on proposed changes to national legislation that could have an impact on services development and financial resources. However, within the HWISC there is no documented procedure ensuring a collection and evaluation of legislative changes that may impact on the organisation. Although, the HWISC performs a legal impact assessment while preparing software development work orders, this does not take into account possible impacts on its wider organisation. Within the organisation, information on legislative changes is disseminated on an ad-hoc basis, but there is no structured mechanism in place ensuring that staff are aware of the legislation relevant to their tasks. The audit team noted that an impact assessment of the General Data Protection Regulation2 (GDPR), led by the Ministry for Social Affairs, had not been completed, and that knowledge of this Regulation as well as its potential impact on the organisation was rudimentary within the HWISC. 4. C.9 [critical]: The roles of data processors and data controllers for the cross-border exchange of ePrescriptions have not been unambiguously identified. The data protection impact assessment (mandatory when the GDPR enters into force on 25 May 2018) should clarify the roles, but has not yet been completed. Conclusions on contractual compliance The absence of a legal basis for the HWISC to operate as an NCPeH in the cross-border exchange of ePrescriptions, and ambiguity as to the identity of the data controller role for these services, means that the organisation currently cannot demonstrate its accountability towards its stakeholders at national and EU level. 5.2 ORGANISATION This section contains an assessment of the compliance with the readiness criteria relating to the organisational measures ensuring the effective operation of the NCPeH. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. OJ L 119, 4.5.2016, p. 1. 3 Findings The audit team noted that the HWISC has a clear organisational structure outlined in an organigram and a recently prepared responsibility assignment (RACI) matrix. Nevertheless, the audit team established the following critical and major findings: 5. O.11 [major]: The HWISC does not monitor the key performance indicators (KPIs) as laid down in the eHealth Digital Service Infrastructure (eHDSI) Monitoring Framework, these being uptime and number of transactions. Although actual monitoring could be seen as premature as long as the NCPeH has not joined the CBeHIS network, the audit team noted that the available monitoring tools have not been configured for the cross- border exchange of health data. 6. O.13 [critical]: The HWISC has no security clearance policy for staff in security sensitive positions. A basic level of required competencies and duties for different roles is referred to in vacancy announcements and labour contracts. However, staff have no written job descriptions, detailing their roles and responsibilities. Conclusions on organisation Notwithstanding the clear organisational structure of the HWISC, the absence of a security clearance policy, in particular linked to security-sensitive roles, poses a risk to the confidentiality and integrity of data processed by them. 5.3 OPERATIONS AND SERVICES This section contains an assessment of the compliance with the readiness criteria relating to service operations management. Findings Operations management for cross-border services are under development. The audit team established the following critical and major findings: 7. OS.1 [critical]: According to the HWISC, they do not have a service-driven management plan. They presented to the audit team a recently drafted service operation plan. The audit team noted that this plan had not been endorsed by senior management and that, to a large extent, it did not reflect the current working practices in the organisation. 8. OS.5 [critical]: The HWISC has informal communication channels with other EU Member States, but has no established formal communication processes. 9. OS.6 [major]: The HWISC does not monitor service levels of suppliers against agreed targets. 10. OS.8 [critical]: The HWISC has an incident management procedure in place. However, the audit team noted that the procedure was not configured to handle cross-border service 4  incidents. The incident management procedure outlined in the recently drafted service operation plan for cross-border services has not been implemented. 11. OS.11 and 12 [critical]: The scope of the current change management practice of the HWISC as well as the change management procedure described in the newly drafted service operations plan is limited to software development orders only. Changes not pertaining to software, such as hardware and organisational changes, are not addressed through change management. 12. OS.21 [major]: The HWISC tool for monitoring capacity is not configured for the cross- border IT services. Moreover, capacity trends are not monitored. 13. OS.24 [major]: The HWISC has no procedure to recover back to normal operations in case of disruption. Conclusions on operations and services The lack of an implemented service management plan creates risks, in particular for the availability of services during routine operations. 5.4 INFORMATION SECURITY This section contains an assessment of the compliance with the readiness criteria relating to information security policies, security controls and security incident management. Findings The HWISC demonstrated awareness of information security controls relevant to the cross- border exchange of health data. The HWISC shared with the audit team its plans for addressing already known shortcomings. Nevertheless, the audit team established the following critical and major findings: 14. IS.2 and 29 [critical]: The HWISC has implemented an information security management system based on the IT baseline security system “ISKE”, which is compulsory for all Estonian state database processors. However, the HWISC could not demonstrate to the audit team how the ISKE controls would give effect to each of the eHDSI policies. 15. IS.3 [critical]: The HWISC has not performed a business impact and risk assessment on which controls to implement for ensuring the required security policies. 16. IS.4 and 10 [critical]: The HWISC has a list of ISKE security controls. However, the audit team noted that these controls are not assigned to the assets relevant to the cross- border exchange of health data. 17. IS.6 [critical]: The HWISC has not documented the trust models applicable to the cross- border exchange of health data. Documenting trust models is important to ensure that no cross-border data could be transmitted to an entity outside the CBeHIS network. 5 18. IS.7 [critical]: The HWISC did not provide evidence to the audit team of an implemented system for collecting, analysing storing and retaining audit trails and logs. 19. IS.11 [major] The HWISC has no business-continuity plan the cross-border exchange of health data. 20. IS.12 [critical]: The HWISC has no disaster recovery plan for the cross-border exchange of health data. 21. IS.20 [major]: The HWISC indicated that the information security policy of the Ministry of Social Affairs establishes that data processing must be done according to the law and should be protected against unauthorised access. However, the HWISC could not demonstrate to the audit team how this policy specifically safeguards personally identifiable information in the cross-border exchange of ePrescriptions. In this context, the HWISC has not completed the data protection impact assessment as required by the GDPR. 22. IS.24, 25 and 26 [critical]: The HWISC has documented procedures for managing the access rights to information systems. Access rights are granted on a need to know basis by the helpdesk. However, the procedures do not define what level of access is necessary for what role or task. Moreover, the information security officer does not have an overview of the access rights granted. 23. IS.28 [critical]: The HWISC did not demonstrate how the non-repudiation evidence produced during cross-border exchange of health data are managed under information security policies. 24. IS.31 [critical]: The HWISC operations management does not ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications. Conclusions on information security Gaps identified in the information security policies and implementation, pose risks to the confidentiality of the data exchanged in cross-border health services. 5.5 SEMANTICS This section contains an assessment of the compliance with the readiness criteria relating to semantic interoperability applicable to ePrescription and eDispensation country B. Findings Semantic interoperability policies, procedures and asset management are well advanced to cope with the demands of routine operations. Nevertheless, the audit team established the following critical finding: 6 25. SI.9 [critical]: The service desk is not equipped to accommodate health care professionals’ feedback on the meaning and clarity of ePrescriptions received from other Member States. Conclusions on semantics The HWISC is well prepared for semantic interoperability, with the exception of the service/help desk function. 5.6 TECHNICAL This section contains an assessment of the compliance with the readiness criteria relating to the technical gateway, national connector and national infrastructure. Findings The HWISC demonstrated that the procedures related to technical assets were documented and implemented accordingly. Nevertheless, the audit team established the following critical finding: 26. T.6 [critical]: A procedure is not in place to monitor the expiration date of the electronic certificates used in the cross-border exchange of health data. Conclusions on technical The HWISC is well prepared to meet the criteria for technical inter-operability during routine operations, with the exception of the monitoring of electronic certificate expiry dates. 6 OVERALL CONCLUSION Although the NCPeH organisation is well advanced in complying with the readiness criteria pertinent to semantics and technical interoperability, substantial work remains to be done in the areas of contractual compliance, organisation, service operations and information security. The absence of a legal basis to operate in the cross-border exchange of health data means that the NCPeH organisation cannot demonstrate its accountability towards its stakeholders at national and EU level. Gaps identified in the information security policies and in their implementation, pose significant risks to safeguarding the confidentiality and integrity of patient data. The lack of an implemented service management plan also creates significant risks, in particular for the availability of services during routine operations. 7 7 CLOSING MEETING The audit team presented all critical and major findings at the closing meeting. The HWISC accepted these findings and acknowledged that work remains to be done in order to comply with the readiness criteria. 8 RECOMMENDATIONS The HWISC is invited to provide details of the actions taken and planned, including deadlines for their completion (‘action plan’), aimed at addressing the recommendations set out below, within 15 working days of receipt of this audit report No. Recommendation 1. To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2. To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3. To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impact assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4. To identify clearly the responsible data controller and data processors for cross-border health data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5. To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 8 No. Recommendation 6. To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 7. To put in place the Service (Level) Management Plan, in line with readiness criterion OS.1. Associated finding: No 7 8. To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9. To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10. To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11. To put in place a documented change management procedure that covers all potential changes, in line with readiness criteria OS.12 and OS.11. Associated finding: No 11 12. To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with readiness criterion OS.21. Associated finding: No 12 13. To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 9 No. Recommendation 14. To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 15. To carry out a business impact and risk assessment on which controls have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpose (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16. To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross-border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17. To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18. To put in place an appropriate system of collecting, analysing, storing and retaining audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19. To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20. To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 10 No. Recommendation 21. To put in place documented policies defining how personally identifiable information is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22. To define the various roles and responsibilities related to information security management and ensure that users are assigned only the necessary rights for performing their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23. To ensure the non-repudiation of cross health data exchanged across the border, in line with readiness criterion IS.28. Associated finding: No 23 24. To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25. To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26. To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 11 N° Recommendation Action Proposed by the competent authority 1 To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2 To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3 To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impac t assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4 To identify clearly the responsible data controller and data processors for cross-border h ealth data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5 To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 6 To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 7 To put in place the Service (Level) Management Plan, in line with readiness criterion OS.1. Associated finding: No 7 8 To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9 To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10 To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11 To put in place a documented change m anagement procedure that covers all potential changes, in line with readiness criteria OS.12 and OS.11. Associated finding: No 11 12 To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with read iness criterion OS.21. Associated finding: No 12 13 To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 14 To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 15 To carry out a business impact and risk assessment on which controls have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpos e (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16 To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross-border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17 To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18 To put in place an appropriate system of collecting, analysing, storing and retain ing audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19 To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20 To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 21 To put in place documented policies defining how personally identifiable in formation is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22 To define the various roles and responsibilities related to information security management and ensure that users are assigned only the necessary rights for pe rforming their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23 To ensure the non-repudiation of cross health data exchanged across the border, in line with readines s criterion IS.28. Associated finding: No 23 24 To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25 To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26 To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 Ref. Ares(2018)2524603 - 15/05/2018 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority 1 To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2 To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3 To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impact assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4 To identify clearly the responsible data controller and data processors for cross-border health data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5 To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 6 To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 7 To put in place the Service (Level) Management Plan, in line with Date: 07 May 2018 Page: 1 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority readiness criterion OS.1. Associated finding: No 7 8 To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9 To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10 To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11 To put in place a documented change management procedure that covers all potential changes, in line with readiness criteria OS.12 and OS.11. Associated finding: No 11 12 To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with readiness criterion OS.21. Associated finding: No 12 13 To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 14 To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 Date: 07 May 2018 Page: 2 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority 15 To carry out a business impact and risk assessment on which controls have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpose (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16 To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross-border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17 To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18 To put in place an appropriate system of collecting, analysing, storing and retaining audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19 To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20 To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 21 To put in place documented policies defining how personally identifiable information is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22 To define the various roles and responsibilities related to information Date: 07 May 2018 Page: 3 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority security management and ensure that users are assigned only the necessary rights for performing their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23 To ensure the non-repudiation of cross health data exchanged across the border, in line with readiness criterion IS.28. Associated finding: No 23 24 To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25 To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26 To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 Date: 07 May 2018 Page: 4