Request for an Audit

Ref. Ares(2018)1992000 - 13/04/2018 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority 1 To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2 To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3 To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impact assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4 To identify clearly the responsible data controller and data processors for cross-border health data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5 To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 6 To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 7 To put in place the Service (Level) Management Plan, in line with readiness criterion OS.1. Associated finding: No 7 Date: 10 April 2018 Page: 1 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority 8 To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9 To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10 To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11 To put in place a documented change management procedure and ensure this procedure is used to correct the underlying cause of incidents/problems, in line with readiness criteria OS.11 and OS.12. Associated finding: No 11 12 To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with readiness criterion OS.21. Associated finding: No 12 13 To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 14 To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 15 To carry out a business impact and risk assessment on which controls Date: 10 April 2018 Page: 2 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpose (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16 To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross-border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17 To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18 To put in place an appropriate system of collecting, analysing, storing and retaining audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19 To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20 To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 21 To put in place documented policies defining how personally identifiable information is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22 To define the various roles and responsibilities related to information security management and ensure that users are assigned only the Date: 10 April 2018 Page: 3 ANNEX Response of the competent authorities of Estonia to the recommendations of report ref. DG(SANTE)/2018-6522-MR of the audit carried out from 12 March 2018 to 16 March 2018 in order to assess the Estonian National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network N° Recommendation Action Proposed by the competent authority necessary rights for performing their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23 To ensure the non-repudiation of cross health data exchanged across the border, in line with readiness criterion IS.28. Associated finding: No 23 24 To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25 To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26 To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 Date: 10 April 2018 Page: 4 Ref. Ares(2018)1992000 - 13/04/2018 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY Health and food audits and analysis Director Grange, SANTE.F5 WR/ams Subject: Reference number: DG(SANTE)/2018-6522 - MR Audit in Estonia from 12 to 16 March 2018 in order to assess the National Contact Point for eHealth's readiness for joining the Cross Border eHealth Information Services Network Dear Ms Reinhold, Following completion of the above-mentioned audit, I enclose a copy of the draft report, reference number: DG(SANTE)/2018-6522 - MR. I invite you to provide any comments that you may wish to make on the factual content, or other elements, of the draft report within 10 working days of receipt of this letter. Please note that comments should not be inserted into the text of the draft report but rather be provided in a separate annex to your reply, which should be sent by email to SANTE-F5- EĦEALTĦ@ec.europa.eu (please use the audit reference number in your correspondence). Upon receipt of your comments, if any, these will be taken into consideration and the report will be finalised within 10 working days. The audit team identified a number of non-conformities with the readiness criteria approved by the eHealth Digital Service Infrastructure Member State Expert Group on 18 December 2017, and you were informed of these during the audit and in the final meeting. The report contains therefore recommendations aimed at rectifying the shortcomings identified. I would be grateful if you could provide details of any actions taken or planned, including deadlines for their completion, to address these recommendations within 15 working days of receipt of the final report. The audit team took note of your comments, made during the audit, that some of the recommendations may also require action by other parties, such as the Ministry of Social Affairs of Estonia, the National Contact Points for eHealth of other Member States and the eHDSI Solution Provider. Ms Katrin Reinhold Director Health and Welfare Information Systems Centre (HWISC) Veerenni 13/Uus-Tatari 25 10134 Tallinn Estonia European Commission, Grange, Dunsany C15 DA39 , Co. Meath, Ireland - Office: GRAN 01/214 Tel.: direct line (+353 46) 9061 893, internal n°: 70893, switchboard: (+353 46) 9061 700. Fax: (+353 46) 9061 705 For your convenience, the recommendations have been annexed to this letter in a tabular format, with a column for your response. Yours sincerely, Paola Colombo Director Enel.: Report DG(SANTE)/2018-6522 - MR Table for response to recommendations N° Recommendation Action Proposed by the competent authority 1 To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2 To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3 To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impact assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4 To identify clearly the responsible data controller and data processors for cross-border health data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5 To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 6 To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 7 To put in place the Service (Level) Management Plan, in line with readiness criterion OS.1. Associated finding: No 7 8 To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9 To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10 To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11 To put in place a documented change management procedure and ensure this procedure is used to correct the underlying cause of incidents/problems, in line with readiness criteria OS.11 and OS.12. Associated finding: No 11 12 To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with readiness criterion OS.21. Associated finding: No 12 13 To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 14 To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 15 To carry out a business impact and risk assessment on which controls have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpose (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16 To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross - border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17 To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18 To put in place an appropriate system of collecting, analysing, storing and retaining audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19 To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20 To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 21 To put in place documented policies defining how personally identifiable information is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22 To define the various roles and responsibilities related to information security management and ensure that users are assigned only the necessary rights for performing their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23 To ensure the non-repudiation of cross health data exchanged across the border, in line with readiness criterion IS.28. Associated finding: No 23 24 To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25 To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26 To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 Ref. Ares(2018)1983566 - 13/04/2018 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY Health and food audits and analysis DG(SANTE) 2018-6522 DRAFT REPORT OF AN AUDIT CARRIED OUT IN ESTONIA FROM 12 MARCH 2018 TO 16 MARCH 2018 IN ORDER TO ASSESS THE ESTONIAN NATIONAL CONTACT POINT FOR HHEALTH'S READINESS FOR JOINING THE CROSS BORDER HHEALTH INFORMATION SERVICES NETWORK  Executive Summary This audit took place in Estonia from 12 to 16 March 2018 and was undertaken at the request of the Health and Welfare Information Systems Centre (HWISC), which operates the Estonian National Contact Point for eHealth (NCPeH). The objective of the audit was to assess the readiness of this NCPeH to join the Cross-Border eHealth Information Services network. Although the NCPeH organisation is well advanced in complying with the readiness criteria pertinent to semantics and technical interoperability, substantial work remains to be done in the areas of contractual compliance, organisation, service operations and information security. The absence of a legal basis to operate in the cross-border exchange of health data means that the NCPeH organisation cannot demonstrate its accountability towards its stakeholders at national and European Union level. Gaps identified in the information security policies and in their implementation, pose significant risks to safeguarding the confidentiality and integrity of patient data. The lack of an implemented service management plan also creates significant risks, in particular for the availability of services during routine operations. The report contains recommendations to the Estonian NCPeH organisation aimed at rectifying the shortcomings identified. I Table of Contents 1 Introduction ....................................................................................................................................1 2 Objectives and scope......................................................................................................................1 3 Readiness criteria ...........................................................................................................................1 4 Background ....................................................................................................................................1 5 Findings and Conclusions ..............................................................................................................2 5.1 Contractual compliance ...........................................................................................................2 5.2 Organisation ............................................................................................................................3 5.3 Operations and services ...........................................................................................................4 5.4 Information security ................................................................................................................5 5.5 Semantics.................................................................................................................................6 5.6 Technical .................................................................................................................................7 6 Overall Conclusion.........................................................................................................................7 7 Closing Meeting .............................................................................................................................7 8 Recommendations ..........................................................................................................................8 II ABBREVIATIONS AND DEFINITIONS USED IN THIS REPORT Abbreviation Explanation CBeHIS Cross Border eHealth Information System eDispensation Electronic data on a dispensed medication eHealth The use of ICT for health eHDSI eHealth Digital Service Infrastructure eHMSEG eHealth Digital Service Infrastructure Member State Expert Group ePrescription Electronic Prescription EU European Union Finding: is evidence regarding the state of a conformity or non-conformity with the readiness criteria Major finding: is evidence of a non-conformity with the readiness criteria which constitutes a potential risk to information confidentiality, integrity or availability, and therefore weakens the reliability of the NCPeH and/or the Finding CBeHIS Network. Combined major findings may constitute a critical finding Critical finding: is evidence of non-conformity with the readiness criteria which constitutes a significant risk to information confidentiality, integrity or availability, and therefore undermines the reliability of the NCPeH and/or the CBeHIS Network GDPR General Data Protection Regulation HWISC Health and Welfare Information Systems Centre ICT Information and communication technologies KPI Key Performance Indicator NCPeH National Contact Point for eHealth Responsibility assignment matrix (Responsible, Accountable, Consulted, RACI matrix Informed) III 1 INTRODUCTION This audit took place in Estonia from 12 to 16 March 2018 and was undertaken at the request of the Health and Welfare Information Systems Centre (HWISC), which operates the Estonian National Contact Point for eHealth (NCPeH), eHealth meaning the use of information and communication technologies (ICT) for health. The audit team comprised four auditors from the European Commission. An opening meeting was held in Tallinn on 12 March 2018 with representatives from the HWISC. At this meeting the audit team confirmed the objectives of and schedule for the audit. In the course of the audit, the team also met with a representative of the Ministry of Social Affairs. 2 OBJECTIVES AND SCOPE The objective of the audit was to assess the readiness of the NCPeH for joining the Cross Border eHealth Information System (CBeHIS) network, by verifying compliance with the readiness criteria agreed by the eHealth Digital Service Infrastructure Member State Expert Group (eHMSEG). Particular emphasis was given to verifying that appropriate policies and processes are in place, are communicated throughout the organisation, and are being implemented in order to preserve the confidentiality, integrity and availability of information. The scope of the audit covered the organisation of the NCPeH and its activities in relation to the service implemented, this being ePrescription country B (country of dispensation), including activities carried out by sub-contracted parties. 3 READINESS CRITERIA The criteria against which the NCPeH was audited are laid down in the readiness criteria checklist (version 1.19) approved by the eHMSEG on 18 December 2017. 4 BACKGROUND On 28 February 2018, the director of the HWISC submitted a request for an initial audit of this organisation as the NCPeH of Estonia, for the service ePrescription country B. This means that Estonia intends to receive ePrescriptions from other European Union (EU) Member States 1, based on which medicines could be dispensed to EU citizens at any of the 371 registered Estonian pharmacies. EU citizens who could avail of this service will come from Member States which are preparing for the service ePrescription country A. These are Croatia, Finland and Portugal in 2018. The audit request was accompanied by a self-assessment, based on the readiness criteria checklist, and supporting documentation. 1 References to 'Member States' should be understood as referring to EU Member States and other countries which participate in the CBeHIS Network. 1 The HWISC is an agency under the umbrella of the Ministry of Social Affairs of Estonia. It was founded on 1 January 2017 as a competence centre for ICT in the health, social protection and labour field, consolidating the roles and responsibilities of the former ICT department of the Ministry of Social Affairs and the Estonian eHealth Foundation. The main responsibilities of the HWISC include: the development of information systems, databases and e-services; the maintenance of services and infrastructure; the provision of information security; and the analysis of data to support policy making, reporting, productivity monitoring and supervision. Estonia already has a system in place for electronic health records and electronic prescriptions for its citizens. According to the HWISC, almost 100% of prescription medicines are dispensed with domestically issued ePrescriptions. 5 FINDINGS AND CONCLUSIONS The terms critical finding and major finding used in this report are defined in the eHealth Audit Framework (version 1.1.0) approved by the eHMSEG on 18 December 2017; for ease of reference, the terms are described in the table of abbreviations and definitions. Conclusions of the report aim at highlighting the impact of the findings. The report focuses on the readiness criteria potentially leading to critical and major findings and which were not satisfactorily met by the NCPeH. In contrast, readiness criteria for which the NCPeH demonstrated compliance are not (or are only superficially) discussed in the report. 5.1 CONTRACTUAL COMPLIANCE This section deals with the legislative and contractual provisions necessary for the organisation to operate as an NCPeH in cross-border health services. Findings The HWISC is a legal entity, competent to contract with suppliers and health care organisations concerning the provision of services at national level. Appropriate contractual arrangements have been made with its suppliers. Nevertheless, the audit team established the following critical and major findings: 1. C.1 [critical]: Current legislation does not designate the HWISC as the national organisation responsible for exchanging ePrescriptions with other Member States. The HWISC as well as the Ministry of Social Affairs, informed the audit team that (changes to) four pieces of legislation are under preparation, all of which are needed to empower the HWISC to fulfil its role in exchanging ePrescription data with other EU Member States. The HWISC anticipates the legislation to be ready by June 2018. 2. C.4 [critical]: The HWISC is currently not empowered to make contracts with pharmacies for the cross-border exchange of ePrescriptions. After the legislation referred 2  to in finding 1 will come into force, the HWISC intends to make contracts with all 371 Estonian pharmacies for the cross-border exchange of ePrescriptions. The HWISC helpdesk is responsible for making contractual arrangements with healthcare organisations. 3. C.6 and 7 [major]: The HWISC is annually consulted by the Ministry of Social Affairs on proposed changes to national legislation that could have an impact on services development and financial resources. However, within the HWISC there is no documented procedure ensuring a collection and evaluation of legislative changes that may impact on the organisation. Although, the HWISC performs a legal impact assessment while preparing software development work orders, this does not take into account possible impacts on its wider organisation. Within the organisation, information on legislative changes is disseminated on an ad-hoc basis, but there is no structured mechanism in place ensuring that staff are aware of the legislation relevant to their tasks. The audit team noted that an impact assessment of the General Data Protection Regulation2 (GDPR), led by the Ministry for Social Affairs, had not been completed, and that knowledge of this Regulation as well as its potential impact on the organisation was rudimentary within the HWISC. 4. C.9 [critical]: The roles of data processors and data controllers for the cross-border exchange of ePrescriptions have not been unambiguously identified. The data protection impact assessment (mandatory when the GDPR enters into force on 25 May 2018) should clarify the roles, but has not yet been completed. Conclusions on contractual compliance The absence of a legal basis for the HWISC to operate as an NCPeH in the cross-border exchange of ePrescriptions, and ambiguity as to the identity of the data controller role for these services, means that the organisation currently cannot demonstrate its accountability towards its stakeholders at national and EU level. 5.2 ORGANISATION This section contains an assessment of the compliance with the readiness criteria relating to the organisational measures ensuring the effective operation of the NCPeH. Findings The audit team noted that the HWISC has a clear organisational structure outlined in an organigram and a recently prepared responsibility assignment (RACI) matrix. Nevertheless, the audit team established the following critical and major findings: 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. OJ L 119, 4.5.2016, p. 1. 3 5. O.11 [major]: The HWISC does not monitor the key performance indicators (KPIs) as laid down in the eHealth Digital Service Infrastructure (eHDSI) Monitoring Framework, these being uptime and number of transactions. Although actual monitoring could be seen as premature as long as the NCPeH has not joined the CBeHIS network, the audit team noted that the available monitoring tools have not been configured for the cross- border exchange of health data. 6. O.13 [critical]: The HWISC has no security clearance policy for staff in security sensitive positions. A basic level of required competencies and duties for different roles is referred to in vacancy announcements and labour contracts. However, staff have no written job descriptions, detailing their roles and responsibilities. Conclusions on organisation Notwithstanding the clear organisational structure of the HWISC, the absence of a security clearance policy, in particular linked to security-sensitive roles, poses a risk to the confidentiality and integrity of data processed by them. 5.3 OPERATIONS AND SERVICES This section contains an assessment of the compliance with the readiness criteria relating to service operations management. Findings Operations management for cross-border services are under development. The audit team established the following critical and major findings: 7. OS.1 [critical]: According to the HWISC, they do not have a service-driven management plan. They presented to the audit team a recently drafted service operation plan. The audit team noted that this plan had not been endorsed by senior management and that, to a large extent, it did not reflect the current working practices in the organisation. 8. OS.5 [critical]: The HWISC has informal communication channels with other EU Member States, but has no established formal communication processes. 9. OS.6 [major]: The HWISC does not monitor service levels of suppliers against agreed targets. 10. OS.8 [critical]: The HWISC has an incident management procedure in place. However, the audit team noted that the procedure was not configured to handle cross-border service incidents. The incident management procedure outlined in the recently drafted service operation plan for cross-border services has not been implemented. 11. OS.11 and 12 [critical]: The current change management practice of the HWISC as well as the change management procedure described in the newly drafted service operations 4  plan are limited to software development orders only, and do not reflect other changes such as changes in the organisational set up. 12. OS.21 [major]: The HWISC tool for monitoring capacity is not configured for the cross- border IT services. Moreover, capacity trends are not monitored. 13. OS.24 [major]: The HWISC has no procedure to recover back to normal operations in case of disruption. Conclusions on operations and services The lack of an implemented service management plan creates risks, in particular for the availability of services during routine operations. 5.4 INFORMATION SECURITY This section contains an assessment of the compliance with the readiness criteria relating to information security policies, security controls and security incident management. Findings The HWISC demonstrated awareness of information security controls relevant to the cross- border exchange of health data. The HWISC shared with the audit team its plans for addressing already known shortcomings. Nevertheless, the audit team established the following critical and major findings: 14. IS.2 and 29 [critical]: The HWISC has implemented an information security management system based on the IT baseline security system “ISKE”, which is compulsory for all Estonian state database processors. However, the HWISC could not demonstrate to the audit team how the ISKE controls would give effect to each of the eHDSI policies. 15. IS.3 [critical]: The HWISC has not performed a business impact and risk assessment on which controls to implement for ensuring the required security policies. 16. IS.4 and 10 [critical]: The HWISC has a list of ISKE security controls. However, the audit team noted that these controls are not assigned to the assets relevant to the cross- border exchange of health data. 17. IS.6 [critical]: The HWISC has not documented the trust models applicable to the cross- border exchange of health data. Documenting trust models is important to ensure that no cross-border data could be transmitted to an entity outside the CBeHIS network. 18. IS.7 [critical]: The HWISC did not provide evidence to the audit team of an implemented system for collecting, analysing storing and retaining audit trails and logs. 19. IS.11 [major] The HWISC has no business-continuity plan the cross-border exchange of health data. 5 20. IS.12 [critical]: The HWISC has no disaster recovery plan for the cross-border exchange of health data. 21. IS.20 [major]: The HWISC indicated that the information security policy of the Ministry of Social Affairs establishes that data processing must be done according to the law and should be protected against unauthorised access. However, the HWISC could not demonstrate to the audit team how this policy specifically safeguards personally identifiable information in the cross-border exchange of ePrescriptions. In this context, the HWISC has not completed the data protection impact assessment as required by the GDPR. 22. IS.24, 25 and 26 [critical]: The HWISC has documented procedures for managing the access rights to information systems. Access rights are granted on a need to know basis by the helpdesk. However, the procedures do not define what level of access is necessary for what role or task. Moreover, the information security officer does not have an overview of the access rights granted. 23. IS.28 [critical]: The HWISC did not demonstrate how the non-repudiation evidence produced during cross-border exchange of health data are managed under information security policies. 24. IS.31 [critical]: The HWISC operations management does not ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications. Conclusions on information security Gaps identified in the information security policies and implementation, pose risks to the confidentiality of the data exchanged in cross-border health services. 5.5 SEMANTICS This section contains an assessment of the compliance with the readiness criteria relating to semantic interoperability applicable to ePrescription and eDispensation country B. Findings Semantic interoperability policies, procedures and asset management are well advanced to cope with the demands of routine operations. Nevertheless, the audit team established the following critical finding: 25. SI.9 [critical]: The service desk is not equipped to accommodate health care professionals’ feedback on the meaning and clarity of ePrescriptions received from other Member States. 6 Conclusions on semantics The HWISC is well prepared for semantic interoperability, with the exception of the service/help desk function. 5.6 TECHNICAL This section contains an assessment of the compliance with the readiness criteria relating to the technical gateway, national connector and national infrastructure. Findings The HWISC demonstrated that the procedures related to technical assets were documented and implemented accordingly. Nevertheless, the audit team established the following critical finding: 26. T.6 [critical]: A procedure is not in place to monitor the expiration date of the electronic certificates used in the cross-border exchange of health data. Conclusions on technical The HWISC is well prepared to meet the criteria for technical inter-operability during routine operations, with the exception of the monitoring of electronic certificate expiry dates. 6 OVERALL CONCLUSION Although the NCPeH organisation is well advanced in complying with the readiness criteria pertinent to semantics and technical interoperability, substantial work remains to be done in the areas of contractual compliance, organisation, service operations and information security. The absence of a legal basis to operate in the cross-border exchange of health data means that the NCPeH organisation cannot demonstrate its accountability towards its stakeholders at national and EU level. Gaps identified in the information security policies and in their implementation, pose significant risks to safeguarding the confidentiality and integrity of patient data. The lack of an implemented service management plan also creates significant risks, in particular for the availability of services during routine operations. 7 CLOSING MEETING The audit team presented all critical and major findings at the closing meeting. The HWISC accepted these findings and acknowledged that work remains to be done in order to comply with the readiness criteria. 7 8 RECOMMENDATIONS The HWISC is invited to provide details of the actions taken and planned, including deadlines for their completion (‘action plan’), aimed at addressing the recommendations set out below, within 15 working days of receipt of this audit report No. Recommendation 1. To ensure that it is designated by the national competent authority as the organisation responsible for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.1. Associated finding: No 1 2. To ensure that there are contractual arrangements in place with the national health care organisations (pharmacies) for the cross-border exchange of health information pertinent to ePrescriptions, in line with readiness criterion C.4. Associated finding: No 2 3. To have appropriate procedures in place ensuring that relevant legislation and regulations are collected and understood by staff, as well as procedures for ensuring the conduct of an impact assessment covering the entire NCPeH organisation for legislative and regulatory changes, in line with readiness criteria C.6 and C.7. Associated finding: No 3 4. To identify clearly the responsible data controller and data processors for cross-border health data pertinent to ePrescriptions, in line with readiness criterion C.9. Associated finding: No 4 5. To implement the measurement of KPIs required by the eHDSI Monitoring Framework, in line with readiness criterion O.11. Associated finding: No 5 6. To define the necessary competencies and, if applicable, security clearance requirements for the staff that operate the NCPeH, in line with readiness criterion O.13. Associated findings: No 6 and 22 8 No. Recommendation 7. To put in place the Service (Level) Management Plan, in line with readiness criterion OS.1. Associated finding: No 7 8. To organise the communication processes with the NCPeH's of EU Member States foreseen to go live with the ePrescription A service in 2018, in line with readiness criterion OS.5. Associated finding: No 8 9. To ensure that it can monitor and report against the service levels targets agreed in the service level agreements, and put in place a mechanism of follow-up on non-compliance with the targets, in line with readiness criterion OS.6. Associated finding: No 9 10. To put in place a documented incident management procedure, applicable to the cross-border exchange of ePrescriptions, in line with readiness criterion OS.8. Associated finding: No 10 11. To put in place a documented change management procedure and ensure this procedure is used to correct the underlying cause of incidents/problems, in line with readiness criteria OS.11 and OS.12. Associated finding: No 11 12. To put in place methods, procedures and/or techniques to monitor and provide adequate service capacity, in line with readiness criterion OS.21. Associated finding: No 12 13. To put in place a procedure to recover back to normal operations in case of disruption, in line with readiness criterion OS.24. Associated finding: No 13 9 No. Recommendation 14. To ensure that the security measures set out in the eHDSI Security Policies and the Organisational Framework for eHealth National Contact Points are followed, and that the necessary controls are implemented to ensure the security of data processed, in line with readiness criteria IS.2 and IS.29. Associated finding: No 14 15. To carry out a business impact and risk assessment on which controls have to be implemented for ensuring the required security policies, along the corresponding assessment on which controls have to be excluded for that purpose (with the appropriate exclusion justification), in line with readiness criterion IS.3. Associated finding: No 15 16. To establish a comprehensive list of identified, applicable and implemented security controls in place ("Statement of Applicability") applicable to the cross-border exchange health data, demonstrating inter alia secure connections with other NCPeHs, in line with readiness criteria IS.4 and IS.10. Associated finding: No 16 17. To ensure that no cross-border data could be transmitted via their services to an entity that either does not belong to or is not allowed within the CBeHIS network, in line with readiness criterion IS.6. Associated finding: No 17 18. To put in place an appropriate system of collecting, analysing, storing and retaining audit trail and logs, in line with readiness criterion IS.7. Associated finding: No 18 19. To define service/business continuity requirements in a Business Continuity Plan, in line with readiness criterion IS.11. Associated finding: No 19 20. To establish a Disaster Recovery Plan for the NCPeH Technical Gateway and other critical services and resources, in line with readiness criterion IS.12. Associated finding: No 20 10 No. Recommendation 21. To put in place documented policies defining how personally identifiable information is safeguarded, in line with readiness criterion IS.20. Associated finding: No 21 22. To define the various roles and responsibilities related to information security management and ensure that users are assigned only the necessary rights for performing their specific duties on the systems and services, in line with readiness criteria IS.24, IS.25 and IS.26. Associated findings: No 6 and 22 23. To ensure the non-repudiation of cross health data exchanged across the border, in line with readiness criterion IS.28. Associated finding: No 23 24. To ensure that the logs of system administrators’ and system operators’ activities are safeguarded and reviewed in order to check for unauthorised or erroneous modifications, in line with readiness criterion IS.31. Associated finding: No 24 25. To ensure mechanisms for the feedback of health professionals as to whether the meaning of ePrescriptions received was clear and not ambiguous, in line with readiness criterion SI.9 Associated finding: No 25 26. To implement a procedure to monitor the expiry date of the electronic certificates used in the cross-border exchange of health data, in line with readiness criterion T.6 Associated finding: No 26 11 Saatja: Katre Pruul </O=SOTSIAALMINISTEERIUM/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=KATRE PRUUL6A3> Saaja: Marika Vaher Teema: FW: Draft report - DG(SANTE)/2018-6522 - MR - Estonia - 12 to 16 March 2018 - eHealth From: Katrin Reinhold Sent: Saturday, April 14, 2018 3:28 PM To: Katre Pruul <[email protected]> Subject: Fwd: Draft report - DG(SANTE)/2018-6522 - MR - Estonia - 12 to 16 March 2018 - eHealth Sent from my iPhone Begin forwarded message: From: "[email protected] <mailto:[email protected]> " <[email protected] <mailto:[email protected]> > To: "Katrin Reinhold" <[email protected] <mailto:[email protected]> > Subject: Draft report - DG(SANTE)/2018-6522 - MR - Estonia - 12 to 16 March 2018 - eHealth Please find attached: - Letter for the attention of Ms Katrin Reinhold, Director, Health and Welfare Information Systems Centre (HWISC) - Report DG(SANTE)/2018-6522 – MR - Table for response to recommendations (pdf and docx versions) With kind regards, Anne-Marie Shortall European Commission Directorate General for Health and Food Safety Health and food audits and analysis Unit F5 Health Protection Grange Dunsany Co. Meath +353 46 9061871 [email protected] <mailto:[email protected]>