This includes every information relating to physical or mental health of a natural identified person or one that can be identified, by reference to an identification number or to one or several elements belonging to the person.
This entails information relating to the provision of a health service implying the processing of information about the person’s health.
In any case, the collection, use and retention of health data is strictly governed by law.
The evaluation procedure will take 8 months :
The accreditation application has three parts that will be analyzed by the accreditation committee and the CNIL:
1) Administrative and financial aspects
2) Legal and technical measures taken to protect and secure the personal information
3) Standard clauses
There are 13 benchmarks that will be analyzed during the procedure : 68 requirements
1. Security and confidentiality policies (18 requirements)
2. Organizational structuring (4 requirements)
3. Data Subjects’ rights (6 requirements)
4. Human resources (6 requirements)
5. Authentication solutions (5 requirements)
6. Telecommunications (3 requirements)
7. Traceability (3 requirements)
8. Incident and data breach management (6 requirements)
9. Disaster recovery plans (5 requirements)
10. Archiving of data (2 requirements)
11. Continuity of services (5 requirements)
12. Service/Policy evolution management (3 requirements)
13. Compliance Audits (2 requirements)
1) “HIPAA Breach Notification Rule”, 45 CFR §§ 164.400-414,
Requires “HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information.” Risk-based approach.
2) Disclosure of Books to Administration §§ 160.310(c)(1)
Disclosure to the Secretary of internal books, practices and records relating to the use and disclosure of protected health information for compliance determining purposes
3) Independent External Audits
These external audits will need to contain a referential for French Data Protection Laws and the EU General Data Protection Regulation in 2018.
· HDS Certification Acceptability Audit: Prior Audit
· ASIP Certification Package 1:Legal Translations and Interpretation for Certification Application, data protection representative, certification application
· ASIP Certification Package 2 (If data protection and security policies/procedures need to be modified or written)
Contactez-nous dès maintenant.
