c) The issue of the transfer of data to a third country.
Here the art. 25, par. 2, of the same Directive provides the system of transfer provided that the receiving Country provides adequate safeguards. Provided that in legal terms adequate can mean less than equivalent or better the same safeguards, the basic issue is that the European Commission is charged to evaluate the degree of this adequacy. To close the reasoning, recently the Court of Justice has stated that this evaluation can be challenged before a Judge (Court of Justice, C-362/14 Maximillian Schrems v. Data Protection Commissioner ).
d) Correction of error on data.
Remaining in the European context, article 12 of the Directive quoted above provides data subjects with the ability to check on the accuracy of the data and to ensure that the data are kept up to date. These rights fully apply to the collection of personal data in EHR systems of course. Therefore, all the information related to how to collect data, the specific purpose and the person legitimated to access to them is functional to allow the owner to access to his date in order to control its accuracy. In the case of error, the owner has the right to have his date rectified. It is evident that  Europe also on this issue has chosen the opposite solution of the American one; the latter allows the patient to include its dissent in the record, that remains unchanged. This makes the patient’s annotation completely useless for the purposes of its right to self-determination.
e) Compensation for break of privacy.
In case of break of privacy, for any cause, the European Directive provides a complete system of compensation. It is composed of civil, criminal remedies and also the recourse to an Independent Authority. The Directive in line with its nature does not chose which kind of action are available for the patient, but it charges each State member to fulfill this obligation. In other words, the States are mandated to drawn a complete and efficient system of restoration of the patrimonial damages and also actions able prevent and avoid further breaks of privacy. The distance from the above mentioned USA solution is so evident that it is nearly useless to further underline it.

6 Open issues and possible solutions
A new regulation is in the process of being approved instead of the Directive 95/46. To sum up the core of the new corpus of norms, they have stated the ambitious intention to strengthen the protection of privacy connected to digital society, but they have left this intention to the Consideranda, while the new norms go in the opposite direction. As an example, sharing medical data is not possible now without a new consent of the patient. This would become possible with the new regulation because art. 5 provides that the data can be used not only for the specific initial purpose, but also for further medical purposes, provided that they are compatible with the original one.
I think the two systems, although considerably different, share a common problem. They do not provide efficient security systems for data, especially now that the data are collected in the cloud. It follows that an unsecure cloud results in a massive risk for privacy.
This may well undermine the success of the entire operation because patients will not have confidence in the system and therefore will refuse their consent. Since the benefits of EHR depend on a generalized use of it, if a significant number of patients lose confidence and deny their consent the whole system of digitized medical history may turn into a failure.
Thus, two different ideological concepts of privacy between USA and EU may not be a real problem. Rather I think that both systems still face three major issues that remain unresolved.
The question of confidentiality refers to the process that ensures that information is accessible only to those authorised to have access to it.
The question of integrity calls for the duty to ensure that information is accurate and is not modified in an unauthorised fashion.
The question of availability requires that information is accessible and useable only upon demand by an authorised entity.
On both sides of the ocean the debate has been focused on privacy. But the profile of the CIA  (confidentiality, integrity and availability)  and the issue whether CIA standards should be regulated by industries or policy makers have been underestimated.
These are the real issues upon which the success of EHR depends rather than a different theoretical construction of the right to privacy.

Abstract
This paper intends to delineate the differences between the legal regimes applicable to the electronic health record in the U.S. and Europe.
In the U.S. notice and awareness of data collection can be satisfied through the privacy practices statement which the company collecting the information sets out in its web site. In the EU, otices to the patient must state that information has been collected, how the information will be used, the entity’s obligation to protect privacy, and the contact for complaints by the patient.
Thus, in the U.S. patient rights are more limited than in Europe. Furthermore, the distance is a policy question. U.S. legislation and doctrine are talking about the second stage of EHR, in which the privacy problem recedes before other issues, such as confidentiality, integrity and availability (CIA).
Confidentiality refers to the process that ensures that information is accessible only to those authorised to have access to it.
Integrity calls for the duty to ensure that information is accurate and is not modified in an unauthorised fashion.
Availability requires that information is accessible and useable only upon demand by an authorised entity.
Europe, having focused the whole debate on the privacy question, has underestimated the profile of the CIA and the question whether CIA standards should be regulated by industries or policy makers.
The author thinks that these are the real open questions.

Pagine: 1 2 3 4