Certification program for processing personal data in the context of data sharing in the health & care sector

The present conformity assessment program was developed within the framework of the BMFTR-funded project “ProKIP: Prozessentwicklung und -begleitung zum KI-Einsatz in der Pflege” (Process development and support for the use of AI in nursing). ProKIP supported, advised, connected, and evaluated research projects within the BMFTR funding program “Making Repositories and AI Systems Usable in Everyday Nursing Practice.” Based on the findings of the project, this conformity assessment program was designed and developed. It serves as a preliminary stage for a data protection certificate pursuant to Article 42 GDPR and ensures the GDPR-compliant and thus legally safe application of the project results in nursing practice. The program covers the processing of personal data from healthcare and nursing institutions for the purpose of transmitting, disseminating or otherwise making available (“sharing”) (or preparing and preprocessing to share) either data-minimised or fully anonymised health or care data to third parties for downstream purposes. The scheme distinguishes two options that can be chosen by the scheme applicant, one with higher requirements for the preprocessing, and one with higher requirements for the disclosure of the preprocessed data: (1) When the scheme applicant chooses the first option, the preprocessing of the data entails data minimisation procedures which do not guarantee full anonymisation. The scheme applicant then has to fulfil higher requirements in order to be permitted to disclose the data to third parties, as put down in this scheme. (2) When the scheme applicant chooses the second option, the preprocessing of the data entails full anonymisation, which has to be demonstrated by the scheme applicant. The scheme applicant then has to fulfil lower requirements in order to be permitted to disclose the data to third parties, as put down in this scheme. The program specifies the necessary protective measures, as well as the type and form of the evidence to be provided and the methods for verifying such evidence.