CEF eid SMO The use of eid in ehealth. ehealth Network meeting 7 June 2016 Amsterdam

Transcription

1 CEF eid SMO The use of eid in ehealth ehealth Network meeting 7 June 2016 Amsterdam

2 Agenda Introduction to the study Introduction to eidas Regulation and CEF eid Identification/ authentication for ehealth use cases Examples of MS experience

3 Introduction to the study

4 Why, what, when, where? The use of eid in ehealth

5 How? Experience from previous/ongoing initiatives: epsos, OpenNCP, Expand, STORK 2.0, esens ehealth pilot, JAseHN Selected countries with relevant experience AT, FI, EL, IT, LU, PT, SE Collaboration with: OpenNCP, esens ehealth pilot, JAseHN Directed by DG SANTE eidas Task Force/DG DIGIT

6 How? ehealth & eidas Bringing the two worlds together!

7 Timeline

8 Introduction to eidas and CEF eid Legal framework Benefits Current situation in MS

9 Introduction to eidas and CEF eid Legal framework eidas Regulation established a legal framework and trust model for the mutual recognition of notified nationally supported eids across borders By Sep 2018 public administrations who offer services that require online authentication must accept (subject to conditions) notified eids from other Member States This will include public ehealth services CEF eid: CEF provides software and support services; financially supports the deployment in MS

10 Introduction to eidas and CEF eid Benefits User centric Flexible SECURE CROSS- BORDER AUTHENTICATION Cost saving CEF Governance and operations

11 Introduction to eidas and CEF eid Countries with implementations based on LSPs Many Member States already have experience with cross-border authentication through the Large Scale Pilot projects Countries with STORK based implementation: middleware countries: AT, DE STORK 1.0: BE, CH, CZ, LV, PT, SI, SK STORK 1 and STORK 2.0: IT, LT, LU STORK 2.0: DK, EE, EL, ES, IS, NL, NO, SE, TR, UK

12 Introduction to eidas and CEF eid Countries in process of implementing an eidas compliant Node Many Member States are already gearing up to become part of the eidas Network Countries setting-up an eidas compliant Node (received CEF funding in 2014): AT*, BE, CZ*, DE, DK*, EE*, EL*, ES*, FR, IS, IT*, MT*, NL*, NO*, PL*, SK, SE, UK* * countries that expressed intent to use CEF eid sample implementation Countries planning national eidas Node implementation: BG, CY, FI, LT, LU, LV, RO, SI, TR

13 Identification/ authentication for ehealth use cases Patient Summary & eprescription/edispensation Identification needs Cross-border patient identification / authentication: How can identification be done using CEF eid?

14 Patient Summary & eprescription Identification needs Both services require: Identification of the patient to retrieve correct PS/eP information Identification of HCP (e.g. doctor, pharmacists) for access to crossborder PS and ep services At national level in some countries eid already support the identification of both patients and HCPs (e.g. BE, LU, AT) For the cross-border PS/eP services CEF eid can similarly support the identification and provide secure and real-time authentication Main question: For PS/eP where is cross-border authentication needed?

15 Cross-border identification/authentication How is identification done today? The NCP architecture provides for cross-border communication and connection with national services Identification in the current NCP setup is handled at the source Identification of the patient based on: National Patient Search and National Patient ID infrastructure Identification of HCP based on National HCP authenticator and National HCP ID infrastructure

16 Cross-border identification/authentication How is identification done today? MS implement the identification based on their requirements: varied landscape, national requirements for levels of assurance, security, liability A future Multilateral Legal Agreement is being discussed in the ehealth Network for adoption in 2016 Identification of the patient is a cross-border use case Identification of HCP does not occur across borders in the current setup (only national identification), however, CEF eid could be used to authenticate access of HCPs in real-time

17 Examples of MS experience Luxembourg Austria Sweden

18 Luxembourg In ehealth nationally issued eids (smartcards) are already used for patient and HCP identification Cross-border identification of patients: Based on national approach: an official document (passport) presented to HCP, information is matched in national systems to retrieve patientid used in NCP Luxembourg foresees to use eidas and would be able to use the national eid across borders to identify patients (and possibly HCPs) Health data is one of the most sensitive types of personal data, the level of assurance and security would be high This could be catered for under eidas, Luxembourg prefers this as the authentication setup under eidas guarantees a single secure solution that can reused across sectors, including ehealth The smartcard solution is still considered the most secure in Luxembourg, security is considered most important, however alternative solutions for point of care issues may be identified

19 Austria In ehealth nationally issued eids (both smartcard and mobile eid) are already used for patient and HCP identification (moving away from health specific cards to the common national eid) Cross-border identification of patients: The national eid schemes are already integrated with the Austrian NCP (collaboration with OpenNCP, and esens ehealth Pilot based on STORK 2.0 experience) Austria foresees that eidas will support the cross-border authentication of patients and possibly also for HCPs Specific requirements for authentication in ehealth are derived from the national eid solutions that are considered secure and level high. ehealth specific requirements are not yet clearly defined, the ongoing work of JAseHN and Multilateral Legal Agreement would be important for this Sector specific authentication solutions should be avoided and eidas should support ehealth in the long-run. Bridge actions to solve current challenges such as point of care issues are useful in the medium term

20 Sweden In ehealth the eid provided by BankID is used for identification of patients based on their social security number. For HCP identification an eid system is in place based on ehealth specific smartcards Cross-border identification of patients: Sweden piloted eprescription across borders in epsos (not based on eid) and expects eprescription to go live in 2017/2018 The eid solution (BankID) is used nationally for patient identification and will most likely be notified under eidas. The HCP smartcard could in principle also be notified, however, there is no decision on this currently Sweden considers that eid schemes will converge to the eidas specifications and levels of assurance, eidas may therefore support the identification of patients and possible HCPs in the future (for which authentication needs to be carefully considered (beyond minimal dataset)) Specific requirements for authentication in ehealth are derived from the national eid solutions that are considered secure and level high. ehealth specific requirements are not yet clearly defined, the ongoing work of JAseHN and Multilateral Legal Agreement would be important for this

21 Visit the catalogue of building blocks on CEF Digital Single Web Portal

22 Contact us European Union, All rights reserved. Certain parts are licensed under conditions to the EU. Reproduction is authorized provided the source is acknowledged.