Authors:
Cátia Santos-Pereira
1
;
2
;
Alexandre B. Augusto
2
;
José Castanheira
3
;
Tiago Morais
3
and
Ricardo Correia
4
;
2
Affiliations:
1
Faculdade de Engenharia da Universidade do Porto, Porto, Portugal
;
2
HealthySystems, Porto, Portugal
;
3
Unidade Local de Saúde de Matosinhos, Porto, Portugal
;
4
CINTESIS – Centro de Investigação em Tecnologias e Serviços de Saúde, Porto, Portugal
Keyword(s):
Audit-trail, Audit-log, GDPR, Security, Data Privacy, Traceability, Healthcare.
Abstract:
GDPR introduces a new concept: ”Data protection by design and per default” for new software development
however legacy systems will also have to adapt in order to comply. This creates great pressure on health care
institutions, namely hospitals, and software producers to provide data protections and traceability mechanisms
for their current and legacy systems. The aim of this work is to understand the maturity level of a Portuguese
Healthcare Organization in their audit records to comply with GDPR article 30 and 32 since healthcare organization operate in a daily-basis with personal data. This study was performed with the partnership of a public
Portuguese healthcare organization and were organized into three main phases: (1) data collection of all information systems that operate with personal data; (2) interviews with IT professionals in order to retrieve the
necessary knowledge for each information system and (3) analysis of the collected data and its conclusions.
This study helpe
d to identify a need inside this organization and to determine a follow-up plan to overpass
this challenge. However it also identified some constrains like financial budget, legacy systems, small team
of IT professionals in the organization and difficulties in establish communication with information system
providers.
(More)