On 7 October 2024 the UK Data Protection Authority ('DPA'), the ICO released 9 toolkits; the goal of these toolkits is to help organisations assess their compliance with key requirements under data protection law. These 9 toolkits are part of a framework which is an extension of the ICO's existing Accountability Framework.

These nine toolkits cover the following areas:

• Accountability
• Records management
• Information & cyber security
• Training and awareness
• Data sharing
• Requests for data
• Personal data breach management
• Artificial intelligence
• Age-appropriate design

Access these 9 toolkits here: https://ico.org.uk/about-the-i...

A question on UK data privacy law and guidelines? Contact our UK consultant

Dave Edwards at d.p.edwards ( at ) pharmarketing.net

The US FDA released in October a Q&A for Electronic Systems, Electronic Records and Electronic Signatures for Clinical Investigations.

This guidance provides information for sponsors, clinical investigators, institutional review boards, contract research organizations, and other interested parties on the use of electronic systems, electronic records, and electronic signatures in clinical investigations of foods, medical products, tobacco products, and new animal drugs.

Among other things, you will learn that you are required to submit letters of non-repudiation to FDA, and if electronic signature based on biometrics are acceptable and how.

Download the Q&A here: Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers | FDA

For more information on Electronic Signatures in the US and in Europe, and how they can be compliant with Privacy laws and GxP, contact us at contact@pharmarketing.net

European Data Protection Authorities published several decisions related to the processing of health data in the past months.
Such decisions shed light on the key measures to implement to stay compliant with privacy (and healthcare) laws and avoid a critical finding.

Many thanks to GDPR hub NOYB and to IAPP for all these valuable information!

Spain:

Fact:

The Data Protection Authority ('DPA') of Spain, the AEPD, fined a plastic surgery clinic €10,000 after it unlawfully shared before and after pictures of a data subject on its social media account. The DPA highlighted that the pictures contained health data under Article 9(1) GDPR. Read more or edit on GDPRhub...

Takeaway:

Always inform and ask the consent of the data subject before sharing their personal data on social media. For a photo, video or voice recording, in addition to the consent above, your organisation needs to ask the data subject to sign a 'right to image' document.

US:

Fact:

The U.S. Department of Health and Human Services Office for Civil Rights ('HHS') announced a USD 250,000 settlement with health care provider Cascade Eye and Skin Centers after a ransomware attack breached sensitive patient information. The organization allegedly violated the Health Insurance Portability and Accountability Act's ('HIPAA') breach notification rules and has agreed to increase its cybersecurity efforts.
Full story

Takeaway:

It is interesting to see that the healthcare provider was find not because of the personal data breach, but because they failed to notify the HHS.

In the US, each and every personal data breach of healthcare data needs to be notified to the HHS: if it is an important data breach, the deadline is 60 days. For a minor breach, the deadline is end of calendar year + 60 days.

Fact:

In a report to the U.S. Department of Health and Human Services ('HHS'), Change Healthcare Inc., a provider of revenue and payment cycle management that connects payers, providers, and patients within the U.S. healthcare system. claimed the cyberattack it experienced in February breached the data of 100 million Americans, CyberScoop reports. The new figure sets the incident as largest breach to ever be reported to U.S. regulators. The breach, which impacted patients' personally identifiable data and health insurance information, remains under HHS investigation. the company paid a $22 million ransom, resulted in estimated losses of more than $1 billion.
Full story

Takeaway:

There is no miracle solution against cyberattacks; that said, in our experience with clients or sub-contractors which experienced a cyberattack, in most cases the cause is human error, like leaving an IT server with 'admin/admin' as user/passcode.

This is why it so important to put appropriate data privacy language and IT security wording in all the contracts with sub-contractors and with employees. It is also key to train all staff regularly to data privacy and IT security basic principles, and to check that all sub-contractors do the same. And of course your organisation needs to implement organisational and technical security measures as the Privacy laws, and according to guidelines like ISO 27001.

It will be interesting to hear the conclusion of HHS's investigation, it it is ever made public.

On another note, it's surprising that HHS/FBI/CIA let Change Healthcare pay the ransom. Usually they recommend not to pay.

Japan:

Fact:

Japan's Personal Information Protection Commission published guidance on how to handle personal information compromised in data breaches at health care facilities such as hospitals, clinics and pharmacies. The PPC's recommended remedies include conducting regular training and ensure enough staffing during busy hours to avoid mistakes.
Full story

Takeaway:

It is a good practice to train employees to privacy regularly, especially in organisations processing healthcare data. 

For more information on the organisational and technical security measures to avoid Healthcare Data Breaches and what to do if you experience a data breach, contact us at contact@pharmarketing.net