View source for KORDEUS - Data retention and deletion concept

KORDEUS is based on b-op, which enables:

* '''decoupling of data and applications'''
* '''the separation of data by owner''' - each patient receives its own data pool, LH has their data pool.
* '''data pools are freely movable (physically)''' between realms, which enables:
** hosting the data in the legeslative region where they belong without breaking the system (e.g. EU patients cloud, CH patients cloud, US patients cloud)
** adhering to all possible regional data retention and deletion plans at the same time - no decisions or compromises has to be done
** protect data owners and their data from laws which dont apply to them
* '''differentiation of possession and ownership'''
** '''perspectives''' - for each data category and possessor you can define retention and deletion policies
** '''shared volatile data''' - data can be shared temporarily and revoked from the owner by trust relations, which are definable by the owner. This happens without destroying referential integrity on temporary possessor.
** '''data appropriation''' '''-''' by data appropriation, data is used in the business process of the processor. Deleting may hurt referential integrity and (only) therefore a data deletion concept is required.

===== Data retention and deletion in healthcare with KORDEUS =====
With thiese new conceptual options, generally all regional data protection laws come with the same requirements on data retention and deletion (see table below):
{| class="wikitable"
!Owner
! colspan="6" |Patient
! colspan="2" |Medical Service Provider
|-
! rowspan="2" |Possesor
! rowspan="2" |Patients
! colspan="2" |Medical Service Provider
! rowspan="2" |Patients
! colspan="2" |Medical Service Provider
! rowspan="2" |Medical Service Provider
! rowspan="2" |Non-medical service provider
|-
!treating
!non-treating
!treating
!non-treating
|-
!Data Category
! colspan="3" |(Medical) Patient-Data
! colspan="3" |(Regular Patient-Data)
! colspan="2" |Service Delivery Information
|-
|Policy by 
'''EU DS-GVO'''
| rowspan="3" |'''Owner''' 
(Never automatically,

Self-Service anytime)
| rowspan="3" |10 years
| rowspan="3" |purpose-limited
| rowspan="3" |'''Owner''' 
(Never automatically,

Self-Service anytime)
| colspan="2" rowspan="3" |purpose-limited
| rowspan="3" |6 years
| rowspan="3" |6 years
|-
|'''HIPAA / US''' Cloud Act
|-
|'''CH nDSG'''
|}

== See also ==

* [[Kordeus PAX data zones and appropriation]]
*