KORDEUS - Data retention and deletion concept: Difference between revisions
Jump to navigation
Jump to search
Stefanseiler (talk | contribs) No edit summary |
Stefanseiler (talk | contribs) |
||
| Line 41: | Line 41: | ||
| rowspan="3" |'''Owner''' | | rowspan="3" |'''Owner''' | ||
(Never automatically, | (Never automatically, | ||
Self-Service anytime) | Self-Service anytime) | ||
| rowspan="3" |10 years | | rowspan="3" |10 years | ||
| Line 46: | Line 47: | ||
| rowspan="3" |'''Owner''' | | rowspan="3" |'''Owner''' | ||
(Never automatically, | (Never automatically, | ||
Self-Service anytime) | Self-Service anytime) | ||
| colspan="2" rowspan="3" |purpose-limited | | colspan="2" rowspan="3" |purpose-limited | ||
| Line 58: | Line 60: | ||
== See also == | == See also == | ||
* [[Kordeus PAX | * [[Kordeus PAX data zones and appropriation]] | ||
* | |||
Latest revision as of 15:04, 10 January 2026
KORDEUS is based on b-op, which enables:
- decoupling of data and applications
- the separation of data by owner - each patient receives its own data pool, LH has their data pool.
- data pools are freely movable (physically) between realms, which enables:
- hosting the data in the legeslative region where they belong without breaking the system (e.g. EU patients cloud, CH patients cloud, US patients cloud)
- adhering to all possible regional data retention and deletion plans at the same time - no decisions or compromises has to be done
- protect data owners and their data from laws which dont apply to them
- differentiation of possession and ownership
- perspectives - for each data category and possessor you can define retention and deletion policies
- shared volatile data - data can be shared temporarily and revoked from the owner by trust relations, which are definable by the owner. This happens without destroying referential integrity on temporary possessor.
- data appropriation - by data appropriation, data is used in the business process of the processor. Deleting may hurt referential integrity and (only) therefore a data deletion concept is required.
Data retention and deletion in healthcare with KORDEUS
With thiese new conceptual options, generally all regional data protection laws come with the same requirements on data retention and deletion (see table below):
| Owner | Patient | Medical Service Provider | ||||||
|---|---|---|---|---|---|---|---|---|
| Possesor | Patients | Medical Service Provider | Patients | Medical Service Provider | Medical Service Provider | Non-medical service provider | ||
| treating | non-treating | treating | non-treating | |||||
| Data Category | (Medical) Patient-Data | (Regular Patient-Data) | Service Delivery Information | |||||
| Policy by
EU DS-GVO |
Owner
(Never automatically, Self-Service anytime) |
10 years | purpose-limited | Owner
(Never automatically, Self-Service anytime) |
purpose-limited | 6 years | 6 years | |
| HIPAA / US Cloud Act | ||||||||
| CH nDSG | ||||||||