Overall Readiness Statement to Start New Exchange for a Service Already in Routine Operations

DG SANTE eHDSI Wave 5 Production Environment Testing (PET) ESTONIA (EE) NCPeH Outcomes Summary Report Document Control Page Settings Value Document Title: EE NCPeH Outcomes Summary Report Project Title: eHealth DSI Document Authors: eHDSI Solution Provider Doc. Version: State of Play as of 21st of February, 2023 Status and concerned services: Wave 5 Production Environment Testing for: • ePrescription (B) • Patient Summary (A) Sensitivity: Restricted to eHMSEG, eHDSI Owner, eHDSI Solution Provider Date: 10/02/2023 1 Link to the source Confluence https://webgate.ec.europa.eu/fpfis/wikis/x/muXzN page: Table of Contents 1. Services under Preparation to GoLive (Production Environment Testing sessions) (Wave 5) ... 3 2. Coverage Completed during last Acceptance Test Event (Wave 5 Formal & Upgrade PPT) ...... 3 3. Summary of Outstanding findings .............................................................................................. 4 4. Outstanding findings ................................................................................................................... 4 5. Closed Findings, Observations, Production Testing Sessions ................................................... 10 Legend: PPT - Pre-production Formal / Upgrade Testing PET - Production Environment Testing Last updated: Feb 21, 2023 2  1. Services under Preparation to GoLive (Production Environment Testing sessions) (Wave 5) Partners in the Production Verification by the eDHSI SP. Planned Date of ID Environment Testing Link to the Session page Findings / Observations GoLive for the Session during the session for EE. services Conformance: • finding: f-29 (new) 2023-01-25 [EE (PS-A), NL (PS- Functional: S-16 EE (PS-A) - NL (PS-B) B)] Production Environment • findings: f-4, f-6, f-8, f-17, Testing f-18, f-22, f-30 (new) • observations: o-2, o-3, o- 4, o-6, o-21, o-24 Conformance: 2023-01-12 [PL (eP-A), EE (eP- • finding: f-29 (new) S-15 PL (eP-A) - EE (eP-B) B)] Production Environment Functional: Testing • observation: o-27 (new) 2. Coverage Completed during last Acceptance Test Event (Wave 5 Formal & Upgrade PPT) Conformance Tests Required Conformance Service Available partners performed - WF with tests with partners partners Conformance testing PS-A (Conformance - min CY, CZ, EL, ES, FR, HR, HU, IE, LU, LV, IE, CY, PT, LV, HU Passed 3 partners) MT, NL, PT PS-B (Conformance - min 3 CY, CZ, EL, ES, HR, IE, IT, LU, LV, MT, PT, LV, PT, SI, IE, HR Passed partners) SI eP-A (Conformance - min CY, CZ, EL, ES, FI, HR, HU, IE, LT, LV, PL, CY, IE, PT, SE, PL, LT, HU Passed 3 partners) PT, SE eP-B (Conformance - min CY, CZ, EL, ES, FI, HR, HU, IE, IT, LT, LV, SE, LT, CY, IE, PL, PT Passed 3 partners) PL, PT, SE Required evaluations Service Available partners Evaluations submitted submitted 3  Conformance Tests Required Conformance Service Available partners performed - WF with tests with partners partners Functional testing PS-A (Functional - own PS CY, CZ, EL, ES, FR, HR, HU, IE, LU, LV, service evaluated by IE, PT, CY, LV, HU Yes MT, NL, PT partners) PS-B (Functional - PS from CY, CZ, EL, ES, HR, IE, IT, LU, LV, MT, PT, IE, PT, LV Yes partners evaluated) SI eP-A (Functional - own eP CY, CZ, EL, ES, FI, HR, HU, IE, LT, LV, PL, docs evaluated by SE, LT, CZ, FI Yes PT, SE partners) eP-B (Functional - eP docs CY, CZ, EL, ES, FI, HR, HU, IE, IT, LT, LV, LT, SE, CZ, HR, HU, CY Yes from partners evaluated) PL, PT, SE eP-A (Functional - eD docs CY, CZ, EL, ES, FI, HR, HU, IE, LT, LV, PL, LT, SE, CZ, FI Yes from partners evaluated) PT, SE eP-B (Functional - own eD CY, CZ, EL, ES, FI, HR, HU, IE, IT, LT, LV, docs evaluated by SE (2), LT, CZ, HR, HU Yes PL, PT, SE partners) 3. Summary of Outstanding findings Outstanding Impact Decision has been taken by Decision has Planned to be fixed by findings been taken on f-4 Medium eHN regarding go-live 2022-06-09 Original plan: 2020 Updated plan: 2024 f-6, f-17, f-18 Medium eHN regarding go-live 2022-06-09 - f-8 Minor eHN regarding go-live 2022-06-09 - f-10 Minor eHMSEG regarding continuing routine operations 2020-08-20 Original plan: 2023 f-22 Minor eHMSEG regarding continuing routine operations 2022-09-16 - 4. Outstanding findings Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 4  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 16 Mar 2020 f-4 Agent causing the Agent is not coded in Estonia In the PS Functional Requirements, the agent causing the PPT W3, PS- allergic reaction allergic reaction is considered as 'basic', that's the reason A, Functional According to ArtDecor its R 1..1, not coded why when missing, it's considered a finding. which in turn means that we are 15 Mar 2021 allowed to use nullFlavor="NI". Solution Provider on 23 Mar 2021: this situation can be PPT W4, PS- Would it be better to remove considered as having a medium impact, given that in the A, Functional the agent overall from Estonian original narrative part of the Section and in the Level 1 PDF PS? the information about the agent causing the allergic 24 Sep 2021 reaction is provided (in Estonian). A Health Professional 29 Mar 2021 PET W3, PS- attending a patient with an allergy would need to use a A, Functional Allergy data was initially planned translation tool or, when possible and feasible (using a to be nationally available in language understood by both), ask the patient or relative 19 Nov 2021 2020, but due to covid about that information. 24 Nov 2021 developments this has been 07 Jul 2022 postponed to 2022. PET W4, PS- 21 Feb 2023: The allergy related A, Functional data, including agent causing the 30 Mar 2022 allergic reaction, is not in structured form nationally. So PPT Wave 5, far, the allergy related update of PS-A, the national data exchange Functional standards has not been started again (even though it was 25 Jan 2023 originally postponed to 2022). PET W5, PS- The issue is still there, on A, Functional national level as well, however it has been waiting behind lack of resources. At the moment the work has been planned to year 2024. We are additionally currently working on the final draft the EU direct grants application and the allergy data update in our national standards and PS is one activity described there as well. 5  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 16 Mar 2020 f-6 Medication All the prescriptions have Solution Provider on 23 Mar 2021: this situation can be PPT W3, PS- entries are different serial numbers. The considered as having a medium impact. Health A, Functional repeated three person who issued the professional can be confused especially when the number times. The prescriptions simply issued of distinct medications is high (mentioned for other PS test 24 Aug 2021 situation happens repeated prescriptions, which data that contained more repetitions) and the start date is PET W3, PS- as well in the are all displayed separately. The not indicated. A, Functional narrative part and prescription numbers are visible in the Level 1 PDF in the original untranslated 19 Nov 2021 section of PS 24 Nov 2021 The same 07 Jul 2022 medicinal product 29 Mar 2021 PET W4, PS- repeated several Depending on the situation the A, Functional times doctors will still prescribe the prescriptions as they have so far, 25 Jan 2023 so for the repeated prescriptions PET W5, PS- it is expected to see 3 A, Functional prescriptions with the same data, but different prescription number. Statistically, about half of the prescriptions prescribed in Estonia are repeated prescriptions. 16 Mar 2020 f-8 Onset date of No data in Estonia Date of onset of medication is considered a 'basic' element PPT W3, PS- medication not in the PS Functional Requirements. A, Functional 06 May 2021 present Solution Provider on 23 Mar 2021: this situation can be We discussed the topic internally 24 Aug 2021 Duration of considered as having a minor impact, especially when and eventually HWISC feels that PET W3, PS- treatment not providing the date of onset of the health problem for which there is no right way to present A, Functional present the medication is prescribed. the data (time, when the prescription was issued isn't Only in some situations it would be more relevant: e.g. 19 Nov 2021 really correct and the time it was recent prescriptions causing an adverse reaction, to 24 Nov 2021 dispensed is also not correct). evaluate a lack of efficacy of a treatment. 07 Jul 2022 Since „The agreed data elements PET W4, PS- must be sent by each NCPeH, A, Functional even if there is no content available (exceptional values are 30 Mar 2022 allowed)“ we should be fine, PPT Wave 5, since we are sending the PS-A, element itself and using UNK. Functional 25 Jan 2023 PET W5, PS- A, Functional 6  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 16 Mar 2020 f- Package size is Update July 2020: we will wait The way to represent the package size was not understood PPT W3, eP-A 10 provided for the change proposal to fix by the receiver of the document (eP and eD). & eP-B, multiplying the this issue, since the additional Functional This issue was discussed during the Joint Online meeting of volume of the text element solution (which the STF on June 10 and it was proposed to prepare a units times the was accepted the last time) isn't Change Proposal to introduce a new data element that number of units in a proper solution. would allow the complete description of complex the package. 02 Apr 2021: Situation is the medications. Additionally using same. Solution Provider on 03 Aug 2020: minor impact. the originalText element to The eP documents from EE contain the detailed description provide the units of the medicinal product in the case of complex per package. medications such as Lantus. Lantus -as well as other medicinal products- have a variety of presentations as regards number of units in the package and volume per unit. The description of the package is present in the original narrative plus in the originalText sub-element of the capacityQuantity element. Therefore, the dispenser will find the information needed about the exact presentation prescribed. UPDATE on 04 Aug 2020: also, the Level 1 PDF contains the detailed description of the package. Solution Provider on 12 Oct 2021: The CP-eHealthDSI-063: Improve Medication Information Representation (https://webgate.ec.europa.eu/fpfis/wikis/x/UYm1Nw) was submitted on 30 Sep 2021. 7  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 19 Nov 2021 f- No coded Since the medical devices value Solution Provider on 25 Jan 2022 : this finding considered 24 Nov 2021 17 information for set is much more granulated in as having medium impact on eHDSI. 07 Jul 2022 the Medical Estonia we do not provide PET W4, PS- Translated information about medical devices could be Device in the mappings and translations for A, Functional very useful during an emergency situation. It is a reality entry, information those, since the result might not that such information might not be even readily available in Estonian in the be accurate. This was agreed 30 Mar 2022 nationally during an emergency contact, therefore, the narrative and in with Marta Terron Cuadrado PPT Wave 5, attending physician would be careful when the Level 1 PDF before. PS-A, ordering/interpreting an imaging test with which an Functional Since increasing the value sets is implant might interfere. a task for eHDSI, then NCPeH 30 new SNOMED CT concepts are included in the value set 25 Jan 2023 can not provide an action plan of eHDSIMedicalDevice for Wave 5: CP-eHealthDSI-049: PET W5, PS- for this. Extend eHDSIMedicalDevice Value Set. In total, there are A, Functional 100 codes for medical devices in the value set. In addition, the reviewing of concepts in this Value Set is planning during the next STF Semantic WG meeting on 03 Feb 2022. MSs can provide their proposals for the SNOMED GPS extensions until the end of February 2022. Solution Provider on 13 May 2022: The information how to proceed when concept cannot be mapped please see here: Facilitation of coded information exchange: what to do with data that cannot be mapped. 8  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 19 Nov 2021 f- No coded Since the surgical procedures Solution Provider on 25 Jan 2022 : this finding considered 24 Nov 2021 18 information for value set is much more as having medium impact on eHDSI. 07 Jul 2022 the Surgical granulated in Estonia we do not PET W4, PS- Translated information about surgical procedures could be procedures in the provide mappings and A, Functional very useful during an emergency situation (e.g. knowing a entry, information translations for those, since the past surgery referring to the implantation of a medical in Estonian in the result might not be accurate. 30 Mar 2022 device or to the transplantation of an organ). It is a reality narrative and in This was agreed with Marta PPT Wave 5, that such information might not be even readily available the Level 1 PDF Terron Cuadrado before. PS-A, nationally during an emergency contact, therefore, the Functional Since increasing the value sets is attending physician would be careful when a task for eHDSI, then NCPeH ordering/interpreting an imaging test with which an 25 Jan 2023 can not provide an action plan implant might interfere. PET W5, PS- for this. 519 new SNOMED CT concepts for surgical procedures A, Functional were included in the value set of eHDSIProcedure for Wave 4: CP-eHealthDSI-053: Extend the value set for procedures. In total, there are 621 codes for surgical procedures in the value set. Also the reviewing of concepts in this Value Set is planning during the next STF Semantic WG meeting on 03 Feb 2022. MSs can provide their proposals for the SNOMED GPS extensions until the end of February 2022. Solution Provider on 13 May 2022: The information how to proceed when concept cannot be mapped please see here: Facilitation of coded information exchange: what to do with data that cannot be mapped. 30 Mar 2022 f- Allergy and Reaction type is not coded in Solution Provider on 29 Jul 2022 : this finding considerer as PPT Wave 5, 22 Intolerance: Estonia having minor impact on eHDSI. PS-A, allergy reaction Functional This information is currently not In requirement catalogue this attribute is marked as basic type not coded available in a coded from in and in many legacy systems it is captured, however 07 Jul 2022 Estonia. We are working towards clinically this attribute might not be well-defined or PET Wave 4, having the allergy data in a understood. It is acknowledged that many clinicians might PS-A, structured format both on a not be in a position to distinguish the mechanism of a Functional national and cross-border level. particular reaction. More relevant information would be allergen and/or clinical manifestation of allergy or According to Art-Decor its R 1..1, 25 Jan 2023 intolerance which both are provided in the section of which means that we are PET W5, PS- Allergy and Intolerance in EE PS document. allowed to use nullFlavor="NI". A, Functional 9  Service & Comments and/or Action Plan ID Finding Comments by the eHDSI Solution Provider Test Event by the NCPeH 12 Jan 2023 f- Provided audit on 09 Feb 2023: we are currently Solution provider on 10 Jan 2023: PET Wave 5, 29 messages do not working on finding a solution for eP-A & eP-B, This issue is probably related to the fact that evidence are contain signature. the issue. Conformance taken from the local disk, since the expected audit messages are not present in the database. This is most probably a database related issue (PostgreSQL) that needs to be investigated and fixed on EE side. The Estonian team already contacted us with question related to this issue. Solution Provider on 10 Feb 2023: this issue is considered as having minor impact. 5. Closed Findings, Observations, Production Testing Sessions The closed findings, observations and Production Testing sessions can be found at the following link: https://webgate.ec.europa.eu/fpfis/wikis/x/qOXzN 10 Ref. Ares(2021)2833831 - 28/04/2021 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response 1 To update the Data Protection Impact Assessment DPIA will be amended by HWSICs legal While the amended DPIA still does not (DPIA) in order to cover risks to all patient’s department and the Minsitry of Social Affairs provide for an assessment of the risks to rights and in particular, to ensure that the DPIA by the end of March 2021. Please see patient's rights, pursuing this provides an assessment of the impact of the new document “LISA 7”. recommendation is unlikely to be productive services on all of the patient’s rights as required by for two main reasons: Article 37.1 and 37.7(c). - The requirement is not specific enough (the Associated finding: No 1 finding being about the achievement of the objectives of an impact assessment). - The underlying finding seems to be a common occurrence in other Member States. Therefore, Unit F5 proposes that no further requests for information or other follow-up actions are made in relation to this recommendation. 2 To ensure that PS-A service is based on consent, Estonia is still in the situation where the While the situation in Estonia is considered as required by Interoperability and Identity functional requirements of the service are non-compliant with the current eHDSI Management specifications. against our national legislation and GDPR. A requirements, the audit team acknowledges Associated finding: No 2 change proposal is being prepared for the that the requirements are under review and alignment of eHDSI Requirements with EU that they are likely to change soon. legislation and the Agreement between Therefore, implementation of a consent National Authorities or National management process at this point in time Organisations responsible for national contact would not be productive. points. This also states “Requirements related to the explicit consent as the single legal Therefore, Unit F5 proposes that no further bases to be applied by MSs on the Cross- requests for information or other follow-up Border health personal data exchange should actions are made in relation to this Page: 1 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response be removed or updated in line with the legal recommendation. provisions of the Agreement between National Authorities or National Organisations responsible for National Contact Points for eHealth on the Criteria required for the participation in Cross-Border eHealth Information Services, the Directive 2011/24/EU and the GDPR.” Please see document CP-Consent.docx 3 To ensure that the data controller can demonstrate Foreign patient can’t give his/her consent in This recommendation is linked to the that the foreign patient has consented to the cross- country B, it has to be given prior the visit to previous one (No 2), and it will also become border exchange of patient summary (in PS-B HCP via country A systems. This is explained redundant when the requirement on consent service), as required by Article 7.1 of the GDPR, in the patient information notice, please see management has been reviewed and interoperability specification and identity document “Patsiendi teavitamine PS-B amended. management specification. EST_03.docx” Associated finding: No 3 Therefore, Unit F5 proposes that no further requests for information or other follow-up actions are made in relation to this recommendation. 4 To finalise the Patient Information Notices for PS- PINs will be finalised and published by the Satisfactory. A and PS-B services as required by business end of March 2021 by HWSIC requirement 04.03 of the Requirements Catalogue. Please see documents “Patsiendi teavitamine The PINs must be translated into official Associated finding: No 4 PS-B EST_03.docx” and “Patsiendi languages of the Member States, which are teavitamine PS-A EST_03.docx” currently providing PS-A service. 5 To develop measurable indicators for When it comes to monitoring integrity and Satisfactory. confidentiality and integrity in PS-A and PS-B confidentiality, in some cases, we have Page: 2 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response services. The indicators should be suitable for quarterly checks on the assigned rights that The plan to further develop indicators is setting measurable targets and reviewing the are given to users, also all activities are adequate. In the absence of specific achievement of targets on a regular basis. logged and therefore it is possible to identify requirements, it is up to the NCP to decide Associated finding: No 5 wrongdoings in the information systems. The the best way to develop indicators. best way to monitor integrity and confidentiality is with incidents. Additional indicators checking the incidents will be added to the service pass by mid April 2021. 6 To review and update the Information Security An additional risk assessment will be Satisfactory. Risk Assessment in order to ensure that relevant conducted by the end of March 2021 by an risks are covered, residual risks are at acceptable outer party. The plan to further develop the Risk level and that the results are presented in a clear Please see documents attached TEHIK Assessment is adequate. Nevertheless,Unit and intelligible way. riskianalüüsi aruanne.docx and Lisa 3. F5 would like to leave it on record that it is Associated finding: No 6 Riskianalüüsi tabel.xlsx not in a position to determine whether this new Risk Assessment is fit for purpose. 7 To verify and demonstrate that all Health Care IS-connector will be removed from the Satisfactory. Provider Organisations comply with the project for the mentioned security reasons. authentication requirements of the contract and to Amended architecture scheme will be The corrective action is satisfactory and fully discontinue the use of IS-connector for available mid April 2021. addresses the recommendation. authentication. Associated findings: Nos 7 and 8 8 To ensure that all TLS connections are configured TLS connection configurations will be Satisfactory. at least to the minimum security level required by rechecked against the eHDSI requirements eHDSI requirements. and regular scans will be discussed and The proposed action is adequate in Associated finding: No 9 documented by the end of March 2021. addressing the recommendation. CEF scan is defined in HWISC cybersecurity Page: 3 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response environment https://spot.tehik.ee/display/TEH/INFOTUR BETEENUSED -> Turvanõrkuste skaneerimine (access limited). In addition, the information has been added to the service pass, document teenuse_pass.pdf, paragraph 6.2.4 Turvanõrkuste skaneerimine. The results of the vulnerability scan will show us the protocols in use. From there on we will continue our change management process (if necessary), document the results in Jira and proceed with the TLS connections alignment with eHDSI requirements. 9 To ensure that cryptographic keys are not Generating the cryptographic keys is based Satisfactory. generated with a weak generator. on HWISC cryptoconcept point 4.4. Since Associated finding: No 10 they are generated by OpenSSL software we The planned action is adequate in addressing assume that it is safe (until proven otherwise). the recommendation. For checking the length of the keys we will add additional controls to monitoring, so that the keys will match the requirements in cryptoconcept, which will be done by the end of February 2021 by HWISc monitoring dep. Please see documents Zabbix (monitoring screenshot on the example of cross border ePrescription) and script external_checks_ssl_check.py 10 To ensure that all certificates are issued by Trust A new service provider (from the EU trusted Satisfactory. Page: 4 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response Service providers, which appear on the EU list) for the NCPeH portal will be added by Trusted List of trust service providers and that the the end of March, which also includes a new The action is adequate in addressing the validity of certificates does not exceed two years. certificate. recommendation. Associated finding: No 11 We have sent a request to the head of HWISC Information Systems Administration Department in order to get a new certificate, but it is still pending. New information will be available in the beginning of April 2021 11 To formalise a procedure for handling findings The regularity of the scans will be described Satisfactory. from vulnerability scans or penetration tests in in HWISCs internal system SPOT and by the order to ensure that timely corrective action is end of February 2021. The action is adequate in addressing the taken. CEF scan is defined in HWISC cybersecurity recommendation. Associated finding: No 12 environment https://spot.tehik.ee/display/TEH/INFOTUR BETEENUSED -> Turvanõrkuste skaneerimine (access limited). In addition, the information has been added to the service pass, document teenuse_pass.pdf, paragraph 6.2.4 Turvanõrkuste skaneerimine. 12 To ensure that health-care related data is not Comment from the auditors: The requirement Satisfactory. included in (audit trail) logs. is using the term “healthcare-related data”, Associated finding: No 13 which might be a bit open for interpretation. The explanation provided is sufficient to What it definitely means, is that medical address the recommendation. For the file, if information from patient summary should not this information had been provided during be there. Some information about the health the audit, there would have been no need to care provider might be necessary to provide issue a recommendation. for non-repudiation and possibly other Page: 5 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response functionalities – including the abuse detection system. So, in summary we could say that we can live with storing health-care professional data but definitely not data concerning the medical details of a patient. HWISC: we have only included the health care professional data in ATNA logs, but not the patients, so this finding should not be a finding. 13 To ensure that configuration and change Changes required by vulnerability scan were Satisfactory. management processes are in line with not captured in change management, but will requirements and suitable for achieving the be resolved with the solution of a finding no The planned action adequately addresses the objectives. 12. recommendation. Associated findings: Nos 14 and 15 Events, incidents and problems will be identified more thoroughly by mid April 2021 by HWISC quality management. 14 To improve the monitoring of service availability Monitoring and service availability will be Satisfactory. and response time. improved after we have a new partner from Associated finding: No 16 the procurement process (should happen in The planned action adequately addresses the February 2021) by mid April 2021. recommendation. 15 To update the communication plan with necessary Communications plan will be updated by the Satisfactory. details and timelines in order to be ready for end of March 2021 by HWISC rolling out awareness and training activities before communication team, please see document The planned action satisfactorily addresses and after going live, as appropriate. attached “CPTP-2.3.Teavitustegevused.pdf”, the recommendation. Associated finding: No 17 patient summary information starting from “Tegevused Eesti riik A ja B vaatest Page: 6 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response (patsiendi terviseandmete kokkuvõtte saatja ja vastuvõtja riik)” Page: 7 Ref. Ares(2021)2833831 - 28/04/2021 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY Health and food audits and analysis Director Grange SANTE.F5 JJ/mmoc Subject: Verification of implementation of corrective actions Audit of Estonia carried out from 4 June to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B Ref.: DG(SANTE) 2020-7091 Dear Ms Reinhold, I am writing to inform you that the audit team has now verified the implementation of the actions taken in response to the recommendations made following the above-mentioned audit. I am pleased to inform you that the audit team has concluded that all recommendations (except for Nos 1 to 3) have been satisfactorily addressed. The audit team has proposed no further request for information or other follow-up actions in relation to recommendations Nos 1 to 3, for the reasons indicated in the attached table. Yours sincerely, (e-signed) María Pilar Aguar Fernández Director Enclosure: Annex Ms Katrin Reinhold Director Health and Welfare Information Systems Centre (HWISC) Veerenni 13/Uus-Tatari 25 10134 Tallinn Estonia European Commission, Grange, Dunsany, Co. Meath C15 DA39, Ireland - Office: GRAN 01/113 Tel.: direct line (+353 46) 9061 788, internal n°: 70788, switchboard: (+353 46) 9061 700. Fax: (+353 46) 9061 705