Overall Readiness Statement to Start New Service in Routine Operations

DG SANTE eHDSI Wave 4 Production Environment Testing (PET) ESTONIA (EE) NCPeH Outcomes Summary Report Document Control Page Settings Value Document Title: EE NCPeH Outcomes Summary Report Project Title: eHealth DSI Document Authors: eHDSI Solution Provider Doc. Version: State of Play as of 2nd of May, 2022 Status and concerned services: Wave 4 Pre-Production Testing for • Patient Summary (A) • Patient Summary (B) Sensitivity: Restricted to eHMSEG, eHDSI Owner, eHDSI Solution Provider Date: 02/05/2022 1 Link to the source Confluence https://webgate.ec.europa.eu/fpfis/wikis/x/muXzN page: Table of Contents 1. Services under Preparation to GoLive (Production Environment Testing sessions) (Wave 4) ... 3 2. Coverage Completed during last Acceptance Test Event (Wave 4 Formal & Upgrade PPT) ...... 3 3. Outstanding findings ............................................................................................................ 4 4. Closed Findings, Observations, Production Testing Sessions .................................................. 8 Legend: PPT - Pre-production Formal / Upgrade Testing PET - Production Environment Testing Last updated: Jun 1, 2022 2  1. Services under Preparation to GoLive (Production Environment Testing sessions) (Wave 4) Partners in the Verification by the eDHSI SP. Planned Date of ID Production Environment Link to the Session page Findings / Observations during the GoLive for the Testing Session session for EE. services Conformance: no issues identified Functional: 2021-11-19 [EE (PS-A), LU • Findings: f-4, f-6, f-8, f-17 S-9 EE (PS A) - LU (PS B) (PS-B)] Production (new), f-18 (new) Environment Testing • Observations: o-2, o-3, o-4, o-5, o-6, o-8, o-21 Conformance: no issues identified 2021-11-24 [EE (PS-A), PT Functional: S-10 EE (PS A) - PT (PS B) (PS-B)] Production • Findings: f-4, f-6, f-8, f-17 Environment Testing (new), f-18 (new) • Observations: o-2, o-3, o-4, o-5, o-6, o-8, o-21 Conformance: no issues identified Functional: 2021-11-24 [EE (PS-A), FR • Findings: f-4, f-6, f-8, f-17 S-11 EE (PS A) - FR (PS B) (PS-B)] Production (new), f-18 (new) Environment Testing • Observations: o-2, o-3, o-4, o-5, o-6, o-8, o-21 2022-01-10 [PT (PS-A), EE Conformance: no issues identified S-12 PT (PS A) - EE (PS B) (PS-B)] Production Functional: no issues identified Environment Testing 2. Coverage Completed during last Acceptance Test Event (Wave 4 Formal & Upgrade PPT) Conformance Tests Required Conformance Service Available partners performed - WF with tests with partners partners Conformance testing PS-A (Conformance - min HR, CY, CZ, EE, FR, GR, HU, LU, MT, NL, HR, CY, CZ, EE, FR, GR, Yes 3 partners) PT, ES HU, LU, MT, NL, PT, ES 3  Conformance Tests Required Conformance Service Available partners performed - WF with tests with partners partners PS-B (Conformance - min 3 HR, CY, CZ, EE, GR, IE, HR, CY, CZ, EE, GR, IE, LU, MT, PT, SI, ES Yes partners) LU, MT, PT, SI, ES eP-A (Conformance - min HR, CY, CZ, FI, GR, HU, HR, CY, CZ, FI, GR, HU, PL, PT, ES, SE Yes 3 partners) PL, PT, ES, SE eP-B (Conformance - min HR, CY, CZ, FI, GR, HU, IE, LU, PL, PT, ES, HR, CY, CZ, FI, GR, HU, Yes 3 partners) SE IE, LU, PL, PT, ES, SE Required evaluations Service Available partners Evaluations submitted submitted Functional testing PS-A (Functional - own PS HR, CY, CZ, EE, FR, GR, HU, LU, MT, NL, service evaluated by HR, GR, HU Yes PT, ES partners) PS-B (Functional - PS from HR, CY, CZ, EE, GR, IE, LU, MT, PT, SI, ES HR, CZ, PT, SI Yes partners evaluated) eP-A (Functional - own eP docs evaluated by HR, CY, CZ, FI, GR, HU, PL, PT, ES, SE FI, PL, SE Yes partners) eP-B (Functional - eP docs HR, CY, CZ, FI, GR, HU, IE, LU, PL, PT, ES, FI, PL, SE Yes from partners evaluated) SE eP-A (Functional - eD docs HR, CY, CZ, FI, GR, HU, PL, PT, ES, SE FI, PL, SE Yes from partners evaluated) eP-B (Functional - own eD HR, CY, CZ, FI, GR, HU, IE, LU, PL, PT, ES, docs evaluated by FI, PL, SE Yes SE partners) 3. Outstanding findings Service & Test Comments and/or Action Plan by the Comments by the eHDSI ID Finding Event NCPeH Solution Provider 4  Service & Test Comments and/or Action Plan by the Comments by the eHDSI ID Finding Event NCPeH Solution Provider In the PS Functional Requirements, the agent causing the allergic reaction is considered as 'basic', that is 16 Mar 2020 the reason why when missing, PPT W3, PS- and it has considered a A, Functional finding. According to ArtDecor its R 1..1, which 15 Mar 2021 in turn means that we are allowed to Solution Provider on 23 Mar PPT W4, PS- use nullFlavor="NI". Would it be better 2021: this situation can be A, Functional to remove the agent overall from considered as having a Estonian PS? medium impact, given that in 24 Sep 2021 Agent causing the allergic the original narrative part of f-4 the Section and in the Level 1 PET W3, PS- reaction not coded A, Functional 29 Mar 2021 PDF the information about the agent causing the allergic Allergy data was initially planned to be 19 Nov 2021 reaction is provided (in nationally available in 2020, but due to 24 Nov 2021 Estonian). A Health covid developments this has been PET W4, PS- Professional attending a postponed to 2022. A, Functional patient with an allergy would need to use a translation tool or, when possible and feasible (using a language understood by both), ask the patient or relative about that information. 16 Mar 2020 PPT W3, PS- Solution Provider on 23 Mar 29 Mar 2021 A, Functional Medication entries are 2021: this situation can be repeated three times. The Depending on the situation the doctors considered as having a 24 Aug 2021 situation happens as well in will still prescribe the prescriptions as medium impact. Health PET W3, PS- the narrative part and in the they have so far, so for the repeated professional can be confused f-6 A, Functional Level 1 PDF prescriptions it is expected to see 3 especially when the number of prescriptions with the same data, but distinct medications is high 19 Nov 2021 different prescription number. (mentioned for other PS test 24 Nov 2021 The same medicinal product Statistically, about half of the data that contained more PET W4, PS- repeated several times. prescriptions prescribed in Estonia are repetitions) and the start date A, Functional repeated prescriptions. is not indicated. 5  Service & Test Comments and/or Action Plan by the Comments by the eHDSI ID Finding Event NCPeH Solution Provider Date of onset of medication is considered a 'basic' element in 16 Mar 2020 06 May 2021 the PS Functional PPT W3, PS-A, Requirements. We discussed the topic internally and Functional Solution Provider on 23 Mar eventually HWISC feels that there is no right way to present the data (time, 2021: this situation can be 24 Aug 2021 considered as having a when the prescription was issued isn't PET W3, PS-A, minor impact, especially when Onset date of medication not really correct and the time it was f-8 Functional providing the date of onset of present dispensed is also not correct). Since „The agreed data elements must the health problem for which 19 Nov 2021 the medication is prescribed. be sent by each NCPeH, even if there is 24 Nov 2021 no content available (exceptional values Only in some situations, it PET W4, PS-A, are allowed)“ we should be fine, since would be more relevant: e.g. Functional we are sending the element itself and recent prescriptions causing using UNK. an adverse reaction, to evaluate a lack of efficacy of a treatment. 6  Service & Test Comments and/or Action Plan by the Comments by the eHDSI ID Finding Event NCPeH Solution Provider Solution Provider on 25 Jan 2022: this finding considered as having medium impact on eHDSI. Translated information about medical devices could be very useful during an emergency. It is a reality that such information might not be even readily available nationally during an emergency contact, therefore, the attending physician would be careful 19 Nov 2021 when ordering/interpreting an 24 Nov 2021 No coded information for the imaging test with which an PET W4, PS-A, Medical Device in the entry, Since increasing the value sets is a task implant might interfere. f-17 Functional information in Estonian in the for eHDSI, then NCPeH can not provide narrative and in the Level 1 an action plan for this. 30 new SNOMED CT concepts PDF are included in the value set of eHDSIMedicalDevice for Wave 5: CP-eHealthDSI-049: Extend eHDSIMedicalDevice Value Set. In total, there are 100 codes for medical devices in the value set. In addition, the reviewing of concepts in this Value Set is planning during the next STF Semantic WG meeting on 03 Feb 2022. MSs can provide their proposals for the SNOMED GPS extensions until the end of February 2022. 7  Service & Test Comments and/or Action Plan by the Comments by the eHDSI ID Finding Event NCPeH Solution Provider Solution Provider on 25 Jan 2022 : this finding considered as having medium impact on eHDSI. Translated information about surgical procedures could be very useful during an emergency (e.g. knowing a past surgery referring to the implantation of a medical device or to the transplantation of an organ). It is a reality that such information might not be even readily available nationally during an emergency contact, therefore, the attending 19 Nov 2021 No coded information for the physician would be careful 24 Nov 2021 Surgical procedures in the Since increasing the value sets is a task when ordering/interpreting an f-18 PET W4, PS-A, entry, information in Estonian for eHDSI, then NCPeH can not provide imaging test with which an Functional in the narrative and in the an action plan for this. implant might interfere. Level 1 PDF 519 new SNOMED CT concepts for surgical procedures were included in the value set of eHDSIProcedure for Wave 4: CP-eHealthDSI-053: Extend the value set for procedures. In total, there are 621 codes for surgical procedures in the value set. Also the reviewing of concepts in this Value Set is planning during the next STF Semantic WG meeting on 03 Feb 2022. MSs can provide their proposals for the SNOMED GPS extensions until the end of February 2022. 4. Closed Findings, Observations, Production Testing Sessions The closed findings, observations and Production Testing sessions can be found at the following link: https://webgate.ec.europa.eu/fpfis/wikis/x/qOXzN 8  eHealth DSI Member State Expert Group Decision regarding Estonia NCPeH to be authorised to start the Production Environment Testing with service PS A and PS B Having analysed the audit and Pre-Production Testing of Estonia. eHMSEG considers the following functional findings f-4, and f-6 have a medium impact on the eHDSI, and finding f-8 have low impact on the eHDSI. eHMSEG has determined these findings can be resolved during routine operations. There are two findings from the initial audit, on which the auditors concluded that no further requests for information or other follow-up actions are needed. The eHMSEG takes note on the fact, that EE have not finished the conformance tests with three partners, due to the exceptional situation, which was the outburst of the COVID -19 pandemic. Having said so, the eHMSEG decides that EE NCPeH is authorised to start the Production Environment Testing of service PS A and PS B. In addition, findings f-4, f-6 and f-8 do not prevent NCPeH from starting routine operations, provided that all the Production Environment Tests sessions are fulfilled and there are no further findings impeding the go-live after these tests. Adopted by the eHMSEG on 15.06.2021  Ref. Ares(2021)2833831 - 28/04/2021 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HEALTH AND FOOD SAFETY Health and food audits and analysis Director Grange SANTE.F5 JJ/mmoc Subject: Verification of implementation of corrective actions Audit of Estonia carried out from 4 June to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B Ref.: DG(SANTE) 2020-7091 Dear Ms Reinhold, I am writing to inform you that the audit team has now verified the implementation of the actions taken in response to the recommendations made following the above-mentioned audit. I am pleased to inform you that the audit team has concluded that all recommendations (except for Nos 1 to 3) have been satisfactorily addressed. The audit team has proposed no further request for information or other follow-up actions in relation to recommendations Nos 1 to 3, for the reasons indicated in the attached table. Yours sincerely, (e-signed) María Pilar Aguar Fernández Director Enclosure: Annex Ms Katrin Reinhold Director Health and Welfare Information Systems Centre (HWISC) Veerenni 13/Uus-Tatari 25 10134 Tallinn Estonia European Commission, Grange, Dunsany, Co. Meath C15 DA39, Ireland - Office: GRAN 01/113 Tel.: direct line (+353 46) 9061 788, internal n°: 70788, switchboard: (+353 46) 9061 700. Fax: (+353 46) 9061 705  Ref. Ares(2021)2833831 - 28/04/2021 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response 1 To update the Data Protection Impact Assessment DPIA will be amended by HWSICs legal While the amended DPIA still does not (DPIA) in order to cover risks to all patient’s department and the Minsitry of Social Affairs provide for an assessment of the risks to rights and in particular, to ensure that the DPIA by the end of March 2021. Please see patient's rights, pursuing this provides an assessment of the impact of the new document “LISA 7”. recommendation is unlikely to be productive services on all of the patient’s rights as required by for two main reasons: Article 37.1 and 37.7(c). - The requirement is not specific enough (the Associated finding: No 1 finding being about the achievement of the objectives of an impact assessment). - The underlying finding seems to be a common occurrence in other Member States. Therefore, Unit F5 proposes that no further requests for information or other follow-up actions are made in relation to this recommendation. 2 To ensure that PS-A service is based on consent, Estonia is still in the situation where the While the situation in Estonia is considered as required by Interoperability and Identity functional requirements of the service are non-compliant with the current eHDSI Management specifications. against our national legislation and GDPR. A requirements, the audit team acknowledges Associated finding: No 2 change proposal is being prepared for the that the requirements are under review and alignment of eHDSI Requirements with EU that they are likely to change soon. legislation and the Agreement between Therefore, implementation of a consent National Authorities or National management process at this point in time Organisations responsible for national contact would not be productive. points. This also states “Requirements related to the explicit consent as the single legal Therefore, Unit F5 proposes that no further bases to be applied by MSs on the Cross- requests for information or other follow-up Border health personal data exchange should actions are made in relation to this Page: 1 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response be removed or updated in line with the legal recommendation. provisions of the Agreement between National Authorities or National Organisations responsible for National Contact Points for eHealth on the Criteria required for the participation in Cross-Border eHealth Information Services, the Directive 2011/24/EU and the GDPR.” Please see document CP-Consent.docx 3 To ensure that the data controller can demonstrate Foreign patient can’t give his/her consent in This recommendation is linked to the that the foreign patient has consented to the cross- country B, it has to be given prior the visit to previous one (No 2), and it will also become border exchange of patient summary (in PS-B HCP via country A systems. This is explained redundant when the requirement on consent service), as required by Article 7.1 of the GDPR, in the patient information notice, please see management has been reviewed and interoperability specification and identity document “Patsiendi teavitamine PS-B amended. management specification. EST_03.docx” Associated finding: No 3 Therefore, Unit F5 proposes that no further requests for information or other follow-up actions are made in relation to this recommendation. 4 To finalise the Patient Information Notices for PS- PINs will be finalised and published by the Satisfactory. A and PS-B services as required by business end of March 2021 by HWSIC requirement 04.03 of the Requirements Catalogue. Please see documents “Patsiendi teavitamine The PINs must be translated into official Associated finding: No 4 PS-B EST_03.docx” and “Patsiendi languages of the Member States, which are teavitamine PS-A EST_03.docx” currently providing PS-A service. 5 To develop measurable indicators for When it comes to monitoring integrity and Satisfactory. confidentiality and integrity in PS-A and PS-B confidentiality, in some cases, we have Page: 2 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response services. The indicators should be suitable for quarterly checks on the assigned rights that The plan to further develop indicators is setting measurable targets and reviewing the are given to users, also all activities are adequate. In the absence of specific achievement of targets on a regular basis. logged and therefore it is possible to identify requirements, it is up to the NCP to decide Associated finding: No 5 wrongdoings in the information systems. The the best way to develop indicators. best way to monitor integrity and confidentiality is with incidents. Additional indicators checking the incidents will be added to the service pass by mid April 2021. 6 To review and update the Information Security An additional risk assessment will be Satisfactory. Risk Assessment in order to ensure that relevant conducted by the end of March 2021 by an risks are covered, residual risks are at acceptable outer party. The plan to further develop the Risk level and that the results are presented in a clear Please see documents attached TEHIK Assessment is adequate. Nevertheless,Unit and intelligible way. riskianalüüsi aruanne.docx and Lisa 3. F5 would like to leave it on record that it is Associated finding: No 6 Riskianalüüsi tabel.xlsx not in a position to determine whether this new Risk Assessment is fit for purpose. 7 To verify and demonstrate that all Health Care IS-connector will be removed from the Satisfactory. Provider Organisations comply with the project for the mentioned security reasons. authentication requirements of the contract and to Amended architecture scheme will be The corrective action is satisfactory and fully discontinue the use of IS-connector for available mid April 2021. addresses the recommendation. authentication. Associated findings: Nos 7 and 8 8 To ensure that all TLS connections are configured TLS connection configurations will be Satisfactory. at least to the minimum security level required by rechecked against the eHDSI requirements eHDSI requirements. and regular scans will be discussed and The proposed action is adequate in Associated finding: No 9 documented by the end of March 2021. addressing the recommendation. CEF scan is defined in HWISC cybersecurity Page: 3 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response environment https://spot.tehik.ee/display/TEH/INFOTUR BETEENUSED -> Turvanõrkuste skaneerimine (access limited). In addition, the information has been added to the service pass, document teenuse_pass.pdf, paragraph 6.2.4 Turvanõrkuste skaneerimine. The results of the vulnerability scan will show us the protocols in use. From there on we will continue our change management process (if necessary), document the results in Jira and proceed with the TLS connections alignment with eHDSI requirements. 9 To ensure that cryptographic keys are not Generating the cryptographic keys is based Satisfactory. generated with a weak generator. on HWISC cryptoconcept point 4.4. Since Associated finding: No 10 they are generated by OpenSSL software we The planned action is adequate in addressing assume that it is safe (until proven otherwise). the recommendation. For checking the length of the keys we will add additional controls to monitoring, so that the keys will match the requirements in cryptoconcept, which will be done by the end of February 2021 by HWISc monitoring dep. Please see documents Zabbix (monitoring screenshot on the example of cross border ePrescription) and script external_checks_ssl_check.py 10 To ensure that all certificates are issued by Trust A new service provider (from the EU trusted Satisfactory. Page: 4 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response Service providers, which appear on the EU list) for the NCPeH portal will be added by Trusted List of trust service providers and that the the end of March, which also includes a new The action is adequate in addressing the validity of certificates does not exceed two years. certificate. recommendation. Associated finding: No 11 We have sent a request to the head of HWISC Information Systems Administration Department in order to get a new certificate, but it is still pending. New information will be available in the beginning of April 2021 11 To formalise a procedure for handling findings The regularity of the scans will be described Satisfactory. from vulnerability scans or penetration tests in in HWISCs internal system SPOT and by the order to ensure that timely corrective action is end of February 2021. The action is adequate in addressing the taken. CEF scan is defined in HWISC cybersecurity recommendation. Associated finding: No 12 environment https://spot.tehik.ee/display/TEH/INFOTUR BETEENUSED -> Turvanõrkuste skaneerimine (access limited). In addition, the information has been added to the service pass, document teenuse_pass.pdf, paragraph 6.2.4 Turvanõrkuste skaneerimine. 12 To ensure that health-care related data is not Comment from the auditors: The requirement Satisfactory. included in (audit trail) logs. is using the term “healthcare-related data”, Associated finding: No 13 which might be a bit open for interpretation. The explanation provided is sufficient to What it definitely means, is that medical address the recommendation. For the file, if information from patient summary should not this information had been provided during be there. Some information about the health the audit, there would have been no need to care provider might be necessary to provide issue a recommendation. for non-repudiation and possibly other Page: 5 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response functionalities – including the abuse detection system. So, in summary we could say that we can live with storing health-care professional data but definitely not data concerning the medical details of a patient. HWISC: we have only included the health care professional data in ATNA logs, but not the patients, so this finding should not be a finding. 13 To ensure that configuration and change Changes required by vulnerability scan were Satisfactory. management processes are in line with not captured in change management, but will requirements and suitable for achieving the be resolved with the solution of a finding no The planned action adequately addresses the objectives. 12. recommendation. Associated findings: Nos 14 and 15 Events, incidents and problems will be identified more thoroughly by mid April 2021 by HWISC quality management. 14 To improve the monitoring of service availability Monitoring and service availability will be Satisfactory. and response time. improved after we have a new partner from Associated finding: No 16 the procurement process (should happen in The planned action adequately addresses the February 2021) by mid April 2021. recommendation. 15 To update the communication plan with necessary Communications plan will be updated by the Satisfactory. details and timelines in order to be ready for end of March 2021 by HWISC rolling out awareness and training activities before communication team, please see document The planned action satisfactorily addresses and after going live, as appropriate. attached “CPTP-2.3.Teavitustegevused.pdf”, the recommendation. Associated finding: No 17 patient summary information starting from “Tegevused Eesti riik A ja B vaatest Page: 6 ANNEX Commission services' assessment of the action plan submitted by the competent authorities of Estonia in response to Report ref. DG(SANTE) 2020-7091 of the audit carried out from 04 June 2020 to 16 October 2020 in order to assess the National Contact Point for eHealth's readiness for joining the Cross-Border eHealth Information Service Network for the new services Patient Summary country A and Patient Summary country B N° Recommendation Action Proposed by the competent authority Commission services' assessment of the competent authority's response (patsiendi terviseandmete kokkuvõtte saatja ja vastuvõtja riik)” Page: 7  To the eHealth Network via eHMSEG Secretariat ([email protected]) Subject: Overall Readiness Statement to Start New Service in Routine Operations On behalf of Health and Welfare Information Systems Centre (HWISC) I declare that our National Contact Point for eHealth is ready to join the Cross-border eHealth Information Services providing the Patient Summary services as Country B in Wave 4. This readiness and adherence of the National Contact Point for eHealth to legal, organizational, semantic and technical criteria is demonstrated by the successful outcome of testing and auditing: 1. Outcome Summary Test Report Wave 4, 2. Verification of implementation of corrective actions 3. Decision to start PET I undertake to notify the eHealth Network immediately of any change that could have a significant influence on the validity of the above statement. Therefore, I apply for joining the Cross-Border eHealth Information Services – Go Live. Tallinn, 02.06.2022 Signed digitally Margus Arm Director of Health and Welfare Information Systems Centre