fnordlicht
commented
3 years ago Thank you for your question.
The e-prescription is an official, transactional supply process in which it must be ensured that a prescription can only be filled once. If the insured person were to take a medically signed data record to the pharmacy on, for example, a USB stick, the following risks would exist:
- There is a risk of compromising the doctor's systems if the doctor records a USB stick.
- The pharmacist could have malicious code imposed on them to compromise their systems.
- Patients may have copied the data and filled a prescription more than once or even acquired it without permission (especially relevant for narcotics)
- Loss of the prescription due to loss of the USB stick
- Discriminatory supply scenarios, as the USB stick cannot be sent to online pharmacies
Local storage is therefore not feasible.
The e-prescriptions are transmitted in encrypted form from the doctor's practice to a central service, stored and processed there in encrypted form and retrieved again in encrypted form from the pharmacy. This protects the e-prescriptions from unauthorized access. The data protection and security measures are ensured by two measures: Firstly, the components of the e-prescription are checked by independent experts before they are allowed to be used. Secondly, gematik monitors compliance with data protection and security by means of technical systems and by persons who regularly carry out audits of the operator of the e-prescription service. The independent experts prepare both a product expert assessment for the e-prescription service and a security expert assessment on the secure operation of the provider of the e-prescription service. In addition, the provider must prove through another expert assessment that it is capable of developing secure software. These expert assessments are reviewed by gematik. For the e-prescription app, gematik commissions (in accordance with the PDSG and SGB V §360 Para. 5) a security report, which is then reviewed by the Federal Office for Information Security and gematik. This assessment also includes the app's interfaces to the e-prescription specialist service and the identity provider. All expert assessments must be renewed regularly. In order to be able to recognise attacks on the e-prescription service in good time, permanent security monitoring takes place. This is carried out by gematik together with the provider of the e-prescription service. If the provider detects security incidents they must inform gematik. In addition to this constant technical monitoring, regular audits are carried out in which gematik checks whether the provider of the specialised e-prescription service is complying with the standards.
Issue was moved here from https://github.com/gematik/E-Rezept-App-Android. Please open issues only in their respective repositories as otherwise they will be closed as unrelated in the future.
MaxGitHubAccount
Miademora
HendrikGematik
Thanks for open-sourcing the app and interface documentation. I am posting here because I cannot open an issue here https://github.com/gematik/api-erp.
Unfortunately, the functional and technical design and implementation is now already in place, which means that reworking basic design decisions is now time-consuming and costly. It would be good if this was recorded in a lessons learnt register to management for future decisions.
Patient data is the most intimate of our data. This requires the highest security and data protection requirements on the system not only by the GDPR but also for acceptance. The current design is for prescriptions for insured persons to be stored entirely at Gematik. https://github.com/gematik/api-erp/blob/master/docs/erp_versicherte.adoc#anwendungsf%C3%A4lle-e-rezept-als-versicherter-verwalten
This entails great risks, which would not necessarily have to be taken. It would be conceivable, for example, that prescriptions are signed by Gematik when they are written (it would be even better if doctors had their own expiring, revocable keys, which in turn would be issued by a Gematik CA), but then not stored centrally but on the customer's device. As soon as the patient brings his prescription to a pharmacy, the authenticity of the prescription is checked via the signature and only one transaction is stored for redeeming and thus invalidating the prescription. This does not require any personal or prescription-related data to be stored, collected or processed. The argument that prescriptions could be lost in this way does not apply here, as patients can also lose the printout or their Access_Token in the current solution.
My proposed solution is probably not state of the art. However, it would be good if the whole workflow could be reviewed with data protection experts on privacy by design and revised accordingly. Currently, the implementation means a significant unnecessary deterioration in the level of data protection of prescriptions.