Interpellation Feri (17.3531): Digitization in the healthcare sector
Submitted text
There is nothing wrong with Swiss Post, SBB, UBS, Swisscom, Credit Suisse or other companies issuing an e‑ID. They are already doing so, and if these companies make an effort to improve and standardize their e‑ID service, this can only be welcomed. Trust in an e‑ID service is central and must be ensured by the state itself (or by a commissioned third party). Finally, the E‑ID is about the fundamental question of how the existing data infrastructures of the state or state-related companies are to be made accessible to the general public. This is why the question of trust in e‑ID is particularly important in the healthcare sector.
I therefore ask the Federal Council to answer the following questions:
- How can the patient really be sure that data protection is guaranteed even with E‑ID?
- What is it doing for the integration of the state digital identity (E‑ID) as a confidence-building measure and as a basis for security in the digitalization of healthcare?
- Is there already an opportunity/risk analysis with regard to digitization in healthcare?
Statement of the Federal Council of August 30, 2017
- The protection profiles and ISO standards (e.g., ISO/IEC 27001:2013 and ISO/IEC 29115:2013) currently in force for the certification of issuers of means of identification attach great importance to data protection and data security; not only at the technical level, but also with regard to the personnel involved in issuing a means of identification and the processes to be followed. This ensures that there is an adequate response to security-relevant events such as the compromise of the means of identification. These protection profiles and standards apply equally to private and governmental issuers of means of identification. Compliance with these requirements is already ensured today in the Implementing legislation for the Federal Act on the Electronic Patient File (EPDG, SR 816.1) for identification meanswhich may be used to access the electronic patient dossier (Art. 23 of the Ordinance on the Electronic Patient Dossier, EPDV, SR 816.11). The future implementing provisions for the Federal Act on Recognized Electronic Identification Units (E‑ID Act) will respect and reflect the level of protection of the EPDV. This will ensure that identification means under the E‑ID Act are compliant with the EPDG and its legal standards.
- The Federal Council conducted the consultation on the E‑ID Act from February 22, 2017 to May 29, 2017. This draft provides that suitable private or public issuers of means of identification can obtain approval from a recognition body at federal level to issue state-recognized electronic means of identification. For example, systems that already exist or are being developed, such as the projects of Swiss Post and SBB as well as banks and Swisscom, should also be able to be recognized by the federal government. The means of identification recognized in this way will also be able to be used in the healthcare sector in due course. Until the e‑ID law is in force, the issuers of the electronic identification means prescribed for access to the electronic patient dossier will have to go through the certification procedure defined in the EPDG. This procedure – similar to the E‑ID Act – is aligned with the existing regulations in the area of electronic signatures, so that synergies arise for recognized issuers of means of identification with regard to the required certifications.
- The Confederation and the cantons have been working for 10 years on the Implementation of the “eHealth Switzerland Strategy As part of this work, the opportunities and risks of digitization were also discussed at all times, and the results of these discussions were taken into account in the ongoing work. For example, special attention was paid to the topics of data protection and data security when the legal basis for the electronic patient dossier was being drawn up. Similarly, in drawing up the recommendations of eHealth Suisse, the competence and coordination body of the Confederation and the cantons, on how to deal with mHealth applications such as health apps or so-called “wearables” such as fitness wristbands, the discussion of the opportunities and risks of this new technology as well as the issues surrounding data protection and data security formed the basis for formulating the recommendations (cf. www.e‑health-suisse.ch > Communities & Implementation > eHealth Activities > mHealth).
Incidentally, as part of the implementation of the “Digital Switzerland” strategy adopted by the Federal Council in April 2016, the “eHealth Switzerland 2.0 strategy” is therefore currently being developed jointly by the Confederation and the cantons (cf. inter alia the statement of the Federal Council on 17.3435 Po Heim. Digital health agenda. Opportunities and risks and on 17.3434 Po Graf-Litscher. Potential and framework conditions for digital sustainability in healthcare).
In addition, as part of the national cyber risk strategy (NCS) and the national critical infrastructure protection strategy (CIP), the resilience of the critical subsector “medical care and hospitals” is being examined with a focus on vulnerabilities of information and communication technologies and on cyber risks, and measures are being developed to improve them. This work is regularly updated to take account of changing conditions (e.g. deployment and use of new technologies in the area of identification tools).