3 ms·

Your IG team will know. From my understanding, from the yearly IG briefings I used to have, you would be able to provide that requester with information on how

by thisone 14y ago

Your IG team will know. From my understanding, from the yearly IG briefings I used to have, you would be able to provide that requester with information on how to obtain their personal access, and point out to them where they can find the information they have requested. Information needs to be made accessible, you don't necessarily need to actually provide printouts. For example, FOI requests from news agencies often cover the same topics. This information can and often is posted publicly on the organisation's website and the FOI responses refer the requester to those links.

alexkus 14y ago
FOI requests are often made because people don't trust that the "all your information is displayed here on the website" is actually all of the information that is being held on them. What if the FOI request was supplemented with the users password (changed by them to a temporary one)? Other possibilities would be encrypting a second copy of the patients data (each time it is stored by the user) using a public key with the corresponding private key held in escrow somewhere on a machine with no network connection. It would then be someone's job, upon receiving an FOI request, to take the patients master-encrypted record(s), put them on the non-connected computer that contains the private key, decrypt, and print out in order to reply to the FOI and then clean up.
- thisone 14y ago
  If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and by whom, and that information must be available as well. Information that you'll probably also need to encrypt, but still be able to search by patient, date, and decrypter. (requests come through to find all records a particular employee has seen within a certain date range as well) I can see the start of a rabbit hole, which is why organisations dealing in PID have IG teams or consultants who know the laws and know how much needs to be done. If a patient thinks an organisation is holding out on them, that patient has a way to complain, and the complaints aren't taken lightly from what I've seen.

by thisone 14y ago

alexkus 14y ago

FOI requests are often made because people don't trust that the "all your information is displayed here on the website" is actually all of the information that is being held on them. What if the FOI request was supplemented with the users password (changed by them to a temporary one)? Other possibilities would be encrypting a second copy of the patients data (each time it is stored by the user) using a public key with the corresponding private key held in escrow somewhere on a machine with no network connection. It would then be someone's job, upon receiving an FOI request, to take the patients master-encrypted record(s), put them on the non-connected computer that contains the private key, decrypt, and print out in order to reply to the FOI and then clean up.

thisone 14y ago
If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and by whom, and that information must be available as well. Information that you'll probably also need to encrypt, but still be able to search by patient, date, and decrypter. (requests come through to find all records a particular employee has seen within a certain date range as well) I can see the start of a rabbit hole, which is why organisations dealing in PID have IG teams or consultants who know the laws and know how much needs to be done. If a patient thinks an organisation is holding out on them, that patient has a way to complain, and the complaints aren't taken lightly from what I've seen.