■由观察健康数据科学与信息学(OHDSI)集体提供的开源软件,包括OMOP-CDM,作为许多现实世界的证据网络和分布式健康数据分析平台的主要支柱。虽然从技术角度来看,容器技术显著简化了部署,监管合规可能仍然是此类平台设置和运行的主要障碍。在本文中,我们提出了OHDSI合规,一套全面的文档模板,旨在简化与数据保护和信息安全相关的文档以及建立OHDSI安装所需的协调工作。
■要确定一组相关文档模板,我们首先分析了法律要求和相关指南,重点是《通用数据保护条例》(GDPR).此外,我们分析了典型的OHDSI堆栈的软件体系结构,并将其组件与所识别的不同一般类型的概念和文档相关联。然后,我们为原型OHDSI安装创建了这些文档,基于所谓的Broadsea包,遵循德国的相关准则。最后,我们通过在需要个别机构特定内容的地方引入占位符和选项来概括文件。
■我们提供四个文件:(1)处理活动的记录,(2)信息安全概念,(3)授权概念,以及(4)涵盖维护堆栈的技术细节的操作概念。这些文件可以在许可许可下公开获得。
■据我们所知,没有其他公开可用的文档集,旨在简化OHDSI部署的合规流程。虽然我们的文件提供了一个全面的起点,需要添加当地细节,and,由于不同国家法律要求的异质性,可能需要进一步收养。
UNASSIGNED: The open-source software offered by the Observational Health Data Science and Informatics (OHDSI) collective, including the OMOP-CDM, serves as a major backbone for many real-world evidence networks and distributed health data analytics platforms. While container technology has significantly simplified deployments from a technical perspective, regulatory compliance can remain a major hurdle for the setup and operation of such platforms. In this paper, we present OHDSI-Compliance, a comprehensive set of document templates designed to streamline the data protection and information security-related documentation and coordination efforts required to establish OHDSI installations.
UNASSIGNED: To decide on a set of relevant document templates, we first analyzed the legal requirements and associated guidelines with a focus on the General Data Protection Regulation (GDPR). Moreover, we analyzed the software architecture of a typical OHDSI stack and related its components to the different general types of concepts and documentation identified. Then, we created those documents for a prototypical OHDSI installation, based on the so-called Broadsea package, following relevant guidelines from Germany. Finally, we generalized the documents by introducing placeholders and options at places where individual institution-specific content will be needed.
UNASSIGNED: We present four documents: (1) a record of processing activities, (2) an information security concept, (3) an authorization concept, as well as (4) an operational concept covering the technical details of maintaining the stack. The documents are publicly available under a permissive license.
UNASSIGNED: To the best of our knowledge, there are no other publicly available sets of documents designed to simplify the compliance process for OHDSI deployments. While our documents provide a comprehensive starting point, local specifics need to be added, and, due to the heterogeneity of legal requirements in different countries, further adoptions might be necessary.