D4.2: Set of requirements for interoperability of Identity Management Systems

FIDIS REQUIREMENTS FOR USERS, GOVERNMENTS AND MERCHANTS

Requirements for users, governments and merchants

Robben stressed the importance of roles and responsibilities in the system as more important than interoperability per se. For example, in a hospital scenario, there might be people accessing data that are not their own. Mandates are necessary to determine who can act on behalf of another person. It can be a central database of mandates or a set of local databases. He sees the need for the creation of a sub-committee of the Privacy Commission specialised in ehealth and responsible for protecting information. This committee would decide on: what entity is allowed; what access; what personal information; about which patient; in which capacity; and in which situation; during which period of time.

It is important that the system that works with the IMS maps the governance structure of the organisation, so that different users only have access according to their permissions. He stressed the importance of accurately ascertaining the identity of both the patient and health care provider (HCP). Robben said that interoperability should be achieved by finding a balance between efficiency, security and privacy protection. He believes that a combination of independent sectoral committees and a good system of sanctions for instances when rules are infringed should make it possible to obtain the adequate level of security and privacy protection.

Neke proposes the following requirements for users (in this context are understood as patients and care providers):

• operational speed of the solutions,  

• low cost,  

• reliability and  

• integration into established operational procedures 

• patient has more control over the data 

Neke says that merchants (pharmacists and health care industry in general) would prefer a non-proprietary system that is not monopolised by one vendor. Müller says that users want uniformity (just one card), confidentiality and legal assurances. For governments, she says that compliance with existing laws is critical and compliance with what users have authorised in terms of data usage.

Otter says that users need to have trust in the system and to be educated on how to use the new system. He also believed that the system would only be socially interoperable if it is granted to specific groups, such as the elderly and the disabled. He also says that users need to be given or to buy a card reader to be able to communicate with government agencies from their home computers.