1. The Crossroads Bank for Social Security, a model for the health care sector ? Frank Robben General manager Crossroads Bank for Social Security Sint-Pieterssteenweg 375 B-1040 Brussels E-mail: Frank.Robben@ksz.fgov.beFrank.Robben@ksz.fgov.be Website CBSS: www.ksz.fgov.bewww.ksz.fgov.be Personal website: http://www.law.kuleuven.ac.be/icri/frobbenhttp://www.law.kuleuven.ac.be/icri/frobben Crossroads Bank for Social Security

2. 2 12/06/2003 Crossroads Bank for Social Security Structure of the presentation n relevant similarities between the social security sector and the health care sector n the model of the Crossroads Bank -the overall concept -the basic building blocks n critical success factors for an implementation

3. 3 12/06/2003 Crossroads Bank for Social Security Relevant similarities n many actors, each having their own competencies and interests n huge need for electronic exchange of sensitive personal data between those actors, with sufficient guarantees on -interoperability -efficiency -data quality -security (availability, integrity, confidentiality) n a central data storage is not possible or desirable for reasons of -privacy protection -unacceptability for the actors

4. 4 12/06/2003 Crossroads Bank for Social Security The Crossroads Bank model n distributed data storage, conform to a functional task sharing between the actors n the use of common identification keys for every entity that has to be identified n a reference directory, serving as a base for the organization of information exchange n a common technical and functional interoperability framework n a common security framework n a legal framework n the creation of an institution that elaborates the vision, stimulates, co-ordinates and manages the necessary frameworks

5. 5 12/06/2003 Crossroads Bank for Social Security Distributed data storage n functional task sharing concerning -validation of information -storage of information n information is dynamically assembled -in function of business needs -on the initiative of the actor who needs the information or of the concerned person -according to the authorizations -by the use of the common interoperability and security framework

6. 6 12/06/2003 Crossroads Bank for Social Security Common identification keys n characteristics -unicity one entity – one identification key same identification key is not assigned to several entities -exhaustivity every entity to be identified has an identification key -stability through time identification key doesn’t contain variable characteristics of the identified entity identification key doesn’t contain references to the identification key or characteristics of other entities identification key doesn’t change when a capacity or a characteristic of the identified entity changes

7. 7 12/06/2003 Crossroads Bank for Social Security Common identification keys n concrete implementation -citizens social security number (national register number or CBSS-number) (electronically) readable from the SIS-card or the electronic identity card controlled access to basic identification data in National Register and CBSS Belgian Privacy Commission: in health care sector preferable use of common identification key derived from social security number, rather than social security number itself -enterprises, including organizations and professionals enterprise number (based on VAT-number) number for every plant of an enterprise generalized access to basic identification data in the Enterprise Register -regulation on data interconnection

8. 8 12/06/2003 Crossroads Bank for Social Security Reference directory n serves as a base for the organization of information exchange n structure -directory of persons: which actors have data on which persons in which capacities for which periods -data availability table: which actor disposes of which type of data for which capacity -access authorization table: which data may be transmitted to which actors for which capacities n functions -routing of information -preventive access control -automatic communication of changes to information

9. 9 12/06/2003 Crossroads Bank for Social Security Interoperability framework n goal: to guarantee the ability of all actors to share information and to integrate information and business processes by the use of -interconnected physical networks -(open) technical standards -functional agreements -harmonized concepts and data modelling

10. 10 12/06/2003 Crossroads Bank for Social Security Technical standards Interconnection Information Exchange Services Repository TCP/IP SMTP LDAP FTP S/MIME XML XSL SOAP WSDL metadata (RDF, XTM, XMI, …) Security Services Register (~ UDDI) Agreements (~ ebXML) Policies Vocabularia (content + metadata)

11. 11 12/06/2003 Crossroads Bank for Social Security Functional agreements n standardized codification n standardized use of objects and attributes n standardized layout of header of messages, independent from information exchange format and type of information exchange n version management n backwards compatibility n SLA’s on disponibility and performance of services n access autorisation management n anonimization rules n acceptation and production environments n priority management n …

12. 12 12/06/2003 Crossroads Bank for Social Security Security framework: institutional measures n no central data storage n independent Control Committee, assigned by Parliament -supervision of information security -authorizing the information exchange -complaint handling -information security recommendations -extensive investigating powers -annual activity report n publication of the authorizations of information exchange n preventive control on legitimacy of data exchange by Crossroads Bank according to authorizations of the independent Control Committee n information security department in each institution n certified specialized information security service providers n working party on information security

13. 13 12/06/2003 Crossroads Bank for Social Security Security framework: extended ISO 17799 n security policy n security organization n asset classification and control n personnel security n physical and environmental security n computer and operations management n access control n system development and maintenance n specific measures with regard to the processing of personal data n business continuity planning n compliance n communication towards the public opinion concerning the security policy and the measures with regard to security and privacy protection

14. 14 12/06/2003 Crossroads Bank for Social Security Security framework: legal measures n obligations of the controller -principles relating to data quality -criteria for making data processing legitimate -specific rules for processing of sensitive data -information to be given to the data subject -confidentiality and security of processing -notification of the processing of personal data n rights of the data subject -right of information -right of access -right of rectification, erasure or blocking -right of a judicial remedy n penalties

15. 15 12/06/2003 Crossroads Bank for Social Security Security framework: authentication n some basic concepts -identification: answer to the question “who are you ?” -authentication: answer to the question “can you proof who or what you pretend to be ?” who: authentication of the identity what: authentication of an attribute (e.g. role, characteristic, mandate,...) -autorisation: answer to the question “what are you allowed to do ?” n authentication -of the identity electronic identity card meanwhile, for some applications user-id – password – token -of an attribute stored in a database or stored in attribute certificate

16. 16 12/06/2003 Crossroads Bank for Social Security SIS card: identification & proof of insurance status name Christian names date of birth sex social security number period of validity of the card card number sickness fund sickness fund registration number insurance period insurance status social exemption status other data to be added in the future, if useful key 1 key 2

17. 17 12/06/2003 Crossroads Bank for Social Security Electronic identity card: identification & authentication name Christian names nationality birth place and date sex national register number main residence place of delivery of the card period of validity of the card card number the photo of the holder identity and signature keys identity and signature certificates accredited certification service furnisher information necesary for authentication of the card and securization of the electronic data

18. 18 12/06/2003 Crossroads Bank for Social Security Harmonized concepts and data modelling n standard elements -with well defined characteristics -used within all services n OO-oriented n version management in an ever changing environment n define once, use many (different presentations) n workflow for validation of standard elements and characteristics n multi criteria search -by element -by scheme -by version -…

19. 19 12/06/2003 Crossroads Bank for Social Security Changes of the legal environment n organization of integrated information management and electronic service delivery -organizational principles of the co-operation -permission or obligation to use common identification keys -rights and obligations of the different actors -role of the Crossroads Bank n liability n ICT-law: only basic principles, technology-neutral, but not technology unaware -data protection -electronic signature -probative value

20. 20 12/06/2003 Crossroads Bank for Social Security Creation of an institution (Crossroads Bank) n managed by representatives of the concerned actors n tasks -elaboration of the common vision in co-operation with the concerned actors -stimulation -co-ordination and program and project management -management of the reference directory the common interoperability framework the common security framework the legal framework -harmonization of the concepts and data modelling

21. 21 12/06/2003 Crossroads Bank for Social Security A proven model n this model has been implemented -with end-to-end integration of electronic processes between 2.000 public and private social security institutions those institutions and all enterprises -with integrated electronic service delivery via a web portal to all citizens and enterprises n 170 types of structured data exchanges have already been implemented n 242 million messages were exchanged in 2002 n the model is mentioned as best practice in E- government in the last 2 surveys of the European Commission

22. 22 12/06/2003 Crossroads Bank for Social Security Critical success factors n a long term vision deliberated with the concerned actors n respect of the repartition of tasks and competences between the actors: co-operation between all actors rather than centralization of tasks n trust of all actors in the co-operation model and the security of the system n search for win-win situations n sufficient financial means, skills and knowledge n support of and access to policymakers at the highest level n legal framework n creation of an institution that elaborates the common vision, stimulates, co-ordinates and manages the necessary frameworks

23. Th@nk you ! Crossroads Bank for Social Security