Commission Implementing Decision (EU) 2019/1269 of 26 July 2019 amending Implementing Decision 2014/287/EU setting out criteria for establishing and evaluating European Reference Networks and their Members and for facilitating the exchange of information and expertise on establishing and evaluating such Networks (Text with EEA relevance.)

For the purposes of this Implementing Decision the following definitions shall apply: (a) “European Reference Networks' Coordinator” means the person appointed as the Coordinator of the Network by the Member of a European Reference Network chosen as the coordinating Member as referred to in recital 3 and Article 4 of Delegated Decision 2014/286/EU (b) “Board of the Network” means a body responsible for the governance of the Network, composed of representatives from each Member in the Network as referred to in recital 3 and point (1)(b)(ii) of Annex I to Delegated Decision 2014/286/EU; (c) “Affiliated Partner” means (Associated National Centre, Collaborative National Centre and National Coordination Hub), as referred to in recital 14 and point (7)(c) of Annex I of Delegated Decision 2014/286/EU and in the Statement of the Board of Member States of 10 October 2017; (d) “Guest user” means a healthcare provider who is not a member or Affiliated Partner and who has the right, following the approval of the competent European Reference Network Coordinator, for a limited period of time, to enrol patients in CPMS and participate in the panel related to that patient or to participate in a specific panel as an expert.’

Member States are invited to exchange information and expertise within the Board of Member States in order to steer the development of the ERNs, provide guidance to the Networks and to the Member States and advise the Commission on matters related to the establishment of the Networks.’

1 A Clinical Patient Management System (“CPMS”) for the electronic exchange of personal data of patients between healthcare providers authorised to access CPMS within the ERNs is hereby established.

2 The CPMS shall consist of a secure IT tool provided by the Commission for the sharing and hosting of patient data and for real and on-time communication on patient cases within the ERNs.

3 It shall include, inter alia, a medical image viewer, data reporting capabilities, custom datasets and it shall integrate adequate data protection safeguards in accordance with Annex I.’

1 Personal data of patients, which consist of name, gender, date and place of birth and other personal data necessary for the purpose of diagnosis and treatment shall be exchanged and processed within the ERNs exclusively through the CPMS. The processing shall be limited to the purposes of facilitating collaboration on the medical assessment of a patient file for diagnosis and treatment, of entering the data in registries and other databases for rare and low prevalence complex diseases, which serve scientific research, clinical or health policy purposes and of contacting potential participants for scientific research initiatives. It shall be based on a consent obtained in accordance with Annex IV.

2 The Commission shall be regarded as controller of processing of personal data related to the management of access rights and shall process these data on the basis of the explicit consent of the individuals identified by the healthcare providers as users and authorised by the relevant ERNs in so far as necessary to ensure that: (a) access rights are granted to these individuals; (b) these individuals may exercise their rights and fulfil their obligations; and (c) it can fulfil its obligations as a controller.

3 The Commission shall not access personal data of patients, unless it is strictly necessary to fulfil its obligations as a joint controller.

4 Only persons authorised by ERNs and belonging to the categories of staff and other individuals affiliated to the healthcare providers authorised to access CPMS may access personal data of patients in the CPMS.

5 The name of the patient, as well as the place and exact date of birth, shall be encrypted and pseudonymised in the CPMS. Other personal data necessary for the purpose of diagnosis and treatment shall be pseudonymised. Only pseudonymised data shall be available to CPMS users from other healthcare providers for panel discussions and assessment of patient files.

6 The Commission shall ensure the security of transfer and hosting of personal data.

7 Healthcare providers authorised to access CPMS shall delete data no longer necessary. Personal data of patients shall only be retained for as long as necessary in the interest of patient care, diseases' diagnosis or for the purpose of ensuring care within an ERN to the patients' family members. Every 15 years at the latest, each healthcare provider authorised to access CPMS shall review the need to keep the patients' data it is controller of.

8 The effectiveness of technical and organisational measures for ensuring the security of processing of personal data in the CPMS shall be regularly tested, assessed and evaluated by the Commission and by the healthcare providers authorised to access CPMS.’

1 Each of the healthcare providers processing patients' data in the CPMS and the Commission shall be joint controllers of the processing of these data in the CPMS.

2 For the purposes of paragraph 1, responsibilities shall be allocated among joint controllers in accordance with Annex III.

3 Each of the joint controllers shall comply with relevant Union and national legislation to which the respective controller is subject.’

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.