Content uploaded by Michael Storck
Author content
All content in this area was uploaded by Michael Storck on Jan 05, 2018
Content may be subject to copyright.
A Secure Architecture to Provide a Medical Emergency Dataset
for Patients in Germany and Abroad
Michael Storcka, Jan Wohlmannb, Sarah Krudwigc, Alexander Vogeld,
Judith Bornb, Thomas Webere, Martin Dugasa, Christian Juhrab
a
Institute of Medical Informatics, University of Muenster, Muenster, Germany,
b
Office for eHealth, University Hospital Muenster, Muenster, Germany
c
CompuGroup Medical Deutschland AG, Koblenz, Germany
d
DATATREE AG, Duesseldorf, Germany
e
Institute of Aerospace Medicine, German Aerospace Center, Cologne, Germany
Abstract
The ongoing fragmentation of medical care and mobility of pa-
tients severely restrains exchange of lifesaving information
about patient's medical history in case of emergencies. There-
fore, the objective of this work is to offer a secure technical so-
lution to supply medical professionals with emergency-relevant
information concerning the current patient via mobile accessi-
bility. To achieve this goal, the official national emergency data
set was extended by additional features to form a patient sum-
mary for emergencies, a software architecture was developed
and data security and data protection issues were taken into
account. The patient has sovereignty over his/her data and can
therefore decide who has access to or can change his/her stored
data, but the treating physician composes the validated dataset.
Building upon the introduced concept, future activities are the
development of user-interfaces for the software components of
the different user groups as well as functioning prototypes for
upcoming field tests.
Keywords:
Emergency treatment; Emergency Service, Hospital; Health
information exchange
Introduction
Due to increasing specialization and fragmentation of medical
care, as well as an increased mobility of patients, the infor-
mation flow, which enables a fast exchange of lifesaving infor-
mation about a patient's prior medical history, is significantly
hampered [1,2]. Especially in cases of emergency, where the
patient is possibly unconscious and cannot be asked about pre-
vious illnesses or current medication, this information can be
exceedingly vital [2,3].
To establish an environment of quickly accessible patient infor-
mation in case of emergency, many countries have started to
implement or plan to implement Medical Emergency Datasets
(MED). Scheduled for 2018, the German Electronic Health
Card (EHC) is supposed to hold a MED [4,5,6]. Authorized
health professionals (e.g. primary care physicians) are asked to
create these datasets, if requested by the patient. Vital infor-
mation about previous diagnoses, medications, allergies and
other emergency-relevant information are stored on the card
[5,7]. Additionally, the patient has the opportunity to save in-
formation about the locations of important personal statements
such as organ and tissue donor ID, end of life decision or a
power of attorney regarding medical care.
Against the background of this upcoming implementation, the
German Medical Association [8] and the University Hospital
Muenster have conducted a validation study in 2014, which sur-
veyed the usability, the necessary instructions as well as anal-
yses on the expected usefulness of paper-based MEDs. Results
indicate that the questioned medical personnel, who included
emergency physicians, clinicians and paramedics, see MEDs as
very useful or useful. Specifically, preliminary diagnoses and
medications were rated as highly relevant for the emergency
care [9]. Building upon the aforementioned findings, the pilot
study ‘NFDM-Sprint’ is currently in progress, which is con-
cerned with analyzing and optimizing the creation process of
MEDs. During the study, MEDs were created by physicians and
evaluated by the researchers. The results of the study are pend-
ing at this time.
With regards to the technical solution in accessing MEDs on
the EHC in Germany, decryption of the stored data will only be
possible with an electronic health professional card. Accord-
ingly, this restriction will limit the access to the MED to Ger-
many only [10,11]. When individuals are traveling to foreign
countries, local health professionals cannot access the data. Fur-
thermore, only publicly insured patients will have the oppor-
tunity of storing a MED on their EHC, since the EHC is not
issued to privately insured patients.
In March 2016, the three-year project Timely Information in
Medical Emergencies (T.I.M.E.) started its research in the field
of emergency care. The project is funded by the European Un-
ion and the Federal Ministry of Health, Equalities, Care and
Aging (MGEPA) of North Rhine-Westphalia. Confronting the
expected limitations of the upcoming MED implementation,
one of the project objectives is to expand the previously defined
concept of MEDs by emergency-relevant findings and docu-
ments. The main goal is to offer an alternative secure technical
solution for a widened access to emergency-relevant infor-
mation via mobile accessibility and to test and evaluate a func-
tioning prototype to proof the concept. Additionally, a solution
for the access to MEDs abroad is being investigated. Final dis-
cussions with the Commissioner for Data Protection of the fed-
eral state of North Rhine-Westphalia are currently in progress
to finalize the data protection and privacy concept, which
makes the architecture prone to minor changes. The goal of the
current work is to describe the conceptualized software archi-
tecture.
MEDINFO 2017: Precision Healthcare through Informatics
A.V. Gundlapalli et al. (Eds.)
© 2017 International Medical Informatics Association (IMIA) and IOS Press.
This article is published online with Open Access by IOS Press and distributed under the terms
of the Creative Commons Attribution Non-Commercial License 4.0 (CC BY-NC 4.0).
doi:10.3233/978-1-61499-830-3-230
230
Methods
Firstly, unstructured interviews with domain experts were con-
ducted to determine which information should be provided with
an enhanced MED and how it can be administered and re-
trieved. Based on these interviews use cases describing the re-
quirements were defined. Secondly, the preexisting data model
of the emergency dataset for the EHC developed by the German
Medical Association and the gematik [12], the Society for
Telematics Applications, which is mandated to carry out the in-
troduction of the electronic health insurance card, was taken as
a basis and an extended data model containing all relevant data
from the interviews was derived. Thirdly, a concept fulfilling
pre-defined use cases and the provision of an emergency dataset
for patients in case of emergency was created. Finally, a data
protection and privacy concept was developed and discussed
with the Commissioner for Data Protection of the federal state
of North Rhine-Westphalia.
Results
Use Cases
At first the requirements given by domain experts were formal-
ized in four use cases:
• Authorizing the access to the emergency dataset by
the patient
• Creating or updating an emergency dataset by an au-
thorized physician
• Reading the emergency dataset in case of emergency
in Germany
• Reading the emergency dataset in case of emergency
in a foreign country
The four use cases address the central requirements, which are
data security, creating and updating the MED and the procedure
in case of an emergency in Germany and abroad.
Medical data model
Figure 1 – Overview of the Patient Summary for Emergencies
As shown in Figure 1, based on the MED developed by the Ger-
man Medical Association and gematik for the EHC, an en-
hanced dataset was developed. The Emergency Data Manage-
ment Concept developed by gematik consisting of contact data
(CD), MED and personal statements of the patient (PSP) was
not altered significantly to ensure interoperability with the
emergency dataset on the EHC. Additional information, for ex-
ample, imaging and laboratory findings were added to the da-
taset under the heading ‘Emergency-relevant findings and doc-
uments (EFD)’, to provide comprehensive information for the
practicing emergency physicians. Thus, information like X-
rays and physicians’ letters stored in formats like images or
PDF documents can be made available for the emergency phy-
sician. In summary, all this information is stored in the Patient
Summary for Emergencies (PSE).
Figure 2 shows the detailed data model of the EFD. Every find-
ing in the EFD has corresponding finding documents and will
be created by an identifiable treating physician or institution.
The treating physician, who decides which information is added
to the current EFD, is also documented as the administering
physician of the findings in the EFD, as given in the national
MED.
Figure 2 – The medical data model of the emergency-relevant
findings and documents
Concept
CompuGroup Medical (CGM), the market leader for physician
information systems in Europe, will develop the prototype. The
existing infrastructure and components of CGM will be used
for the implementation. Nevertheless, the concept can be gen-
eralized and developed in the same manner by other manufac-
turers.
As seen in Figure 3, the central component of the system is an
electronic patient record called PSE, which stores the enhanced
MED. All information stored in the PSE is encrypted with state
of the art encryption algorithms and can only be accessed by
authorized users. The authorization to access, change or add
data in the record is managed by the patient him- or herself.
M. Storck et al. / A Secure Architecture to Provide a Medical Emergency Dataset for Patients in Germany and Abroad 231
Figure 3 – Architecture overview: The physician creates (A)
or updates (B) PSE for the patient (left side). The patient has
to release the changed PSE (bottom right). The emergency
professionals can access the PSE (C upper right).
Authorizing the access to the emergency dataset
The system is patient-centered, which means the data is stored,
altered and accessed only with explicit permission given by the
patient. For the creation of the PSE, the patient has to give in-
formed consent in written form to the physician, who creates
the PSE within the patient record.
Medical professionals have to be registered with their official
profession within the system, like first responder or emergency
physician, to access the PSE. To enable medical professionals
to access the PSE, the patient can generate an access token
within his/her patient portal, which is a string consisting of 25
characters. This access token can be obtained as a Quick Re-
sponse Code (QR-Code), which can be opened by a preinstalled
app showing the released data from the PSE. If the app is not
installed an error is shown. Thus, a two-factor authentication is
established. Table 1 shows the standard authorization configu-
ration for a released PSE. The first aiders, who are defined as
nonprofessional helpers like people seeing an accident and ini-
tiating an emergency call, are not granted access to the data if
they scan the QR-Code. However, if a registered medical pro-
fessional like the emergency service or the emergency physi-
cian uses the QR-Code, he/she can retrieve appropriate medical
data regarding their needs for the emergency.
Table 1 – Authorization matrix
(R=Read, W=Write and D=Delete)
Object CD MED PSP EFD
First aider (nonpro-
fessional)
None None None None
First responder
(
p
rofessional)
R R None None
Emer
g
enc
y
service R R R None
Emergency physi-
cian
R R R R
Administering phy-
sician
R,W,D R,W,D R,W R,W,D
Patient R,W,D R,D R,W,D R,D
Creating or updating an emergency dataset
The creation (A in Figure 3) and update (B in Figure 3) of a
PSE is done exclusively by an authorized physician, as only a
treating physician who knows the patient can determine which
information is useful in case of emergency and should be part
of the PSE. Only contact data and information regarding per-
sonal statements can be updated by the patient (Figure 3, bot-
tom right corner), but he/she is not allowed to create a PSE. On
the one hand, the physician can use an integrated form in his/her
physician information system to manage the PSE (Figure 3, top
left corner). On the other hand, he/she could use a web portal
developed for physicians who do not have physician infor-
mation systems or use a physician information system without
PSE integration (Figure 3, bottom left corner).
Since the physician decides which information is relevant for
the PSE, the patient cannot choose if specific medical infor-
mation from his or her medical history or current illnesses is
present in the current dataset. Thus, the PSE will always be a
valid set of medical data approved by a physician. After crea-
tion or update of the PSE, the patient is notified about the
changed data. Until the patient releases the new PSE or revokes
his/her participation, the outdated PSE is not available in case
of emergency. As the updating process is during the consulta-
tion with the physician, the time gap between an outdated and
confirmed PSE should not be too long. However, the patient
can revoke the permission to store the PSE at any time. If he
does so or does not give his permission after an update, his com-
plete PSE will be deleted. It is therefore an all-or-nothing ap-
proach. Since the emergency data of the patient will partly be
stored on the EHC in form of the MED, the system will inte-
grate a mechanism for updating the data on the EHC and updat-
ing the data in the PSE from the EHC.
Reading the emergency dataset in case of emergency
Registered medical professionals like the emergency service or
the emergency physician can retrieve the PSE. The registration
can be done by the medical professional him-/herself using the
health professional card or by an authorized organization like
the German Medical Association or aid organizations, who can
proof the accreditation of the medical professional.
After the patient has released the PSE, he/she can print the cor-
responding QR-Code for the created access token. In case of
emergency, the medical professional may scan this QR-Code
and can retrieve the appropriate information as shown in Table
1 (C in Figure 3). The patient will be notified about every data
access by other users through the patient portal and the QR-
Code will automatically be disabled after a predefined period
of time. Thus, the data cannot be retrieved for an unlimited time
afterwards and the patient has to create a new access token to
re-enable the access to the PSE. Therefore, the patient is respon-
sible for updating the access token and carrying along the cur-
rent active access token to provide access to his/her emergency
dataset.
Since the expertise of health professionals in foreign countries
cannot be verified, as there is no global health professional card
or a standardized way to identify health professionals, the ac-
cess to the PSE has to be achieved differently in foreign coun-
tries. In case of holidays or business trips, the patient has the
opportunity to extend the access rights to the PSE for a speci-
fied period of time. Thus, anybody who scans the QR-Code
within the specified period of time can access the whole PSE
without any authorization mechanisms in place.
Data privacy and data protection
The stored information in the PSE is encrypted with state of the
art industrial standard encryption algorithms. It is therefore not
possible to decrypt the information with reasonable effort, with-
out knowledge of the secret private key. Moreover, the commu-
nicated data is end-to-end encrypted and the communication be-
tween the system, which runs the PSE and the client devices is
encrypted as well.
M. Storck et al. / A Secure Architecture to Provide a Medical Emergency Dataset for Patients in Germany and Abroad232
The personal and medical information of the patients are only
temporarily stored on the clients’ devices. After closing the app
but at the latest after three hours the data will be deleted. Fur-
thermore, the app checks if the device has been rooted or jail-
breaked, which leads to an error and closing the app. The access
to the patients’ data is managed by the patient him-/herself and
the patient has the opportunity to revoke the consent on storing
information in the PSE and to delete the information stored in
the PSE at any time. The patient is notified every time his/her
information is changed by a physician and he/she has to ap-
prove the new emergency dataset.
An audit trail for all accesses to the PSE is stored, so the patient
is able to see who has accessed his/her medical information and
when it happened. Furthermore, an encrypted snapshot or
screenshot of the viewed data is stored within the PSE to pro-
vide the opportunity to notice abuse of information or for legal
reasons.
Discussion
The objective of this work was to illustrate a software architec-
ture for a secure technical solution to make an extended MED
available to users via mobile accessibility in Germany and
abroad. Built upon the current version of the official German
MED model, the presented concept shows an alternative way of
getting emergency-relevant information to medical profession-
als directly to the emergency site. The PSE, containing the
Emergency Data Management components and additional
emergency-relevant findings and documents, builds an en-
larged basis for diagnostics and forms the foundation for this
enhanced software solution. The current concept offers a way
for secured access to the data via a two-factor authentication
(QR-Code plus app). Only medical professionals registered
within the system with their official profession, like first re-
sponder or emergency physician, are allowed to access the PSE
to retrieve appropriate medical data regarding their needs for
the emergency. Due to more information about the patients’
medical history, the physician gains greater knowledge of pa-
tients’ clinical characteristics and this is expected to improve
medical decision-making [13].
To get overall clinical acceptance of the PSE, it is essential that
the quality of data be guaranteed. A possible way in achieving
this is if the treating physician is also the administrator of the
PSE. Nevertheless, the patient could also provide additional in-
formation during the creation of the dataset since he/she can be
asked specifically about emergency-relevant findings assessed
by other physicians.
Concerning the limitations of this study, the PSE will exclu-
sively be tested using the existing infrastructure and compo-
nents of CGM. However, given the plans of the government for
building a healthcare telematics infrastructure which includes
the provision of MEDs to the public by 2018 [6], transferability
of the concept to other systems has been the focus of this project
from the start.
Since the PSE is primarily meant to be accessed at the site of an
emergency, mobile Internet access is a vital requirement to be
able to get the crucial information. Restrictive factors of mobile
Internet access are of course still present in form of data volume
limitations or areas with no connectivity, yet a comprehensive
network covering the area of Germany is scheduled for 2018.
Another fact that has to be accepted is that a mobile device, seen
from the point of information security, has a residual risk of
exploitation. To minimize the risk the delivered app will check
the device for roots and jailbreaks. However, since emergency-
relevant data should be available quickest possible, the access
via mobile accessibility is crucial. Still, the patient has to be
informed about all possible security weaknesses and has to give
informed consent acknowledging these data privacy concerns.
Furthermore, a privacy issue regarding accessibility of MEDs
abroad might be raised, as for a defined period of time no au-
thorization mechanism would take place when scanning the
QR-code, giving access to sensitive data. This concern is a
prominent discussion point in the ongoing developmental pro-
cess of the concept and has also been stressed by the Commis-
sioner for Data Protection of the federal state of North Rhine-
Westphalia. While it can be argued that a patient has the sole
responsibility for the safety of the QR-Code when being abroad,
two alternative data protection solutions with controlled activa-
tion are currently being discussed. Firstly, a call center can
grant access to the PSE to the emergency physician, after veri-
fication of the physician’s profession. Secondly, implementa-
tion of a two-factor authentication sending a short message to
the patient or a relative to acknowledge the access to the PSE
could be an option.
Next to the limited authentication measures abroad, another is-
sue is the translation of the content to another language. Since
the dataset offers free text fields without proper semantics, au-
tomatic translation cannot be provided at this point. Further-
more, Germany has not licensed the international terminology
SNOMED CT [14], which could have been used to achieve se-
mantic interoperability. Nevertheless, the PSE will partly be
mapped to international terminologies and classifications, like
the International Classification of Diseases for diagnoses, Log-
ical Observation Identifiers Names and Codes for laboratory
values and Anatomical Therapeutic Chemical Classification
System for medication. Additionally, there are initiatives that
promote cross border exchange of personal health data like the
pilot project Smart Open Services for European Patients
(epSOS) [15], a six-year initiative which ended in 2014. In the
project, regulatory, technical and organizational aspects were
blueprinted for a cross boarder electronic health record system
including the healthcare services ‘electronic Prescriptions’ and
‘Patient Summaries’. While there are strong content-related
similarities between the epSOS Patient Summary and the offi-
cial German MED, the primary application area of patient sum-
maries is in doctors’ offices or hospitals. Consequently, the use
of this data sharing approach is not applicable at the emergency
site.
To overcome the interoperability issues, the development of an
international profile, like IHE XDS, specifically addressing the
emergency dataset, should be considered. Furthermore, the in-
troduction of an international electronic health card for all citi-
zens and an international health professional card for medical
professionals would be helpful for exchanging health data and
authorizing the access to health data [13].
Conclusion
In conclusion, a concept for a secure architecture to provide a
medical emergency dataset for patients has been proposed.
With the implementation of this architecture in its finalized
state, it will be possible to supply medical professionals with
emergency-relevant information concerning the current patient
via mobile accessibility. Furthermore, the patient will have the
opportunity to use his/her emergency dataset not only in Ger-
many but also whilst travelling abroad.
The next activity in the T.I.M.E. project is the development of
user-interfaces for the software components of the different
user groups. Using these proposed user interfaces an online sur-
vey among physicians will be conducted to determine the opti-
mal user interface for displaying MEDs. Based on the results of
the survey a functioning prototype will be developed, tested and
M. Storck et al. / A Secure Architecture to Provide a Medical Emergency Dataset for Patients in Germany and Abroad 233
evaluated. Finally, a support infrastructure (e.g. telephone hot-
line) has to be constructed for the test phase and possible future
commissioning.
Acknowledgements
This work is supported by and the European Union and the
Ministry of Health, Equalities, Care and Ageing of the State of
North Rhine-Westphalia (MGEPA http://www.mgepa.nrw.de)
Grant ID: GE-1-1-006A / EFRE-0800196. The funders had no
role in study design, data collection and analysis, decision to
publish, or preparation of the manuscript.
References
[1] J.S. Shapiro, J. Kannry, A.W. Kushniruk, and G. Kuperman, Emergency
physicians' perceptions of health information exchange, J Am Med Inform
Assoc 14 (2007), 700-705.
[2] A. Stiell, A.J. Forster, I.G. Stiell, and C. van Walraven, Prevalence of
information gaps in the emergency department and the effect on patient
outcomes, CMAJ 169 (2003), 1023-1028.
[3] J.T. Finnell and J.M. Overhage, Emergency medical services: the frontier
in health information exchange, AMIA Annu Symp Proc 2010 (2010), 222-
226.
[4] N. Stafford, Germany is set to introduce e-health cards by 2018, Bmj 350
(2015), h2991.
[5] gematik, For a health-care system with a future. The electronic health
insurance card, [cited 12. December. 2016], Available from:
https://www.gematik.de/cms/media/infomaterialpresse/_Broschuere_En
glisch_2.pdf
[6] Federal Ministry of Health of Germany, Act on secure digital
communication and applications in the
health care system (E-Health Act), [cited 15. December. 2016], Available
from: http://www.bgbl.de/xaver/bgbl/start.xav?startbk=Bundesanzei-
ger_BGBl&jumpTo=bgbl115s2408.pdf
[7] J. Born, J. Albert, A. Bohn, N. Butz, K. Fuchs, S. Loos, J. Schenkel, and
C. Juhra, Der Notfalldatensatz für die elektronische Gesundheitskarte,
Notfall+ Rettungsmedizin (2016), 1-6.
[8] German Medical Association, [cited 12. December. 2016], Available
from:http://www.bundesaerztekammer.de/weitere-
sprachen/english/german-medical-association/
[9] J. Born, J. Albert, N. Butz, S. Loos, J. Schenkel, C. Gipp, and C. Juhra,
The Emergency Data Set for the German Electronic Health Card–Which
Benefits Can Be Expected?, EHealth2015–Health Informatics Meets
EHealth: Innovative Health Perspectives: Personalized Health 212
(2015), 206.
[10] B. Blobel, Comparing approaches for advanced e-health security
infrastructures, Int J Med Inform 76 (2007), 454-459.
[11] N. Ernstmann, O. Ommen, M. Neumann, A. Hammer , R. Voltz, and H.
Pfaff, Primary care physician's attitude towards the German e-health card
project--determinants and implications, J Med Syst 33 (2009), 181-188.
[12] gematik, [cited 12. December. 2016], Available from: https://www.ge-
matik.de/cms/de/startseite/index.jsp
[13] M.Moharra, C. Almanán, M. Decool, A.-L. Nilsson, N. Allegretti, and M.
Seven, Implementation of a cross-boarder health service: physician and
pharmacists´ opinions from the epSOS project, Family practice (2014),
cmv052
[14] International Health Terminology Standards Development Organisa-
tion (IHTSDO), Snomed CT, [cited 12. December. 2016], Available
from: http://www.ihtsdo.org/snomed-ct
[15] epSOS – the European eHealth Project, [cited 12. December. 2016],
Available from: http://www.epsos.eu/
Address for correspondence
Michael Storck, michael.storck@uni-muenster.de
M. Storck et al. / A Secure Architecture to Provide a Medical Emergency Dataset for Patients in Germany and Abroad234
