GB/T 41981.1-2022 in English

《GB/T 41981.1-2022液压传动连接 测压接头 第1部分：非带压连接式》由TC3（全国液压气动标准化技术委员会）归口，TC3SC1（全国液压气动标准化技术委员会液压传动和控制分会）执行，主管部门为中国机械工业联合会。

Foreword

ChinaStandards.net is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative.

This standard is developed in accordance with the rules given in GB/T 1.1-2009.

This standard was proposed by and is under the jurisdiction of SAC/TC 260 National Technical Committee on Information Security of Standardization Administration of China.


Introduction

The health data includes personal health data and health related data obtained after processing the personal health data. With the vigorous development of health data application, "Internet Plus Healthcare" and intelligent healthcare, new businesses and applications are emerging, health data are facing more security challenges in all stages of the life cycle than before, and security issues are frequent. As health data security is a matter of patient life safety, personal information security, social public interest and national security, in order to better protect health data security, regulate and promote the integration, sharing and open application of health data, and promote the development of health care, the guide for health data security is developed.



Information security technology –
Guide for health data security

1 Scope

This standard specifies the security measures that health data controllers can take to protect the health data.

This standard is applicable to guiding health data controllers in the security protection of health data, and can also be used for reference by health care- and cybersecurity-related competent departments and third-party assessment agencies and other organizations when carrying out security supervision, management and assessment of health data.

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

GB/T 22080-2016 Information technology - Security techniques - Information security management systems - Requirements
GB/T 22081-2016 Information technology - Security techniques - Code of practice for information security controls
GB/T 22239-2019 Information security technology - Baseline for classified protection of cybersecurity
GB/T 25069 Information security technology - Glossary
GB/T 31168 Information security technology - Security capability requirements of cloud computing services
GB/T 35273 Information security technology - Personal information security specification
GB/T 35274-2017 Information security technology - Security capability requirements for big data services
GB/T 37964-2019 Information security technology - Guide for de-identifying personal information
ISO 80001 Application of risk management for IT-networks incorporating medical devices



3 Terms and definitions

For the purposes of this document, the terms and definitions given in GB/T 25069 and the following apply.

3.1
personal health data
electronic data that, alone or in combination with other information, can identify a specific natural person or reflect the physical or mental health of a specific natural person

Note: Personal health data relate to an individual's past, present or future physical or mental health status, health care services received and health care service fees paid for, etc., see Annex A.

3.2
health data
personal health data and health related electronic data obtained after processing the personal health data

Example: Overall analysis results, trend prediction, disease prevention and control statistics of a group obtained after processing group health data.

3.3
health service professional
persons authorized by the government or industry organization to be qualified to perform specific health work duties

Example: Doctor.

3.4
health service
service provided by a health service professional or paraprofessional that have an impact on health condition

3.5
health data controller
organizations or individuals who can determine the purpose, manner, scope, etc. of health data processing

Examples: Organizations, health insurance agencies, government agencies, health care scientific research institutions and individual clinics that provide health services.



3.6
health information system
system that collects, stores, processes, transmits, accesses, and destroys health data in a computer-processable form

3.7
limited data set
personal health data set that have been partially de-identified but still identify the corresponding individual and therefore need to be protected

Example: Health data from which identifications directly related to individuals and their families, family members, and employers are removed.

Note: Limited data set may be used for the purposes of scientific research, medical/health education and public health without individual authorization.

3.8
notes of treatment
observations, reflections, and program discussion conclusions recorded by health service professionals in the course of providing health services

Note: Notes of treatment have the attribute of intellectual property rights and their intellectual property rights belong to health service professionals and/or their units.

3.9
disclosure
act of transferring and sharing health data to specific individuals or organizations, as well as publicly releasing health data to unspecified individuals, organizations or society

3.10
clinical research
scientific research activities aimed at exploring the causes, prevention, diagnosis, treatment, and prognosis of diseases, conducted by medical institutions, academic research institutions, and/or healthcare-related enterprises, with patients or healthy individuals as research subjects

Note: Clinical research is a branch of medical research.

3.11
completely public sharing
data, once released, being difficult to recall and usually released directly to the public via the Internet

[GB/T 37964-2019, Definition 3.12]

3.12
controlled public sharing
constraining the use of data through data use agreement

[GB/T 37964-2019, Definition 3.13]

3.13
enclave public sharing
data shared within the physical or virtual enclave out of which data cannot flow

[GB/T 37964-2019, Definition 3.14]

4 Abbreviations

For the purposes of this document, the following abbreviations apply.

ACL: Access Control Lists

API: Application Programming Interface

APP: Application

DNA: DeoxyriboNucleic Acid

EDC: Electronie Data Capture

GCP: Good Clinical Practice

HIS: Hospital Information Systems

HIV: Human Immunodeficiency Virus

HL7: Healthcare Level 7

ID: ldentity

IP: Internet Protocol

IPSEC: Internet Protocol Security

LDS: Limited Data Set Files

PIN: Personal Identity Number

PUF: Public Use Files

RIF: Research Identifiable Files

RNA: RiboNucleic Acid

SQL: Structured Query Language

TLS: Transport Layer Security

USB: Universal Serial Bus

VPN: Virtual Private Network

XSS: cross-site scripting

7 Principles for use and disclosure

b) Without the authorization of the subject, the controller may use or disclose the corresponding personal health data under the following circumstances:

1) When providing the subject with his/her own health data;

2) During treatment, payment or health care;

3) When involving public interests or laws and regulations;

4) When the limited data set is used for the purposes of scientific research, medical/health education and public health;

Under the above circumstances, the controller may rely on legal and regulatory requirements, ethics and professional judgment to determine what personal health data is permitted to be used or disclosed.

c) The controller should obtain the authorization of the subject before using or disclosing personal health data for marketing activities, except for face-to-face marketing communication between the controller and the subject. The authorization for marketing activities should be presented to the subject in a reasonable manner, and the subject should be made fully aware of it and give his/her explicit and autonomous consent. The authorization should be independent and should not be a precondition for the subject to obtain any public service or medical service or be bundled with other service terms. While obtaining the authorization, the controller should inform the subject in writing that it has the right to revoke the authorization at any time.

1 Scope
2 Normative references
3 Terms and definitions
4 Performance requirements
5 Design
6 Manufacture
7 Naming of joints
8 Marking
9 Marking instructions (cited in this document)