(1)

Commission Implementing Decision 2014/287/EU (2) sets out criteria for establishing and evaluating European Reference Networks and their Members and for facilitating the exchange of information and expertise on establishing and evaluating those Networks. Article 6 of that Decision invited Member States to set up a Board of Member States with a view to deciding whether or not to approve proposals for Networks, their membership and termination. The Member States set up the Board of Member States, which subsequently approved 23 European Reference Networks (ERNs) in December 2016 and one in February 2017. All Networks commenced activities in 2017.

(2)

To increase the efficiency of the European Reference Networks, the Board of Member States should become the forum for exchanging information and expertise in order to steer the development of the ERNs, provide guidance to the Networks and to the Member States and advise the Commission on matters related to the establishment of the Networks. To promote the exchange of experience and to facilitate a process consistent with other cross border exchanges of health data, the Board should foresee a close cooperation with the eHealth Network to develop, wherever possible, common approaches, data structures and guidelines facilitating transparent access to different services and streamlining rules for healthcare providers. The Board should also promote the discussion with other relevant EU fora (such as Steering Group on Health Promotion, Disease Prevention and Management of Non-Communicable Diseases) on areas of common interest.

(3)

The current experience of the 24 existing ERNs has shown that to ensure an effective functioning of each Network, its Members should closely cooperate in performing their tasks, such as exchanging health data concerning patients' diagnoses and treatment in an efficient and secure manner, contributing to scientific research activities and to the development of medical guidelines. Close cooperation requires mutual trust among the Members of each Network and mutual recognition in particular of their expertise and competence, of the quality of their clinical care as well as of their specific human, structural and equipment resources as provided for under point 2 of Annex II to Commission Delegated Decision 2014/286/EU (3).

(4)

Mutual trust and recognition by peers are equally important where healthcare providers wish to join an existing Network as they guarantee the right pre-conditions for future cooperation within the Network. A favourable opinion on the membership application by the Board of the Network that the healthcare provider wishes to join, following a peer review carried out by the Network on the basis of the criteria and conditions set out in point 2 of Annex II to Delegated Decision 2014/286/EU, should therefore accompany such application when it is assessed by an independent assessment body appointed by the Commission. In order to allow the healthcare provider express its views on the opinion of the Board of the Network, the healthcare provider should be permitted to submit comments on the draft opinion within a period of one month from the date of receipt of that opinion.

(5)

Reasonable deadlines should be set out for the Board of the Network as regards the draft and final opinion. The deadline for the final opinion should therefore, in principle be set at four months. However, in case the healthcare provider submits comments on the Board of the Network's draft opinion, the four-month deadline for delivering the final opinion should be extended by one month in order to allow the Board of the Network to take into account the comments received. For reasons of legal certainty, if the Board of the Network fails to send the draft opinion or deliver the final opinion within the deadlines set, the final opinion should be deemed favourable.

(6)

If a membership application receives an unfavourable opinion by the Board of the Network that the healthcare provider wishes to join, while having received the endorsement in the form of a written statement from the healthcare provider's Member State of establishment, the Member State of establishment should have the possibility of requesting the Board of Member States to decide, on the basis of the criteria and conditions set in point 2 of Annex II to Delegated Decision 2014/286/EU, whether the application can nevertheless be submitted to the Commission.

(7)

In order to support health professionals across the ERNs to collaborate remotely in the diagnosis and treatment of patients with rare or low prevalence complex diseases or conditions across national borders and to facilitate scientific research of such diseases or conditions, the Commission developed a Clinical Patient Management System for ERNs (‘CPMS’) with the aim of facilitating the establishment and functioning of the ERNs as provided for in point (c) of paragraph 4 of Article 12 of Directive 2011/24/EU.

(8)

The CPMS should provide a common infrastructure for health professionals to collaborate within the ERNs in the diagnosis and treatment of patients with rare or low prevalence complex diseases or conditions. It should provide the means through which the exchange of information and expertise on such diseases takes place within the ERNs in the most effective way.

(9)

The CPMS should therefore consist of a secure IT infrastructure providing a common interface where healthcare providers that are members of the ERNs, Affiliated Partners (4) or guest users (‘healthcare providers authorised to access CPMS’), can exchange information within the Networks on the concerned patients with the aim of facilitating their access to safe and high quality healthcare and promoting effective cooperation on healthcare between Member States by facilitating the exchange of relevant information.

(10)

In order to guarantee compliance with data protection rules and ensure the use of an effective and secured environment for the electronic exchange of personal data of patients between healthcare providers within the ERNs for the purposes referred to in paragraph 2 of Article 12 of Directive 2011/24/EU, such exchange should take place only on the basis of the patients' explicit consent and only through the CPMS. The healthcare providers are responsible for ensuring the security of the data they process outside of the CPMS with the aim of entering them into the CPMS, as well as of the data that are not entered into the CPMS but are processed by them in relation with the CPMS (such as consent forms) or of the data downloaded by them from the CPMS and processed outside of the CPMS.

(11)

The CPMS processes sensitive data concerning patients suffering from rare or low prevalence complex diseases. These data are processed solely for the purpose of facilitating patients' diagnosis and treatment, for entering them into relevant registries or other databases for rare and low prevalence complex diseases, which serve a scientific research, clinical or health policy purposes and for contacting potential participants for scientific research initiatives. Healthcare providers within the ERNs should be able to process the patients' data in the CPMS once they have obtained the patients' specific, informed and free consent about three possible uses of their data (medical assessment of the file for advice on diagnosis and treatment, entering the data in rare diseases registries or other databases for rare and low prevalence complex diseases and possibility for the patients to be contacted to participate in a scientific research initiative). The consent should be obtained separately for each of these three purposes. This decision should lay down the purposes and the safeguards for the processing of such data in the CPMS. In particular, the Commission should provide for the general features of the CPMS in relation to each Network, should provide and maintain the secure IT infrastructure required to that end and should ensure its technical functioning and security. In line with the principle of data minimisation, the Commission should only process personal data strictly necessary in order to ensure the administration of the CPMS in relation to each Network and therefore should not access health data of patients exchanged in the ERNs, unless it is strictly necessary to fulfil its obligations as a joint controller.

(12)

This Implementing Decision should only apply to processing of personal data, which takes place in the CPMS, in particular contact details, and health data, within the ERNs.

(13)

Article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council (5) and Article 28 of Regulation (EU) 2018/1725 of the European Parliament and of the Council (6) place an obligation on joint controllers of personal data processing operations to determine, in a transparent manner, their respective responsibilities for compliance with the obligations under these Regulations. They also provides for the possibility to have those responsibilities determined by Union or Member State law to which the controllers are subject.

(14)

Implementing Decision 2014/287/EU should therefore be amended accordingly.

(15)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 13 September 2018.

(16)

The measures provided for in this Decision are in accordance with the opinion of the Committee set up under Article 16 of Directive 2011/24/EU,

(1)

The following Article 1a is inserted:

(2)

In Article 8, the following paragraphs 4, 5 and 6 are inserted:

(3)

In Article 9, paragraph 1 is replaced by the following:

(4)

In Chapter IV, the following Article 15a is inserted:

(5)

The following Article 16a is inserted:

(6)

The following Article 16b is inserted:

(7)

The following Article 16c is inserted:

(8)

Annex III is added, the text of which is set out in Annex I to this Decision.

(9)

Annex IV is added, the text of which is set out in Annex II to this Decision.