“Each hospital must create a GDPR-compliant CPMS 2.0 Patient Consent Form. This is their responsibility, and they are accountable to their national data privacy authorities. To minimize errors when enrolling a patient in CPMS 2.0, the patient consent form text should be aligned with CPMS 2.0’s three consent types: mandatory consent for care, optional consent for educational purposes, and optional consent for data export to registries. The EC is providing patient consent templates in all 24 official EU languages which are GDPR compliant and well aligned with CPMS 2.0. However, each hospital is free to decide on the template to use. If a hospital was already using the CPMS, the old consent form can still be used but the transfer of patient consent from the paper form to the IT platform should be carefully done as the old form is not well aligned with the new CPMS. Each hospital must assess the need for carrying out a data privacy impact assessment. Two cases can be considered:
a) Members and affiliated partners that have already used CPMS and will be switching over to CPMS 2.0.
b) Members and affiliated partners that never used CPMS.
Those which are already using the CPMS should have carried out in the past a Data Privacy Impact Assessment of their activities related to the use of CPMS, according to the guidelines of their respective national data privacy authorities. They just need to assess if a revision to that DPIA is needed. In most cases it is not, as the processing activities in the hospital did not change; however, it is up to the hospital to assess and decide.
Those which never used the CPMS most probably never carried out a DPIA in the past. In that case, they must assess the need of carrying out a DPIA on their activities related to the use of CPMS, according to the guidelines of their respective national data privacy authorities and, if considered necessary, carry out the DPIA.
The Data Privacy Officer of each hospital must take action, but this is not necessarily a complex task, in most cases it is even a very simple exercise. Some questions in the FAQ document address this topic in more detail and the answers provide additional information.” Further information will follow shortly.
