Medical and Legal Aspects of the Practice of Teledermatology in Spain. / Aspectos medicolegales de la práctica de la teledermatología en España.

Teledermatology is now fully incorporated into our clinical practice. However, after reviewing current legislation on the ethical aspects of teledermatology (data confidentiality, quality of care, patient autonomy, and privacy) as well as insurance and professional responsibility, we observed that a specific regulatory framework is still lacking and related legal aspects are still at a preliminary stage of development. Safeguarding confidentiality and patient autonomy and ensuring secure storage and transfer of data are essential aspects of telemedicine. One of the main topics of debate has been the responsibilities of the physicians involved in the process, with the concept of designating a single responsible clinician emerging as a determining factor in the allocation of responsibility in this setting. A specific legal and regulatory framework must be put in place to ensure the safe practice of teledermatology for medical professionals and their patients.

Fundamental privacy rights in a pandemic state.

Faced with the emergence of the Covid-19 pandemic, and to better understand and contain the disease's spread, health organisations increased the collaboration with other organisations sharing health data with data scientists and researchers. Data analysis assists such organisations in providing information that could help in decision-making processes. For this purpose, both national and regional health authorities provided health data for further processing and analysis. Shared data must comply with existing data protection and privacy regulations. Therefore, a robust de-identification procedure must be used, and a re-identification risk analysis should also be performed. De-identified data embodies state-of-the-art approaches in Data Protection by Design and Default because it requires the protection of direct and indirect identifiers (not just direct). This article highlights the importance of assessing re-identification risk before data disclosure by analysing a data set of individuals infected by Covid-19 that was made available for research purposes. We stress that it is highly important to make this data available for research purposes and that this process should be based on the state of the art methods in Data Protection by Design and by Default. Our main goal is to consider different re-identification risk analysis scenarios since the information on the intruder side is unknown. Our conclusions show that there is a risk of identity disclosure for all of the studied scenarios. For one, in particular, we proceed to an example of a re-identification attack. The outcome of such an attack reveals that it is possible to identify individuals with no much effort.

Privacy versus Public Health? A Reassessment of Centralised and Decentralised Digital Contact Tracing.

At the beginning of the COVID-19 pandemic, high hopes were placed on digital contact tracing. Digital contact tracing apps can now be downloaded in many countries, but as further waves of COVID-19 tear through much of the northern hemisphere, these apps are playing a less important role in interrupting chains of infection than anticipated. We argue that one of the reasons for this is that most countries have opted for decentralised apps, which cannot provide a means of rapidly informing users of likely infections while avoiding too many false positive reports. Centralised apps, in contrast, have the potential to do this. But policy making was influenced by public debates about the right app configuration, which have tended to focus heavily on privacy, and are driven by the assumption that decentralised apps are "privacy preserving by design". We show that both types of apps are in fact vulnerable to privacy breaches, and, drawing on principles from safety engineering and risk analysis, compare the risks of centralised and decentralised systems along two dimensions, namely the probability of possible breaches and their severity. We conclude that a centralised app may in fact minimise overall ethical risk, and contend that we must reassess our approach to digital contact tracing, and should, more generally, be cautious about a myopic focus on privacy when conducting ethical assessments of data technologies.

South Africa's COVID-19 Tracing Database: Risks and rewards of which doctors should be aware.

In response to the COVID-19 pandemic, South Africa (SA) has established a Tracing Database, collecting both aggregated and individualised mobility and locational data on COVID-19 cases and their contacts. There are compelling public health reasons for this development, since the database has the potential to assist with policy formulation and with contact tracing. While potentially demonstrating the rapid facilitation through technology of an important public service, the Tracing Database does, however, infringe immediately upon constitutional rights to privacy and heightens the implications of ethical choices facing medical professionals. The medical community should be aware of this surveillance innovation and the risks and rewards it raises. To deal with some of these risks, including the potential for temporary rights- infringing measures to become permanent, there are significant safeguards designed into the Tracing Database, including a strict duration requirement and reporting to a designated judge. African states including SA should monitor this form of contact tracing closely, and also encourage knowledge-sharing among cross-sectoral interventions such as the Tracing Database in responding to the COVID-19 pandemic.