의료정보 클라우드컴퓨팅 규제와 법적 과제

Abstract

The Ministry of Health and Welfare revised the Enforcement Rule of the Medical Service Act on February 5, 2016, allowing medical institutions to utilize the cloud to store and manage electronic medical records in an external location. This became effective on August 6, 2016. If a medical institution utilizes a cloud computing system, it will be subject to the Act on the Development of Cloud Computing and Protection of Its Users, hereinafter referred to as the Cloud Computing Act. The Medical Service Act, the Framework Act on Health and Medical Service, the Act on Mental Health and Welfare Service, the Mother and Child Health Act, and the Personal information Protection Act also regulate the protection of medical information, and, in addition to the Cloud Computing Act, the Telecommunications Business Act, the Act of Information and Communication Networks, the eGovernment Act, and the Framework Act on National Informatization serve to regulate information and communication systems. Korea's cloud computing–related industries are still in their infancy. However, to promote the cloud computing industry, the Cloud Computing Act has been introduced so that the public sector can lead. As the Enforcement Rule of the Medical Service Act is enacted and the Ministry of Health and Welfare promulgates the medical records management preservation facility standards, it is expected that cloud computing systems will be actively utilized, particularly by small and medium-size medical institutions. However, as healthcare information protection issues may arise due to the sharing of personal medical information via cloud computing, it is necessary to make the legal issues of the Medical service laws and the Cloud Computing Act clear. On May 25, 2018, the European Union's General Data Protection Regulation, hereinafter referred to as GDPR, will be enacted. The Code of Conduct for Cloud Computing, based on the GDPR, has already been established, in 2017. Because cloud computing consists of cross-border virtualization and decentralization technologies, Korean companies and cloud computing providers will also be subject to the European Privacy Protection Act. In this paper, I review the regulatory status of medical information cloud computing, the legal aspects of medical information cloud computing, the issue of compensation for damages, and the storage of information abroad, by referring to the EU GDPR and Code of Conduct.