Article 73 1

(a)

the restriction of access to the secure processing environment to authorised natural persons listed in the data permit issued pursuant to Article 68;

(b)

the minimisation of the risk of the unauthorised reading, copying, modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technical and organisational measures;

(c)

the limitation of the input of electronic health data and the inspection, modification or deletion of electronic health data hosted in the secure processing environment to a limited number of authorised identifiable individuals;

(d)

ensuring that health data users have access only to the electronic health data covered by their data permit, by means of individual and unique user identities and confidential access modes only;

(e)

the keeping of identifiable logs of access to and activities in the secure processing environment for the period necessary to verify and audit all processing operations in that environment; logs of access shall be kept for at least one year;

(f)

ensuring compliance and monitoring the security measures referred to in this paragraph to mitigate potential security threats.