Turkish Regulation on Health Information Management Systems was published in the Official Gazette and entered into force.
The Regulation on Health Information Management Systems (HIMS Regulation) was published in the Official Gazette numbered 31934 and dated 25/8/2022, and entered into force.
The matters regulated by the Regulation were previously arranged by the General Directorate of Health Information Systems of the Turkish Ministry of Health (MoH) through a Circular No. 2015/17.
Introduction
Health Information Management System Regulation (HIMS Regulation) sets out the procedures and principles related to the rules that service providers must comply with, the procurement processes of health information management systems, their standards, and the determination of registration procedures. HIMS Regulation includes provisions related to the rules that must be complied with by health information management system service providers and those who benefit from this service.
Integrations and standards that HIMS service providers must provide, provisions for imaging service providers, data model, delivery and transfer of data between HIMS service providers, data backup and archiving are regulated.
Administrative and technical measures to ensure the confidentiality and security of personal health data are mentioned. How the log records will be kept, how and on which parameters the inspections will be carried out by the MoH are also among the issues included in the Regulation.
Key Definitions and Concepts
KTS Application
KTS Documents
Registry of Registration System (KTS) is managed by the Ministry of Health (MoH), General Directorate of Health Information Systems (SBSGM) in order to be able to operate in health service providers.
The application process is carried out electronically, transactions can be made via Registered Electronic Mail or e-Government. Authorization certificates are issued to HIMS service providers on the active list at KTS.
Copy of Trade Registry Gazette
First and latest copy of the corporate from Turkish Trade Registry Gazette.
Workplace Reg. Number
Document Indicating the Social Security Institution Workplace Registration Number.
Balance Sheet For Three Years
Approved balance sheet for the last 3 years from a tax office or a certified public accountant.
Signature Circular
In order to confirm whether relevant person is authorised to sign or not.
Apostilled Document
This is only needed if the software produced abroad.
17021 Certificate of the Firm
Certificate for Conformity Assessment of the firm issues ISO 27001.
TS ISO/IEC 15504
Certificate for SPICE level 2 (min) or CMMI level 3 (min).
Certificate for Programs
Certificate that could be obtained from the Ministry of Culture and Tourism.
TS ISO/IEC 27001 Certificate
Certificate for Information Security Management.
List of Produced Software
Which software would be registered to the KTS?
Information of User
Share information about your software's user(s) such as general practitioner or dentist.
HIMS Audit
The Ministry may audit or have the HIMS service provider audited, ex officio or upon complaint. Nevertheless, the Regulation foresees that the audit cannot go beyond the scope of the service provided by the responsibility of the HIMS service provider.
In the remote or on-site audits, audits are conducted on the following matters:
If the deficiencies identified during these audits are not remedied within a certain period of time, relevant HIMS service provider will be placed on the passive list and this process may ultimately result in complete removal from the list.
Enforcement
Except for Articles 17 and 20, the provisions of the Regulation have come into effect on the date of 25/8/2022, when the Regulation was published in the Official Gazette. On the other hand, Article 17 (Event and trace logs) is on effect from 25/8/2023 and Article 20 (Competency score) is on effect from 25/4/2024.
Dates
25/8/2022
25/8/2023
25/4/2024
Article 17 (Event and trace logs)
1- HIMS service recipients shall be obliged to retain their SAMILOG records for no less than five years, and all other records for no less than two years, within their proprietary servers.
2- SAMILOG records pertaining to AHBS shall be conserved within the database in such a manner as to preclude alteration via AHBS.
3- All modifications effected by users at the database level, inclusive of data addition, data deletion, data modification, and all transformations enacted upon database objects, shall be preserved.
4- All systems engendering event and trace logs shall be synchronized by means of a time server to be furnished by the HIMS service recipient, for the express purpose of engendering uniform time information throughout the system.
5- Event and trace logs shall be safeguarded against unauthorized access, erasure, and modification. The event and trace logs so generated shall be retained by affixing a signature through a qualified time stamp, as provided by either resident qualified electronic certificate service providers within Türkiye or by SBSGM.