MEDICINE, LAW & SOCIETY Vol. 15, No. 1, pp. 169–192, April 2022 https://doi.org/10.18690/mls.15.1.169-192.2022 © 2022 University of Maribor, University Press DIGITAL TRANSFORMATION AS ONE OF THE INSTRUMENTS FOR OVERCOMING THE PUBLIC HEALTH CRISIS: THE ROLE AND USE OF EHEALTH SOLUTIONS DURING THE COVID-19 PANDEMIC IN SLOVENIA Accepted 10. 2. 2022 Revised 28. 2. 2022 Published 26. 4. 2022 DALIBOR STANIMIROVIĆ,1 MATJAŽ DREV,2 ŽIVA RANT2 1 University of Ljubljana, Faculty of Public Administration, Ljubljana, Slovenia, dalibor.stanimirovic@fu.uni-lj.si 2 National institute of Public Health, Ljubljana, Slovenia, matjaz.drev@nijz.si, ziva.rant@nijz.si CORRESPONDING AUTHOR dalibor.stanimirovic@fu.uni-lj.si Keywords digital transformation, public health, COVID-19, information security, eHealth Abstract The comprehensive digital transformation of the Slovenian healthcare system and the use of national eHealth solutions would enable the citizens and healthcare professionals to access data and information relevant to high- quality healthcare services, and healthcare managers to take evidence-based decisions and measures. This paper analyses the role and use of selected eHealth solutions during the Covid-19 pandemic in Slovenia. The pandemic has led to significant growth in interest in digital transformation processes and the use of eHealth solutions. It also breaks down the normative framework of eHealth and the compliance of eHealth solutions with the fundamental principles of information security and the General Data Protection Regulation. The study proceeded from a review of the literature, followed by discussions with experts engaged in managing eHealth solutions and an examination of current statistical data on the use of these solutions from administrator modules. The results of the study show that the Covid-19 pandemic could constitute a turning point in our understanding of digital transformation, which is becoming not only a key public health management instrument, but also an indispensable driver to further develop the healthcare system, and empower patients at times of national and international public health crises. 170 MEDICINE, LAW & SOCIETY. 1 Introduction In recent years the Slovenian public health system has been faced with numerous challenges brought about by various systemic and socio-economic circumstances and by unfavourable public health trends (WHO, 2016). The health system is confronted with issues relating to the management and scarcity of resources, and with frequently outdated and inadequate legislation. Radical and wide-ranging changes to current health regulations are required if we are to meet these challenges and ensure the sustainability of the public health system. The digital transformation process is therefore key to innovation and to the establishment of a more efficient and more successful health system. In this text, the term ‘digital transformation’ is used to mean the comprehensive introduction of information and communications technology (ICT) into the operational and business processes of the health system. In international strategic documents, ICT is an essential instrument for improving health services to patients and ensuring the timely monitoring of all parameters of operation within the health system (European Commission, 2018). The most recent Slovenian strategic document, which is the Resolution on the National Healthcare Plan 2016–2025 (‘Together for a Healthy Society’), outlines several specific targets in the area of ICT in health. In common with EU documents, which emphasise the importance of having efficient, accessible and flexible health systems, the resolution highlights the implementation of standardised and effective ICT solutions as the overarching strategic objective. These ICT solutions would provide adequate data for healthcare services and support the evidence-based adoption of management decisions (Ministry of Health, 2016). Reliable health, financial and administrative data would bring improvements not only to the planning and management of individual healthcare providers but to the health system as a whole (Stanimirović, 2015). Studies show that successful projects for digital transformation in health are extremely important in strategic terms for the future development of the health system, with far-reaching impacts on economic growth and social development (Wolff et al., 2020). The project to digitally transform Slovenian healthcare (‘eZdravje’ or ‘eHealth’), which follows national, European and World Health Organization guidelines, is one of the Slovenian public sector’s key long-term goals (Ministry of Health, 2005; Cardenas, 2021). The eHealth system combines a series of digital solutions that D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 171. provide for safer and more effective healthcare services. The goal of eHealth is to introduce modern and versatile digital solutions into the workings of the Slovenian health system, and to connect local information systems into a functional national health information system. This interconnection of local information systems ensures that the citizens and health professionals are able to overcome the many obstacles to finding information relevant to the health provision process (Ammenwerth, 2018), and improves managers’ ability to monitor the operation of healthcare institutions and improve the way they take decisions and adopt measures (Steurs et al., 2018). The comprehensive digital transformation of the health system will provide Slovenian healthcare with opportunities to engage in even higher quality and more professional work with patients, manage health-related information and data quickly and securely, and further develop the health system and make it more competitive within the European context. In its current form, the most important elements of the Slovenian eHealth are digital solutions such as electronic prescriptions (‘eRecept’), electronic appointments (‘eNaročanje’), the central register of patient data (CRPP, which contains the results of specialist examinations, microbiological results, discharge letters, outpatient medical results, vaccinations and other patient records) and the zVEM portal. There is, of course, also a whole raft of back-office infrastructure and network platforms used by eHealth solutions that are not, in general, aimed directly at users (and are therefore not addressed specifically in this paper). In view of what has happened since the publication of the first strategic document on digital transformation in health in 2005, the implementation of the eHealth system, which was rolled out in 2016, represents an important milestone in the history of the development of Slovenia’s health system (Stanimirović et al., 2021). This paper focuses on an analysis of the role and use of ePrescriptions, eAppointments, the CRPP and the zVEM portal during the Covid- 19 pandemic in Slovenia; it also breaks down the normative framework of eHealth and the compliance of eHealth solutions with the fundamental principles of information security and the General Data Protection Regulation (GDPR). 172 MEDICINE, LAW & SOCIETY. 2 Methods Our analysis was performed by reviewing the literature and legislation from this area (Tulu et al., 2016; Glöggler and Ammenwerth, 2021); the project-design documentation and technical specifications of the solutions themselves; and by analyzing expert opinions and experiences of 15 specialists from the National Institute of Public Health (NIJZ) involved in eHealth solutions, and on current statistical data on the use of these solutions from their administrator modules (Sim and Waterfield, 2019). The selection of research methods was based on the particular features of the research field and the fact that the entire area of digital transformation in healthcare in Slovenia is still in its embryonic stages, which means that there is only a narrow circle of experts with appropriate knowledge and experience in this field (Yin, 2017). This methodological approach has provided both an insight into the theoretical and technological starting points to date for these kinds of digital solution, and an empirical overview of the actual situation, the development stages and the use of the selected solutions in the Slovenian health system and the wider social environment (Mohajan, 2018). The participation of experts from the NIJZ in the study enabled not just an insight into the technological/technical, statistical and administrative aspects of the workings of eHealth solutions, but also a critical and thorough insight into the user aspects of these solutions. The NIJZ experts are well- acquainted with the user experiences of patients and health professionals in the field and their satisfaction with the solutions, as the managers of the solutions are involved on a daily basis in resolving requests and responding to questions via the User Support Sevice (15,217 requests by eHealth solution users from throughout Slovenia in 2020, which rose to 104,684 by November 2021, NIJZ, 2021). The big jump in the number of requests/questions in 2021 can be attributed primarily to the significant interest shown by the public in registering for Covid-19 vaccination and acquiring digital Covid certificates. As NIJZ experts are strongly involved in handling and resolving such a large annual number of requests or questions from users, they are able to provide a reliable and objective assessment of both user experiences and of the technological adequacy and quality of eHealth solutions. The analysis of the role and use of eHealth solutions was conducted in the first half of 2021 by means of a review of the literature in this field and of the project-design documentation and technical specifications. Structured interviews with NIJZ experts D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 173. and the acquisition of statistical data from business and administrator modules were carried out between June and December 2021. This paper focuses on the selected eHealth solutions principally because of their usefulness and importance for patients and health professionals alike, and because of the considerable progress made in the past two years. The synthesis of findings from the literature, user functionalities from the technical documents, statistical reports and the views of NIJZ experts enabled us to formulate credible conclusions based on verifiable data regarding the highlighted research aims. The use of the methodological framework referred to above, which includes a combination of different data collection approaches and techniques, was of key importance to the credibility of the analysis of the role and use of the selected eHealth solutions (Thomas, 2021). At the concluding stage of the study, the comprehensive analysis of data acquired from a variety of sources and from structured interviews with NIJZ experts provided a key basis for interpreting the data and formulating consistent conclusions regarding the research premises of the paper, which address the role and use of the selected eHealth solutions. 3 Results Despite a lack of a set of uniform strategic documents and guidelines, considerable progress has been made in recent years in the implementation and use of individual eHealth solutions. In view of the course of events, starting with the publication of the first strategic document in the area of the digital transformation of health in 2005, the implementation of the eHealth system represents an important turning point. We hope that recent events in the field of eHealth are confirmation of an increasing awareness on the part of decision-makers (and above all users) that modern digital solutions can have a major impact on the management of public health, and provide vital support to all decision-making, planning and management processes within the health system. The latter is confirmed by the statistical data and by the various evaluations carried out by national and international institutions. ePrescriptions accounted for over 96 percent of all prescriptions issued in 2021 (calculated as a monthly average); in absolute numbers, this was more than 1,171,000 ePrescriptions per month. At almost 96 percent, the percentage of eReferrals within 174 MEDICINE, LAW & SOCIETY. the eAppointments system was similar (more than 322,000 eReferrals per month in 2021). The number of healthcare documents that healthcare providers send to the CRPP is growing continuously, while the zVEM portal recorded more than 768,000 visits in 2019, 1,883,854 visits in 2020 and 23,975,212 visits in 2021. Table 1 shows the cumulative increase in the use of eHealth solutions in Slovenia at the annual level between its introduction into the health system in 2016 and the end of 2021. The statistics contained in Table 1 evidences the continuous growth in the use of eHealth solutions over the past six years, and it is likely that this growth will accelerate in future years, particularly if the difficult and unpredictable public health conditions brought about by Covid-19 continue. Table 1: Annual growth in the use of eHealth solutions in Slovenia 2016–2021 2016 2017 2018 2019 2020 2021 eAppointments Number of eReferrals 241,379 2,509,518 3,564,993 3,946,878 3,273,719 3,871,269 % of all referrals 42.96 84.71 95.11 93.92 94.97 95.99 ePrescriptions Number of ePrescriptions 12,326,845 13,095,808 13,867,192 13,895,517 13,790,000 14,060,730 % of all prescriptions 87.23 88.73 92.33 93.47 95.63 96.06 CRPP Number of documents 3,180,704 6,436,900 9,411,132 15,201,309 53,294,237 115,527,06 1 Oct zVEM portal Number of visits 669 262,012 548,512 768,255 1,883,854 23,975,212 An evaluation conducted by the Ministry of Public Administration for the 2016– 2018 period shows that the use of eHealth solutions (ePrescriptions and eAppointments) has led to savings in the health system of approximately EUR 40 million in total (Ministry of Public Administration, 2019). In addition to the financial savings, the evaluation also highlights the other systemic benefits of ePrescriptions and eAppointments, such as simplified and more efficient patient services, a simplification of procedures for patients, greater standardisation, high-quality and secure health data, better communication between general practitioners and consultants, lower administrative costs, the accessibility of data for analysis and research, and so on. Graph 1 shows the annual dynamics of savings as set out in the Ministry of Public Administration’s evaluation. D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 175. Graph 1: Estimated savings produced by the introduction of ePrescriptions and eAppointments 2016–2018 Source: own. The European Commission’s Digital Economy and Society Index (DESI) is a composite index that summarises relevant indicators on digital service provision and performance, and tracks the evolution of EU Member States in digital competitiveness. The 2019 DESI report marks a major breakthrough in the development and use of eHealth services in Slovenia, with the country being ranked sixth in the EU (European Commission, 2019) (Graph 2). Slovenia’s position (marked in black) is considerably above the EU-28 average (marked in white); it is also better than many countries with a comparable or even higher GDP and a comparable population. Graph 2: Use of eHealth services in EU Member States (2019 DESI report) Source: own. Digital solutions for the monitoring of quality and safety in hospitals are also relatively well-developed. In 2002, the Ministry of Health established a system for 2.187.328,11 3.122.040,63 3.203.915,51 1.186.715,72 12.337.794,30 17.526.931,59 0,00 5.000.000,00 10.000.000,00 15.000.000,00 20.000.000,00 2016 2017 2018 Sa vi ng s i n EU R YearePrescriptions eAppointments 0% 10% 20% 30% 40% 50% EE F I D K SE ES S I U K IT N L H R B E LU L T EU 28 A T SK C Z PL PT LV F R R O IE B G EL C Y D E H U M T Pe rc en ta ge o f u se Member States (EU-28) 176 MEDICINE, LAW & SOCIETY. tracking warning events and receiving reports from healthcare providers. In line with the requirements, hospitals have introduced digital solutions in the form of online self-assessment questionnaires that enable quality and safety indicators to be monitored and the appropriate measures to be taken when deviations are established. The development of a national online portal has also been under way that will allow patients to report any deviations they detect in the quality or safety of their own treatment; unfortunately, the project was halted in April 2020 because of the Covid-19 pandemic. Specialist web expert systems are in place in several areas; these provide advanced support for decision-making and AI-supported predictive analysis. However, this practice is not widespread in Slovenia and is not used on a routine basis by healthcare providers. Expert systems, which are usually used in combination with decision- making algorithms and smart devices, are generally deployed to monitor and interpret batch analyses of large amounts of data in certain fields, where this is substantively and technologically feasible (Covid-19 patients, chronic patients, monitoring of cancer patients, clinical chemistry, etc.). Nevertheless, this branch of the digital system is still in its infancy in Slovenia and the main impetus for the development of these types of systems have come from national and international research projects in recent years. As we can see, a multi-faceted analysis of the development, use and efficiency of eHealth solutions places Slovenia high on the list of the most successful countries in the field of eHealth. That said, when the first case of Covid-19 was detected in Slovenia in March 2020, which was followed several days later by the declaration of an epidemic by the government, questions began to be raised about the benefits of eHealth in such situations. Although a number of eHealth analyses and assessments had already been undertaken, no observations or evaluations had been produced of the possible benefits of such solutions within the context of an epidemic. It is interesting to note that, up to that point, numerous aspects of the development and use of digital solutions in health had been studied, including those of a peripheral nature that often barely warranted legitimate interest from researchers. There has definitely been a lack of research interest in such a vital area as the possible benefits of digital solutions in situations such as the Covid-19 pandemic. Starting from this premise, we outline below the course of the Covid-19 pandemic in Slovenia, review D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 177. the socio-economic consequences and the measures taken in response nationally and at EU level, and, most importantly from the point of view of our research, provide an analysis of the role of eHealth solutions and the uses to which they were put, for health professionals and patients, during the Covid-19 pandemic in Slovenia. The first case of Covid-19 infection in Slovenia was detected on 4 March 2020, and the epidemic was officially declared on 12 March. The government quickly introduced a series of restrictive measures to tackle the Covid-19 outbreak. Owing to the relatively positive trends, the measures were gradually withdrawn at the start of April and, on 31 May 2020, the government officially announced the end of the epidemic. Since then, there have been several significant waves of infection. The total number of people infected since the start of the pandemic stood at 909,643 by 9 March 2022, with the total number of deaths estimated at 6,388 by 10 March 2022. By 9 March 2022, 1,219,138 people had been fully vaccinated (NIJZ, 2022). Although most of the epidemiological measures have been relaxed in recent months, the virus is still circulating. Epidemiologists are discussing the possibility of further, more serious Covid-19 outbreaks and consequences, in the coming period. Protective measures, such as social distancing and mask-wearing, are still required in certain situations. The epidemic and the accompanying measures have had a serious impact on the Slovenian economy, and on Slovenia’s health and other social sub- systems. To mitigate the consequences of the epidemic, the government adopted several regulatory measures at a total cost of more than EUR 6 billion (ZIUZEOP, 2020); however, it is now clear that the pandemic will have deep and lasting consequences. In general, one can say that the socio-economic consequences are even more severe, on average, in the rest of the EU. The European Commission proposed that the entire EU budget potential be mobilised for investments in and the financing of key areas with the aim of reviving Member States’ economies. The Commission activated the emergency European Recovery and Resilience Facility in the amount of EUR 750 billion, together with three important safety nets for workers, enterprises and citizens worth EUR 540 billion. According to plans, this will provide EUR 1,290 billion in targeted support measures for Member States’ recovery efforts (European Commission, 2020). These funds are gradually being directed to Member States from the EU budget for key areas such as the strengthening of health and 178 MEDICINE, LAW & SOCIETY. social systems and support for the green and digital economies, with the final aim of ensuring sustainable development and more stable socio-economic foundations in Member States. Commission representatives stress that additional funds will be provided for the relevant measures if the crisis continues or successive waves of infection arrive. An important question is the role and usefulness that eHealth solutions played for health professionals and patients during the Covid-19 pandemic. The everyday operations of the health system came to a halt during the pandemic, with the exception of emergency procedures and cancer treatment. Owing to the new treatment and safety protocols, health professionals faced major challenges in their work. Moreover, patients tried to reduce the number of personal visits to healthcare institutions as much as possible from fear of infection, and in response to the changes that had to be introduced to healthcare services and the various restrictions put in place by the institutions themselves. The various eHealth solutions (ePrescriptions, eAppointments, zVEM portal, CRPP) suddenly became the only way of providing fast, effective and safe health services, and of enabling proper communication between health professionals and between health professionals and patients (Kruse et al., 2018; Van den Bulck et al., 2018). After the initial shock of the epidemic, interest in using eHealth solutions increased overnight among health professionals and patients, with a surprising flattening in the learning curve. Because of the exceptional circumstances, along with other inherent factors and pressure from patients, health professionals began to make more intensive use of eHealth solutions. Patients showed the greatest interest in monitoring their health and well- being using the healthcare documents accessible via the zVEM portal and the CRPP. The statistical data supports the qualitative findings outlined above. The zVEM portal, and the CRPP in particular, saw a significant rise in use during lockdown and immediately afterwards (Graphs 3 and 4). Despite the significant restrictions placed on the health system in many areas and the reduction in the number of patients admitted, other eHealth solutions maintained a relatively stable level of use, or even grew; this confirms that they also have a critical role to play in patient services and the general operations of the health system as a whole. D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 179. Graph 3: Growth in the number of registered users of the zVEM portal by year Source: own. Graph 4: Cumulative growth in the number of microbiological results in the CRPP November 2019–December 2021 Source: own. 10.412 24.025 35.820 44.296 409.900 0 50.000 100.000 150.000 200.000 250.000 300.000 350.000 400.000 450.000 2017 2018 2019 2020 2021 8 476.546 1.300.146 2.615.982 0 500.000 1.000.000 1.500.000 2.000.000 2.500.000 3.000.000 180 MEDICINE, LAW & SOCIETY. Experiences from the Covid-19 epidemic have shown that eHealth solutions play a very important role in such situations. Statistical data on use clearly indicate that health professionals and patients are becoming increasingly aware of the many benefits of eHealth, particularly in unexpected and crisis situations that affect the health system and the way it operates. Moreover, it has been shown that, for health professionals and patients, eHealth solutions have even greater use value in such circumstances than they do in ‘normal’ circumstances. Users (health professionals and patients) have shown a particularly high interest in this period in viewing and obtaining microbiological results, Covid vaccination, test or recovery certificates and, of course, EU digital Covid certificates, as confirmed by studies in other countries (Chen et al., 2021; Mbunge et al., 2021). 4 Normative framework of eHealth, information security and the GDPR Plans for a national eHealth project were set out in the Development Programmes Plan 2006–2012, which was adopted by the Slovenian Parliament with the 2008 and 2009 budgets. Until 2015, the project was partly financed by the European Union through the European Social Fund. Pursuant to the Healthcare Databases Act (ZZPPZ), on 1 December 2015, NIJZ assumed the implementation of eHealth activities, with those activities being financed by the Ministry of Health. The project is designed to introduce communications technologies into healthcare with the aim of increasing the safety, quality and above all efficiency of healthcare services. The aim of the project was not merely to introduce technical solutions, but to foster a new approach to the provision of health services focused primarily on the patient. The systemic implementation of all eHealth sub-projects began in 2008, with a dedicated eHealth department set up at the Ministry of Health three years later. The department was tasked with accelerating the planning and implementation process, initiating pilot projects and introducing solutions into the health system. Today, the eHealth system already contains a large number of applications that have been successfully launched nationally and that have radically altered the way the Slovenian health system works, as many stakeholders have confirmed. D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 181. The National Strategy of Quality and Safety in Healthcare (2010–2015) envisaged the development of information technology in health with the aim of improving providers’ and health service users’ recording, monitoring, analytical and decision- making processes by 2015. On 29 March 2016, the National Assembly adopted the Resolution on the National Health Care Plan 2016–2025 (‘Together for a Healthy Society’, ReNPZV16–25). The Resolution deals, among other things, with efforts to improve the performance of the health system (management and administration), and concludes that the degree to which healthcare providers are interlinked for the purpose of increasing specialisation, rationalising the process of treating patients and reducing administrative burdens is insufficient. The concentration of expertise in highly specialised centres, the network-based cooperation of specialists, the achievement of high standards with regard to the quantity and complexity of the cases in question are preconditions for improving the success of treatment and ensuring equal access to high-quality and safe provision for all. The digital transformation of the health system encompasses information systems and services which, together with organisational changes and the development of new skills, contribute to the advances in healthcare, and to improvements in access to healthcare and to the quality, efficiency and productivity of services. The solutions support advances in healthcare activities, enable better management and the expansion of medical knowledge, and foster evidence-based healthcare activities. At the end of 2015, the eHealth project established a single health information system which, by being integrated with the information systems of various health service providers, enabled interoperability and data exchange. The revision of the Healthcare Databases Act provided a legal basis for eHealth databases (CRPP, ePrescriptions, eReferrals and eAppointments, Telekap/Telestroke, the register of teleradiological images, etc.) and interconnection of those databases. The information technology used in eHealth is tested and globally established. It incorporates licensed software with guaranteed long-term support, and process- enabling hardware that has been tested, ensures the appropriate redundancy and features two geographically separate data centres with regular data back-up. 182 MEDICINE, LAW & SOCIETY. The processing of personal data within the eHealth system is defined in the legislation, chiefly the ZZPPZ. In accordance with the ZZPPZ, eHealth at the national level is a harmonised health information system which, by operating on a single ICT infrastructure, enables: − the processing of the health-related and other data set out in detail in Article 14b of ZZPPZ and in Annex 2 to that act; − the provision of eHealth services that enable the electronic processing of the data referred to in the previous indent for the purposes determined for the specific eHealth database. The digital solutions that comprise the eHealth system will, over time, be further developed and upgraded. Some of these solutions also function as databases of personal data as defined in the ZVOP-1 and the GDPR; these are specifically set out in Annex 2 to the ZZPPZ. Other solutions constitute merely a hub or information tray that enables information from the databases to be retrieved and displayed. The ZZPPZ delineates the purpose and scope of data processing. Any expansion or contraction of either the purpose or scope of data processing would be possible only with prior amendments to the law. There are currently no measures planned that would, on the assumption that the legislation remains unchanged, enable the same purposes to be achieved with a smaller set of data. In accordance with NIJZ’s overarching and sectoral information protection policies, all key organisational, technical and logical-technical measures are in place for preventing the unauthorised processing of personal data in line with the requirements referred to in Articles 24 and 25 of the ZVOP-1 and Article 32 of the GDPR. Measures are in place to restrict access to data on the basis of user rights; all accesses and other forms of data processing are recorded with the help of audit trails; network traffic is adequately filtered; and data is protected by means of a centrally managed anti-virus protection system. The security measures are defined in detail in the ‘Overarching and sectoral information protection policies’ document published on the NIJZ intranet system. Personal data within the eHealth information system databases is processed pursuant to the law (ZZPPZ, Annex 2), which specifies the purpose and the scope of processing, the types of data processed and the data retention period. The www.nijz.si website provides further information on personal data processing. Individuals may exercise the rights stemming from the GDPR in relation to personal D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 183. data processing via the publicly accessible vop@nijz.si email address. The NIJZ has appointed a data protection officer (DPO) and deputy DPO who are tasked with resolving any claims relating to personal data protection and the rights stemming from the GDPR. The NIJZ takes measures to inform individuals (either at the point of data capture, if possible, or via the website) on how and for what purposes data is collected; it also facilitates the exercise of rights relating to data protection under the GDPR. Data quality depends on the input of data by healthcare providers; they are the primary source of data as they acquire it directly from patients and then process it as independent data controllers. The input of other data by external institutions, chiefly the Health Insurance Institute of Slovenia and the Ministry of the Interior, depends on those institutions. The NIJZ ensures that the technical data transfer process takes place smoothly and without complications; it also ensures that any special corrections to data are made on time, which also includes the prompt resolution of requests for changes to data under the GDPR. Compliance of the processing of personal data is ensured by means of continuous work by the legal department, the DPO, information security specialists and process managers. Steps are taken to ensure that personal data is processed lawfully; that individuals are apprised that data is being processed, when possible or when they so request; that individuals have the possibility of exercising their data protection rights under the GDPR; and that the data is adequately protected against unauthorised processing by means of organisational, technical and logical-technical measures (Zhang et al., 2018). The NIJZ carries out audits of personal data processing procedures in order to improve data protection. These efforts include a data protection impact assessment (DPIA) for the eHealth information system. The purpose of carrying out a DPIA is to ensure the compliance of personal data processing with the requirements of the GDPR, to define and identify risks to the protection and security of personal data, and to determine measures to reduce these risks to an acceptable level, thereby adhering to the basic principles of the GDPR as regards personal data processing. Article 35 of the GDPR defines the DPIA, when it should be performed and the elements it is required to contain: 184 MEDICINE, LAW & SOCIETY. 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks. 2. The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment. 3. A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of: a. a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; b. processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or c. a systematic monitoring of a publicly accessible area on a large scale. It therefore follows from Article 35 of the GDPR that a DPIA is carried out ‘where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons’ and, in particular, when ‘processing on a large scale of special categories of data’, which also includes health data, is carried out. The processing of personal data within the eHealth information system meets both criteria, which is why a DPIA is required. The GDPR, which determines what a DPIA should contain and when it is necessary to carry one out, came into force in 2016 and began to be directly applied in May 2018. The question of the implementation of a DPIA therefore became relevant only after this date. As eHealth is the largest (central) health information system in Slovenia, and because it involves the extensive and systemic processing of personal health-related data, a DPIA is required not only because of the formal requirements set out in Article 35 of the GDPR, but also because of the real security risks relating to unauthorised personal data processing. D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 185. Personal and special types of personal data as determined by the GDPR are processed within the eHealth information system. The data of all patients with permanent or temporary residence in Slovenia, as well as other patients who receive treatment in Slovenia, is processed. The personal and other data is entered, in accordance with the legislation and within the terms of their remit, by individual healthcare providers, who act as independent personal data controllers. The entry of data from local information systems into the eHealth system and the acquisition of data from the eHealth system are carried out with the assistance of dedicated software applications installed within the local information environments of individual healthcare providers (who are also responsible for protecting data within their local information environment) and, to a limited extent, also via the zVEM online portal, which is intended for end-users (patients), and the zVEMplus online portal, which is intended for healthcare providers. Both portals are adequately protected by means of authentication mechanisms, and connections are encrypted. The transfer of data between healthcare providers’ applications and the eHealth system, particularly the CRPP, takes place with the help of the zNET secure network, which also ensures that data transfer is encrypted. The administrator (NIJZ) has embarked on the eHealth planning, development and maintenance stages in a responsible manner and with full realisation of the security and other risks that could arise from such extensive processing of special types of data. Throughout the whole process, it has ensured that the relevant security measures have been implemented. These efforts included the drawing-up of a DPIA as part of the project-design documentation; this was primarily designed to ensure the adequate protection of personal data and constitutes an important component of the wider information security network (McWay, 2020). In developing the eHealth information system, the NIJZ, as the administrator, holds regular consultations with internal and external stakeholders on the essential aspects of personal data processing; these meetings make an important ongoing contribution to ensuring an adequate level of personal data security and making sure that the entire eHealth system functions reliably. Accordingly, the following activities are carried out as part of the consultation process with stakeholders: − regular working meetings of the personal data protection group; 186 MEDICINE, LAW & SOCIETY. − working meetings involving the personal data protection group, the legal department, information scientists and those in charge of specific personal data processing procedures; − consultations between the NIJZ and contractual processors regarding the key aspects of personal data processing; − regular meetings of NIJZ working groups and the Ministry of Health to address specific personal data processing issues; − emergency meetings of NIJZ working groups and other key stakeholders; − consultations with representatives of the health profession; − consultations with the Information Commissioner; − consultations with the Information Security Administration of the Republic of Slovenia and SI-CERT; − emergency working meetings between the NIJZ and individual healthcare providers. 5 Discussion Despite the growing interest among research and academic circles in the digital transformation of health over the last 20 years, and the increasing number of national projects around the world aimed at digitally transforming healthcare, the number of comprehensive and in-depth studies dealing with direct analyses of the effects of eHealth services on the various aspects of the health system is relatively small. Previous research in this field is, to a large extent, focused on specific narrower segments of projects for the digital transformation of health systems (Alonso et al., 2020; Voigt et al., 2020; Groen et al., 2017). Studying the impacts and role of digital transformation from its many partial and frequently isolated aspects prevents a comprehensive and critical evaluation of the potential impacts of digital transformation on public health management (Grady et al., 2018). On the one hand, this often manifests itself in an inability to plan the long-term development of health systems; on the other, digitalisation projects frequently encounter major difficulties in securing political support and funds, as well as poor organisation, management and coordination, which prolongs the implementation period and increases costs. One can say, generally speaking, that the academic literature ascribes a significant role to ICT in the future development of healthcare (European Commission, 2018; D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 187. Warth and Dyb, 2019; Kruse and Beane, 2018), and stresses that digital transformation is one of the basic steps towards the comprehensive reform of health systems, with the aim of bringing higher quality healthcare provision on the one hand and of ensuring the more effective management and operation of health systems on the other. In a series of major research studies since the 1990s (World Health Report), which have, in addition to other factors, examined the impact of eHealth projects around the world, the World Health Organization has identified the digital transformation of health systems as a key factor in improving global health (WHO, 2016). In its report of 2016, the WHO identified a direct link between the use of digital tools and improvements in health management, and highlighted the fact that the biggest obstacle to the more effective development of health systems was precisely the lack of ICT support. Studies therefore confirm that while health information systems undoubtedly have great potential, the construction of those systems and the collection, arrangement, analysis and presentation of health-related data are nevertheless faced with considerable problems (Wildenbos et al., 2017; Kumar et al., 2018; Katehakis, 2018). Because it is incomplete, inaccurate, out of date and not connected to the priority tasks and functions of health professionals, the selected data is frequently unusable and does not provide support to high-quality decision- making by health managers (WHO, 2016; Turner et al., 2019); in other words, health information systems are often oriented towards data rather than towards operation. At a time when health systems are faced with ever greater demands from users and the funds for their operation become ever more limited, the need for greater efficiency becomes increasingly important. Studies (Roder-DeWan, 2020; Mitropoulos, 2021) point out that the quality of individual health services declines if these types of service are provided within an inefficient health system. Although existing health information systems in Slovenia cover certain aspects of the operation of healthcare institutions relatively well (administrative aspects in particular), their contribution to providing useful clinical and management data and information is relatively limited. This deficiency is the result of a change to the content or primary objectives of the use of health information systems in recent years, which Slovenian healthcare informatics has not kept abreast of. Health information systems have, in this period of time, been redirected away from the 188 MEDICINE, LAW & SOCIETY. narrow monitoring of (primarily) the administrative aspects of operations to the comprehensive monitoring of the operations of the health system, which includes the monitoring of clinical and management aspects of operations, in addition to the administrative aspects (Karahanna et al., 2019; Singh et al., 2020). On the other hand, existing health information systems in different areas do provide a large amount of useful data and functionalities which, from the point of view of the design of adequate, evidence-based measures and policies, often remain under-exploited. In line with the premises of the research, an exhaustive review of conditions in the field has revealed that the difficulties encountered in the digitalisation project in Slovenia stem, on the one hand, from the technical and technological characteristics of the existing, largely fragmented, health information systems. These are a consequence of the uncoordinated development in the area of healthcare informatics in recent decades. On the other hand, responsibility for the existing situation can be attributed to the managers, who left the development of healthcare informatics in this period to the personal initiatives, needs and the interests of individuals at the healthcare institution level. Moreover, those in charge in recent years have not managed to promote development and realise the digital transformation project with stronger political (financial, human resources, organisational) support and by making the digital transformation project one of the developmental priorities, which it undoubtedly should be. Nevertheless, recent events and the sharp rise in the use of eHealth solutions confirm the growing awareness of users and decision-makers that ICT and healthcare informatics have considerable use value and developmental potential, and provide indisputable proof of the greater engagement and commitment of healthcare policy, which previously paid the eHealth project relatively little attention. The successful implementation and high percentage of use of the CRPP, the zVEM portal, eAppointments, ePrescriptions and other eHealth solutions prove that the NIJZ has, in the last few years, managed to a sufficient extent to harmonise the wishes and interests of the majority of the most important entities within the health system, and achieve a relatively stable consensus regarding the functionalities of ICT-based solutions. Moreover, the effective implementation of operational ICT solutions is confirmation of ever greater cooperation and coordination between healthcare institutions, the NIJZ (and the Ministry of Health) and external ICT D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 189. service providers, and constitutes a successful example of how the numerous technical and organisational problems occasioned by the piecemeal development of digital transformation in the field of health can be overcome. 6 Conclusion It appears that, in a very short time, the Covid-19 pandemic has done more to increase awareness and use of eHealth solutions than any other initiative so far, whether political, legislative, administrative or financial. Given this worrying fact, a thorough study is required of what we were doing wrong before the pandemic (or what we failed to do correctly) that meant we were unable to intensify the use of eHealth solutions and convince users of the numerous advantages offered by digital solutions. The reasons for this undoubtedly range from a lack of political will and insufficient commitment on the part of stakeholders, to an absence of clearly defined sectoral policies and convincing goals for users with different motives, and the insufficient education and training of users (health professionals and patients). In addition to the above factors, we can certainly say that the comprehensive advocacy of eHealth and digital transformation, which is one of the fundamental principles of the promotion of national initiatives in the field of public health, has failed. If so, this epidemic/pandemic could mark a turning point in our understanding of digital transformation. Not only as one of key drivers for the development and promotion of public health, but also as an indispensable component of efforts to make use of the existing capacities and potentials of the health system, and empower patients at times of national and international public health crises (such as the current one) and, most likely, in all future pandemics. Legal Sources European Commission (2018) Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on enabling the digital transformation of health and care in the Digital Single Market; empowering citizens and building a healthier society, 233 final. Brussels. European Commission (2019) Digital Public Services. Digital Economy and Society Index Report 2019. Brussels. European Commission (2020) Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions. The EU budget powering the recovery plan for Europe, 442 final. Brussels. 190 MEDICINE, LAW & SOCIETY. Ministrstvo za javno upravo (2019) Vrednotenje učinkov implementacije projekta eZdravje: eRecept in eNaročanje, Ljubljana. Ministrstvo za zdravje (2005) eZdravje 2010. Strategija informatizacije slovenskega zdravstvenega sistema 2005-2010, Ljubljana. Ministrstvo za zdravje (2016) Resolucija o nacionalnem planu zdravstvenega varstva 2016–2025. Skupaj za družbo zdravja, Ljubljana. Nacionalni inštitut za javno zdravje (2021) Statistika zahtevkov na Prvem nivoju podpore uporabnikom eZdravja, Ljubljana. Nacionalni inštitut za javno zdravje (2022) Dnevno spremljanje okužb s SARS-CoV-2 (COVID-19), Ljubljana. General Data Protection Regulation (2016) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. World Health Organization (2016) Global diffusion of eHealth: making universal health coverage achievable. Report of the third global survey on eHealth. Geneva. World Health Organization (2016) Slovenia: health system review, Regional Office for Europe. Copenhagen. Zakon o interventnih ukrepih za zajezitev epidemije COVID-19 in omilitev njenih posledic za državljane in gospodarstvo (ZIUZEOP), Uradni list RS, št. 49/20, 61/20. Zakon o varstvu osebnih podatkov (ZVOP), Uradni list RS, št. 94/07. Zakon o varstvu osebnih podatkov (ZVOP-1), Uradni list RS, št. 94/07, 177/20. Zakon o zbirkah podatkov s področja zdravstvenega varstva (ZZPPZ), Uradni list RS, št. 65/00, 47/15, 31/18. References Alonso, V., Santos, J.V., Pinto, M., Ferreira, J., Lema, I., Lopes, F. & Freitas, A. (2020) Health records as the basis of clinical coding: Is the quality adequate? A qualitative study of medical coders’ perceptions, Health Information Management Journal, 49(1), pp. 28-37, doi: 10.1177/1833358319826351. Ammenwerth E. (2018) From eHealth to ePatient: the role of patient portals in fostering patient empowerment, European Journal of Biomedical Informatics, 14(2), pp. 20-23, doi:10.24105/ejbi.2018.14.2.4. Cardenas, N.C. (2021) Advancing strategic policy on European Union digital COVID-19 certificate, Journal of Public Health, fdab227, doi: 10.1093/pubmed/fdab227. Chen, L.H., Petersen, E., Blumberg, L., Piyaphanee, W. & Steffen, R. (2021) COVID-19 health passes: Current status and prospects for a global approach, Journal of Travel Medicine, 28(7), taab118, doi: 10.1093/jtm/taab118.. Glöggler, M. & Ammenwerth, E. (2021) Development and Validation of a Useful Taxonomy of Patient Portals Based on Characteristics of Patient Engagement, Methods of Information in Medicine, 60(S 01), e44-e55, doi: 10.1055/s-0041-1730284. Grady, A., Yoong, S., Sutherland, R., Lee, H., Nathan, N. & Wolfenden, L. (2018) Improving the public health impact of eHealth and mHealth interventions, Australian and New Zealand Journal of Public Health, 42(2), pp. 118-119, doi: 10.1111/1753-6405.12771. Groen, W.G., Kuijpers W., Oldenburg H.S., Wouters M.W., Aaronson N.K, & van Harten W.H. (2017) Supporting lung cancer patients with an interactive patient portal: feasibility study, JMIR cancer, 3(2), e10, doi: 10.2196/cancer.7443. Karahanna, E., Chen, A., Liu, Q.B. & Serrano, C. (2019) Capitalizing on health information technology to enable digital advantage in US hospitals, MIS Quarterly, 43(1), pp. 113-140, doi: 10.25300/MISQ/2019/12743. D. Stanimirović, M. Drev, Ž. Rant: Digital Transformation as One of the Instruments for Overcoming the Public Health Crisis: The Role and Use of Ehealth Solutions During the Covid-19 Pandemic in Slovenia 191. Katehakis, D.G. (2018) Electronic medical record implementation challenges for the national health system in Greece, International Journal of Reliable and Quality E-Healthcare, 7(1), pp. 16-30, doi: 10.4018/978-1-7998-1204-3.ch072. Kruse, C.S. & Beane, A. (2018) Health information technology continues to show positive effect on medical outcomes: systematic review, Journal of Medical Internet Research, 20(2), e8793, doi: 10.2196/jmir.8793. Kruse, C.S., Stein, A., Thomas, H. & Kaur, H. (2018) The use of electronic health records to support population health: a systematic review of the literature, Journal of Medical Systems, 42(11), pp. 1- 16, doi: 10.1007/s10916-018-1075-6. Kumar, M., Gotz, D., Nutley, T. & Smith, J.B. (2018) Research gaps in routine health information system design barriers to data quality and use in low‐and middle‐income countries: A literature review, The International Journal of Health Planning and Management, 33(1), e1-e9, doi: 10.1002/hpm.2447. Mbunge, E., Dzinamarira, T., Fashoto, S.G. & Batani, J. (2021) Emerging technologies and COVID- 19 digital vaccination certificates and passports, Public Health Pract, 2:100136, doi: 10.1016/j.puhip.2021.100136. McWay, D.C. (2020) Legal and ethical aspects of health information management (New York: Cengage Learning). Mitropoulos, P. (2021) Production and quality performance of healthcare services in EU countries during the economic crisis, Operational Research, 21(2), pp. 857-873. Mohajan, H.K. (2018) Qualitative research methodology in social sciences and related subjects, Journal of Economic Development, Environment and People, 7(1), pp. 23-48. Roder-DeWan, S. (2020) Health system quality in the time of COVID-19, The Lancet Global Health, 8(6), e738-e739, doi: 10.1016/S2214-109X(20)30223-0. Sim, J. & Waterfield, J. (2019) Focus group methodology: some ethical challenges, Quality & Quantity, 53(6), pp. 3003-3022. Singh, R. P., Javaid, M., Haleem, A., Vaishya, R. & Bahl, S. (2020) Significance of Health Information Technology (HIT) in context to COVID-19 pandemic: Potential roles and challenges, Journal of Industrial Integration and Management, 5(04), pp. 427-440, doi: 10.1142/S2424862220500232. Stanimirović, D. (2015) A framework for information and communication technology induced transformation of the healthcare business model in Slovenia, Journal of global information technology management, 18(1), pp. 29-47, doi: 10.1080/1097198X.2015.1015826. Stanimirović, D., Murko, E., Battelino, T., Grošelj, U. & Žerjav-Tanšek, M. (2021) Towards a comprehensive strategy for the management of rare diseases in Slovenia: outlining an IT- enabled ecosystemic approach, International Journal of Environmental Research and Public Health, 18(23), pp. 1-17, doi: 10.3390/ijerph182312395. Steurs, L, Van de Pas, R, Delputte, S. & Orbie, J. (2018) The Global Health Policies of the EU and its Member States: A Common Vision? International Journal of Health Policy and Management, 7(5), pp. 433-442, doi: 10.15171/ijhpm.2017.112. Thomas, G. (2021) How to do your case study (Thousand Oaks: Sage Publications). Tulu, B., Trapp, A.C., Strong, D.M., Johnson, S.A., Hoque, M., Trudel, J. & Garber, L. (2016) An analysis of patient portal utilization: what can we learn about online patient behavior by examining portal click data? Health Systems, 5(1), pp. 66-79, doi: 10.1057/hs.2015.5. Turner, K., Hong, Y.R., Yadav, S., Huo, J. & Mainous, A.G. (2019) Patient portal utilization: before and after stage 2 electronic health record meaningful use, Journal of the American Medical Informatics Association : JAMIA, 26(10), pp. 960-967, doi: 10.1093/jamia/ocz030. Van den Bulck, S.A., Hermens, R., Slegers, K., Vandenberghe, B., Goderis, G. & Vankrunkelsven, P. (2018) Designing a Patient Portal for Patient-Centered Care: Cross-Sectional Survey, Journal of Medical Internet Research, 20(10), e269, doi: 10.2196/jmir.9497. 192 MEDICINE, LAW & SOCIETY. Voigt, I., Benedict, M., Susky, M., Scheplitz, T., Frankowitz, S., Kern, R., Müller, O., Schlieter, H. & Ziemssen, T. (2020) A digital patient portal for patients with multiple sclerosis, Frontiers in Neurology, 11:400, doi: 10.3389/fneur.2020.00400. Warth, L.L. & Dyb, K. (2019) eHealth initiatives; the relationship between project work and institutional practice, BMC Health Services Research, 19(1), pp. 1-12, doi: 10.1186/s12913-019- 4346-0.. Wildenbos, G.A., Peute, L. & Jaspers, M. (2017) Facilitators and barriers of electronic health record patient portal adoption by older adults: a literature study, Studies in Health Technology and Informatics, 235, pp. 308-312. Wolff, J., Pauling, J., Keck, A. & Baumbach, J. (2020) The Economic Impact of Artificial Intelligence in Health Care: Systematic Review, Journal of Medical Internet Research, 22(2), e16866, doi: 10.2196/16866. Yin, R.K. (2017) Case study research and applications: Design and methods (Thousand Oaks: Sage Publications). Zhang, X., Liu, S., Chen, X., Wang, L., Gao, B. & Zhu, Q. (2018) Health information privacy concerns, antecedents, and information disclosure intention in online health communities, Information & Management, 55(4), pp. 482-493, doi: 10.1016/j.im.2017.11.003.