University of Oulu

Jääskelä, J., Haverinen, J., Kaksonen, R., Reponen, J., Halunen, K., Tokola, T., & Röning, J. (2022). Digi-HTA, assessment framework for digital healthcare services: information security and data protection in health technology – initial experiences. Finnish Journal of EHealth and EWelfare, 14(1), 19–30.

Digi-HTA, assessment framework for digital healthcare services : information security and data protection in health technology – initial experiences

Saved in:
Author: Jääskelä, Jari1; Haverinen, Jari2,3; Kaksonen, Rauli1;
Organizations: 1Biomimetics and Intelligent Systems Group, University of Oulu, Oulu
2Finnish Coordinating Center for Health Technology Assessment (FinCCHTA), Oulu
3FinnTelemedicum, Research Unit of Medical Imaging, Physics and Technology, Faculty of Medicine, University of Oulu, Oulu
4Medical Research Center Oulu, Oulu University Hospital and University of Oulu, University of Oulu, Oulu
Format: article
Version: published version
Access: open
Online Access: PDF Full Text (PDF, 0.4 MB)
Persistent link:
Language: English
Published: Finnish Social and Health Informatics Association, 2022
Publish Date: 2023-03-20


It is well-known that security issues in medical devices, services and applications have potentially catastrophic consequences. To avoid compromising patient data or information systems, it is essential that healthcare services and products meet the relevant information security and data protection requirements. For these reasons, the Digi-HTA assessment includes information security and data protection assessment domains. The outcome of the Digi-HTA process is a recommendation that decision-makers can use during the procurement process. We present results and experiences from the first assessments made in the Digi-HTA process.

We have assessed six products so far and multiple assessments are in progress. The results indicate that healthcare product manufacturers have found the process useful, and usually, the manufacturers have had to improve the security of their product during the Digi-HTA process to get a favourable recommendation for their product. The assessment processes have taken longer than expected due to shortcomings and ambiguities in the provided self-assessment forms, and due to feedback cycles and meetings prompted by assessment findings. Of the six assessed products, four received a green light in information security and data protection, whereas two have received a yellow light due to issues that were not fixed during the process. In addition to shortcomings in adhering to best practices, we have also found exploitable security issues.

see all

Series: Finnish Journal of eHealth and eWelfare
ISSN: 1798-0798
ISSN-E: 1798-0798
ISSN-L: 1798-0798
Volume: 14
Issue: 1
Pages: 19 - 30
DOI: 10.23996/fjhw.111776
Type of Publication: A1 Journal article – refereed
Field of Science: 217 Medical engineering
113 Computer and information sciences
Funding: The development and launch of the Digi-HTA framework happened in the project called Oulu DigiHealth Knowledge Hub funded by the Regional Council of Northern Ostrobothnia (funding from the European Regional Development Fund).
Copyright information: © 2022 Finnish Journal of eHealth and eWelfare. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.