International Emergency Responses: Harmonizing Data Security and Protection Standards for Emergency Medical Teams

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

Thanks for the opportunity to review this piece. There is no doubt that this issue is a perennial one and remains an unsolved challenge globally, one indeed which has learned to run before it can walk as technological solutions sky rocket and yet basic universal standards remain elusive.

My reservations about the piece in its current form are that it feels like it has been written from an academic's perspective with little focus on the practitioner. Whilst both have a place, bringing them closer together must remain paramount in any work within this domain. Subsequently the recommended implementation feels as if it sits some distance apart from what might be achieved from a practical point of view.

I wonder whether the addition of an author with extensive practical experience of EMT work would bring an important dimension to the paper - apologies if it is the case that one or both of the authors fit this brief, in which case I'd recommend them taking the academic glasses off for a moment and replacing them with EMT glasses for revision.

I have made just a few comments below:

"Emergency Medical Teams (EMTs) encounter four primary obstacles related to data 57 management"

There are only 3 listed

The paragraph entitled : Codes of Conduct as a Strategic Approach

This paragraph is full of technical conceptualisation however the thread of connection to EMT practice is only really made at the end and should be weaved throughout, the following paragraph does this with a bit more success.

 

The list of recommended implementations should ideally be saved for a piece of work which has actually examined in detail what is feasible and what is a priority following relevant and extensive stakeholder consultation - perhaps via the constortium which is proposed. Otherwise this piece is in danger of being used as a blueprint and falling far from the mark when implemented because it perhaps does not resonate with practitioner experience of what is possible. Furthermore, much of what is suggested is notional rather than practical.

Comments on the Quality of English Language

Mostly good, focussing on simpler language would be helpful

Author Response

Dear reviewer 1. Thank you for your comments. Please find our answers below.

My reservations about the piece in its current form are that it feels like it has been written from an academic's perspective with little focus on the practitioner. Whilst both have a place, bringing them closer together must remain paramount in any work within this domain. Subsequently the recommended implementation feels as if it sits some distance apart from what might be achieved from a practical point of view.

I wonder whether the addition of an author with extensive practical experience of EMT work would bring an important dimension to the paper - apologies if it is the case that one or both of the authors fit this brief, in which case I'd recommend them taking the academic glasses off for a moment and replacing them with EMT glasses for revision.

Thank you for the comment. We followed the suggestion and discussed the contents of the paper with Mr. Harm-Bastian Harms from Johanniter Competence Center European Civil Protection and Disaster Assistance (EUCC), who has several decades of experience in EMT coordination and who is also the project management lead for the design and setup of the new rescEU EMT[1] of the European Commission. Mr. Harms also agreed to become coauthor of the publication.

 

"Emergency Medical Teams (EMTs) encounter four primary obstacles related to data 57 management" There are only 3 listed

We fixed that.

The paragraph entitled : Codes of Conduct as a Strategic Approach

This paragraph is full of technical conceptualization however the thread of connection to EMT practice is only really made at the end and should be weaved throughout, the following paragraph does this with a bit more success.

The list of recommended implementations should ideally be saved for a piece of work which has actually examined in detail what is feasible and what is a priority following relevant and extensive stakeholder consultation - perhaps via the consortium which is proposed. Otherwise this piece is in danger of being used as a blueprint and falling far from the mark when implemented because it perhaps does not resonate with practitioner experience of what is possible. Furthermore, much of what is suggested is notional rather than practical.

Thank you for the comment. We are aware of the situation that Codes of Conducts need mutual agreements between several EMTs. We are currently part of the working groups below and discuss the implementation of the recommended policies:

• The WHO EMT Technical Working group on Knowledge and Information Management
• The EMT regional action plan within the WHO European Region
• The rescEU EMT Information Management working group

[1] https://ec.europa.eu/commission/presscorner/detail/en/ip_23_2273

Reviewer 2 Report

Comments and Suggestions for Authors

The "Viewpoint" article discusses the protocols for the management and protection of sensitive health data which are not universally defined. Thus, it is vital to harmonize data protection and security standards for emergency medical equipment.

The authors' considerations and arguments are solid and consistent.

To raise the quality of the "Viewpoint" the authors must explain:

1. Line 198: ISO/IEC 27001 year?

2. Should emergency medical technicians be certified in the proper use of medical and personal data (Habeas data)? o Get certified in the management and protection of sensitive health data?

3. Should the proposal of a standardized regulatory framework for data protection between actors be the sole responsibility of the WHO? Why?

4. The authors should expand the information on the codes of conduct related to data security and protection during EMT operations because they can be confused with Habeas Data laws.

5. The authors focus the study on multiple legal systems, but leave aside the technological need for interoperable platforms between countries. This must be considered.

Comments on the Quality of English Language

Each law or regulation must have the year of regulation

Author Response

Dear reviewer 2. Thank you for your comments. Please find our answers below.

1. Line 198: ISO/IEC 27001 year?

We fixed that.

2. Should emergency medical technicians be certified in the proper use of medical and personal data (Habeas data)? o Get certified in the management and protection of sensitive health data?

We appreciate your emphasis on the certification of EMTs in data management. We have revised the manuscript in sect 4 to include this topic and underscore the necessity of certification of EMT staff, highlighting the crucial role it plays in ensuring the responsible handling of sensitive health data.

“This includes staff training related to the sensitivity of health data. Here it is imperative that all Emergency Medical Teams (EMTs) undergo rigorous training and achieve certification in data management and protection. This ensures that they are well-equipped to handle personal and medical information responsibly and in compliance with both local and international data protection regulations.”

3. Should the proposal of a standardized regulatory framework for data protection between actors be the sole responsibility of the WHO? Why?

Thank you for your question regarding the role of WHO in standardizing data protection frameworks. We have clarified in the manuscript that while WHO is crucial, a collaborative multi-stakeholder approach is essential for developing robust data protection standards, acknowledging the diverse inputs necessary for a globally applicable framework.

“While the WHO plays a pivotal role in setting global health standards, the responsibility for developing a standardized regulatory framework for data protection should be a collaborative effort involving multiple stakeholders. This includes national governments, international organizations, and the private sector, ensuring a comprehensive approach that reflects diverse legal, cultural, and operational realities. “

4. The authors should expand the information on the codes of conduct related to data security and protection during EMT operations because they can be confused with Habeas Data laws.

Thank you for pointing out the potential confusion. We have expanded the discussion on codes of conduct to clearly distinguish them from Habeas Data laws, focusing on their unique roles in the context of EMT operations and data security.

"To differentiate, codes of conduct for data protection specifically address the ethical and operational measures EMTs must follow to secure data, which are distinct from Habeas Data laws that primarily focus on the rights of individuals to access and correct their personal information."

5. The authors focus the study on multiple legal systems, but leave aside the technological need for interoperable platforms between countries. This must be considered.

We recognize the omission in our discussion on technological interoperability. The manuscript now includes a statement about the necessity for interoperable platforms to ensure efficient international collaboration among EMTs, acknowledging the critical role of technology in facilitating global emergency responses.

"The need for interoperable platforms across different countries is fundamental for the seamless operation of EMTs. Such platforms facilitate efficient data exchange and integration, enhancing the speed and efficacy of emergency medical responses across varying legal and technological environments."

Round 2

Reviewer 1 Report

Comments and Suggestions for Authors

Many thanks for the opportunity to re-review & thanks to the authors for their responses.

Whilst the clarification that the authors are a part of the working groups noted in their response, it still does not come across in the article what the basis of these recommendations is and why the recommendations are being made outwith the working groups - are the recommendations derived from group discussions (in which case the authorship should be the whole consortium/working group or it should be acknowledged as such that the working groups agree to them). Or are these just the ideas developed from the authors themselves - and if so the basis of these recommendations needs to be clearer - is it simply translation of GDPR into language relevant to EMTs? In which case it needs to be labelled as such.  If the recommendations come as a result of expert consensus of the authors I think the positionality of the authors should be clear and the paper should indicate that it is an expert consensus.

Otherwise what is stated in the abstract: 

"This article contributes to standardizing data protection and technology within EMT 56 operations. It analyzes the European General Data Protection Regulation (GDPR, specifi- 57 cally Art. 40 GDPR “Codes of Conduct”) to provide recommendations for EMTs. Its ob- 58 jective is to foster a global discussion among stakeholders to address existing challenges 59 and develop solutions."

is not quite what the article does - there is no clear analysis and pathway between the GDPR and the recommendations for EMTs.

As I stated in my initial review - I think this work is valuable and important, it just needs to be really clear what it is and who it is coming from so that it can be understood as such.  Another approach might be to simply reword the title of "Recommended implementations" to something like "Key areas to consider for EMT development of data management" - this makes it much less directive and clearer that it is not derived from any sort of consensus/stakeholder work 

 

Author Response

Dear reviewer 1,

thank you for the suggestions. We clarified the topics in the manuscript:

Change 1 - revised paragraph:

from

This article contributes to standardizing data protection and technology within EMT operations. It analyzes the European General Data Protection Regulation (GDPR specifically Art. 40 GDPR “Codes of Conduct”) to provide recommendations for EMTs. Its objective is to foster a global discussion among stakeholders to address existing challenges and develop solutions.

to

This article aims to provide insights into the data protection challenges faced by EMTs, guided by the European General Data Protection Regulation (GDPR, specifically Art. 40 GDPR 'Codes of Conduct'). The objective is to offer key considerations and foster a global discussion among stakeholders to develop practical solutions. These recommendations reflect the authors' interpretation of GDPR provisions relevant to EMT operations.

 

Change 2 - added line to 1st paragraph of sect 3:
This section outlines the authors' interpretation of how EMTs can navigate these challenges by considering sector-specific Codes of Conduct.

 

Change 3 - modified headline in sect 4:

from: Recommended implementations ...

to: Key areas to consider for EMT development of data management