Framework para el almacenamiento de datos de la salud alineado a la legislación ecuatoriana y estándares de calidad

Abstract

In 2023, Ecuador implemented the Ley Orgánica de Protección de Datos Personales (LOPDP), designed to protect people’s rights regarding their data, especially classifying health data as unique and sensitive. This has created a need for the software industry to develop and assess new methods to ensure the security and privacy of personal data processing and the quality of the processed data. Therefore, this study introduces a framework to software engineers and technical personnel for handling personal data in the health domain aligned with the LOPDP, the security and privacy criteria of the ISO/IEC 27701 – Gestión de la privacidad de la información (ISO27701) standard, and the data quality criteria of the ISO/IEC 25012 – Modelo de Calidad de Datos (ISO25012) standard. The framework is explained with a broad vision that can be applied to any domain that is made up of forty components: thirty-one from the legal axis, eight from the security axis and one from the data quality axis; and a specific one for the health sector: thirty-three components belong to the legal axis, twenty-three to the security axis and twenty-six to the quality axis. Expert interviews were conducted to assess the proposed solution using an interdisciplinary Delphi method, resulting in a list of components that may need inclusion or modification. Finally, the study provides directions for future work, such as completing the stages of the Delphi method and conducting quantitative validation of the framework with software engineers.