The Order of 21 July 1994 regulating the files with personal data managed by the Ministry of Health and Consumer Affairs, provided compliance with the provisions of the second, second provision of the Law Organic 5/1992, October 29, regulating the automated processing of personal data.

Subsequently, the Organic Law 15/1999, of 13 December, of Protection of Personal Data, provided for in Article 20.1, that the creation, modification or deletion of the files of public administrations only may be made by means of a general provision published in the Official Journal of the State or in the Official Journal concerned.

Law 16/2003, of 28 May, of cohesion and quality of the National Health System, provides, in Articles 53 and 55, that the Ministry of Health, Social Services and Equality will establish a system of health information of the System National Health (SNS) to ensure the availability of reciprocal information and communication between health administrations.

The Royal Decree 69/2015, of February 6, regulates the Register of Specialized Health Care Activity (RAE-CMBD) attached to the Directorate General of Public Health, Quality and Innovation of the Ministry of Health, Services Social and Equality. This register constitutes an evolution of the current State Minimum Basic Data Set (CMBD), created by agreement of the Interterritorial Council of the SNS in 1987, which will be integrated in the history of the current RAE-CMBD Registry.

By this order, the Order of 21 July 1994 is amended and the file of the "Register of Specialized Health Care Activity (RAE-CMBD)" is created in order to comply with the provisions of the Fifth additional provision of Royal Decree 69/2015 of 6 February.

In the processing of this order, the Spanish Data Protection Agency has issued a mandatory report.

In its virtue, I have:

Article 1. Creating the file.

The contents of Annex 2 "Administrative Character Ficheros" of the Order of 21 July 1994, which regulate the files with personal data managed by the Ministry of Health and Consumer Affairs, is extended. including a new automated file called "Register of Specialized Health Care Activity (RAE-CMBD)", the characteristics of which are detailed in Annex I.

Article 2. Deleting the file.

The "Minimum Basic Data Set (CMBD)" personal data file is deleted, which is listed in Annex II.

Article 3. Responsible for the file.

The General Directorate of Public Health, Quality and Innovation will be the administrative organ responsible for the file created by this order.

Article 4. Management and organization of the file.

The head of the body responsible for the register of the registered health care activity register (RAE-CMBD) will adopt, at the top of the head of the Ministry of Health, Social Services and Equality, the measures management and organization that are necessary, ensuring, in any case, the confidentiality, security and integrity of the data, as well as the drivers to make effective the guarantees, obligations and rights recognized in Organic Law 15/1999, December 13, Protection of Personal Data, in its Rules of Procedure development approved by Royal Decree 1720/2007 of 21 December 2007 and other implementing rules.

Personal data recorded in the file created by this order shall only be used for the purposes expressly provided for and by duly authorized personnel.

Article 5. Data cession.

The data contained in this file may only be transferred in the cases expressly provided for by law.

Single end disposition. Entry into force.

This order shall enter into force on the day following that of its publication in the "Official State Gazette".

Madrid, 8 September 2015.-The Minister of Health, Social Services and Equality, Alfonso Alonso Aranegui.

ANNEX I

General Directorate of Public Health, Quality and Innovation

Filename: "Specialized Health Care Activity Log (RAE-CMBD)"

Purpose and intended uses:

i. To know the care demand and the morbidity attended in the specialized care devices, to favor the conduct of clinical, epidemiological and evaluation studies of health services and health outcomes.

ii. Provide autonomic records with the information necessary for the evaluation and control of the care provided in the National Health System as a whole.

iii. Facilitate the performance of health sector statistics at the state level, as well as those resulting from commitments to international official bodies.

Persons or collectives on which they are intended to obtain data of a personal nature or which are obliged to supply them: natural persons who receive healthcare provided under the care hospitalization, hospitalization at home, medical day hospital, outpatient surgery, outpatient procedure of special complexity and urgency.

Provenance and procedure for the collection of personal data: the autonomous communities and, where appropriate, the health centres shall supply the data to the body responsible for the registration and by electronic means, in such a way that is allowed to be incorporated into the automated file.

Data and/or data transfers that are provided to third countries: to the public services responsible for the production of official statistics. The autonomous communities and administrative mutual societies of the special social security schemes of civil servants shall have access to the data in the register as provided for in Article 8.3 of Royal Decree 69/2015 of 6 February 2015.

Administrative body responsible for the file: Directorate-General for Public Health, Quality and Innovation of the Ministry of Health, Social Services and Equality.

Services or units to which the right of access, rectification, cancellation and opposition may be exercised: Subdirectorate General of Health Information and Innovation, Directorate General of Public Health, Quality and Innovation. Ministry of Health, Social Services and Equality, Paseo del Prado, 18-20, 28071 Madrid.

Security measures with level indication: high.

Basic file structure: database.

Personal data included in the file: the file contains the data "Personal Identification Code (CIP)" of the Individual Health Card (TSI), as well as the number of medical history.

The CIP will be anonymized by a one-way summary function. Initially the SHA-256 algorithm will be used and, if the advancement of science makes it necessary, it will be replaced in the future by algorithms of greater cryptographic strength.

All the manipulations performed on the data for statistical exploitation shall be carried out with anonymous data, not being possible, in any case, their association with the CIP or with the number of the Clinical History of the persons or, therefore its potential identification, as only once anonymized data will be exploited and the algorithms used for this are irreversible.

All the process of reviewing, loading and operating the data as well as the databases, will be subject to the criteria and security measures established in Organic Law 15/1999, of December 13, in its Regulation of development approved by Royal Decree 1720/2007 of 21 December 2007 and other implementing rules.

Other data that includes the RAE-CMBD are:

Of clinical type: diagnosis or main and secondary diagnoses; procedures performed at the center; procedures performed in other centers; morphology codes of neoplasms and prior presence or survival of the main and secondary diagnostics (POA indicator).

Administrative type data: type of Personal Identification Code, date of birth; sex; country of birth; postal code of the patient's usual address; municipality of the patient's usual address; funding; date and time of the start of the care; date and time of the order of entry; type of contact (defined as the care modality provided); type of visit (defined as the health care modality of the medical day hospital); (defined as the device, health service or entity requesting contact); circumstances of care; service responsible for care; date and time of completion of care; type of discharge; care continuity device; date and time of intervention; income in intensive care unit; days of care stay in intensive care unit; health centre; autonomous community of the health centre.

Treatment System: Automated.

ANNEX II

Filename: "Minimum Basic Data Set (CMBD)"

Spanish Data Protection Agency Registration Code: 194246895

Target of the data contained in the file: the data in the existing file "Minimum Basic Data Set (CMBD)" will become part of the structure of the new creation file called " Log of Activity Specialised Health Care (RAE-CMBD) ' as detailed in Annex I.