Workshop Program

Data sharing has been promoted as a significant step in neuroimaging-based research for over a decade, yet the vision for widespread sharing has not been realized. Despite the availability of tools for deidentifying data and a few standout examples of data sharing, privacy concerns over the treatment of neuroimages as full face images have not been resolved. Continuing to share data, in large undertakings or ad hoc collaborations, without resolving the issue serves neither the subjects nor the researchers.

The growing role of mobile devices in previously face to face interactions presents new domains for cryptographic applications. At the same, time the increased role of digital systems raises new security and privacy issues. With some thirty thousand notifications sent, inSPOT.org’s electronic notification of exposure to sexually transmitted infections is one such concerning development. This paper explores those concerns, the features of an ideal service for both notification and certification, and outlines protocols for cryptographic solutions.

Mobile and wearable systems for monitoring health are becoming common. If such an mHealth system knows the identity of its wearer, the system can properly label and store data collected by the system. Existing recognition schemes for such mobile applications and pervasive devices are not particularly usable – they require active engagement with the person (e.g., the input of passwords), or they are too easy to fool (e.g., they depend on the presence of a device that is easily stolen or lost).

We present a wearable sensor to passively recognize people. Our sensor uses the unique electrical properties of a person’s body to recognize their identity. More specifically, the sensor uses bioimpedance – a measure of how the body’s tissues oppose a tiny applied alternating current – and learns how a person’s body uniquely responds to alternating current of different frequencies. In this paper we demonstrate the feasibility of our system by showing its effectiveness at accurately recognizing people in a household 90% of the time.

The federal and state governments have investigated thousands of health care privacy and security cases, received tens of thousands of healthcare breach reports, audited dozens of health care entities, and entered into a few high-profile financial settlements. These enforcement efforts offer a wealth of knowledge on the threats facing the health care industry, the privacy and security issues that represent the largest legal risks, and how improvements can be made. This presentation will analyze past enforcement trends and offer analysis and lessons about ways health care providers and plans can improve the privacy and security of some of our most sensitive information.

Adam Greene is a partner in the Washington, D.C., office of Davis Wright Tremaine, where he primarily counsels health care providers and technology companies on compliance with the HIPAA privacy, security, and breach notification rules. Previously, Adam was a regulator at the U.S. Department of Health and Human Services, where he played a fundamental role in administering and enforcing the HIPAA rules. At HHS, Adam was responsible for determining how HIPAA rules apply to new and emerging health information technologies, and he was instrumental in the development of the current HIPAA enforcement process. Adam is the Chair of the HIMSS Cloud Security Workgroup and a member of the AHIMA Emerging Issues Practice Council.

Health information technology can have positive impacts on healthcare delivery and is utilised for various applications. Patient-centred services are a special kind of health information technology and are designed to cater to patients' needs. They manage personal medical information and utilise such information to offer personalised, advantageous services as well as information for patients. Due to the sensitivity of medical information and the gravity of possible consequences, if medical information falls into the wrong hands, patient-centred services need to employ security measures to ensure the privacy of patients. The German Nationwide Health Information Technology Infrastructure (HTI), which is currently being established, could serve as a fit and proper foundation for securely offering patient-centred services. In this paper, we illustrate the past developments and current status of the HTI introduction with a focus on security aspects related to patient-centred services. We depict how security features of the HTI can be applied to improve secure provision of patient-centred services. Furthermore, we present additional security measures that should be implemented by providers of patient-centred services.

Portable implantable medical device systems are playing a larger role in modern health care. Increasing attention is now being given to the wireless control interface of these systems. Our position is that wireless security in portable implantable medical device systems is just a part of the overall system security, and increased attention is needed to address low-tech security issues.

We previously developed an enhanced Role-Based Access Control (RBAC) model to support information access management in the context of team collaboration and workflow. We report in this paper a generic system framework to implement the enhanced RBAC with three functional layers: (1) encoding of access control policies; (2) interpretation of the encoded policies; and (3) application of policies to specific cases and scenarios for information access management. Based on this system framework, we have successfully applied the enhanced RBAC model to the New York State HIV Clinical Education Initiative (CEI) for coordination of clinical education programs. An evaluation has shown that the enhanced RBAC can be effectively used for information access management in collaborative processes. Future work includes extension of this system framework to support the continuous development of the enhanced RBAC and deployment of it to other domain applications for clinical education, biomedical research, and patient care.

In the medical sphere, personal and medical information is collected, stored, and transmitted for various purposes, such as, continuity of care, rapid formulation of diagnoses, and billing. Many of these operations must comply with federal regulations like the Health Insurance Portability and Accountability Act (HIPAA). To this end, we need a specification language that can precisely capture the requirements of HIPAA. We also need an enforcement engine that can enforce the privacy policies specified in the language. In the current work, we evaluate eXtensible Access Control Markup Language (XACML) as a candidate specification language for HIPAA privacy rules. We evaluate XACML based on the set of features required to sufficiently express HIPAA, proposed by a prior work. We also discuss which of the features necessary for expressing HIPAA are missing in XACML. We then present high level designs of how to enhance XACML’s enforcement engine to support the missing features.

Both health information technology (HIT) and the payment card industry (PCI) involve the exchange and management of sensitive, protected information. Compared to the PCI, HIT could consider protected health information (PHI) more sensitive than PCI cardholder data. If cardholder data is breached in the PCI, payment card companies may then remove fraudulent charges from the customer’s account and/or issue the customer a new payment card. However, once a person’s PHI has been breached, the PHI has been breached forever. Healthcare organizations cannot issue new health histories or new identities to affected individuals. Secure logging and auditing may deter users from performing unauthorized transactions with PHI since an irrefutable trace of the user’s activity is recorded. Logging and auditing also provides an accounting of PHI disclosures for assisting data breach investigations.

Secure logging and auditing is one mechanism EHR systems should implement to promote security, user accountability, and trust. The objective of this paper is to raise awareness of issues around electronic health record logging and auditing mechanisms through a comparison with the Payment Card Industry Data Security Standards. With the recent push to move all health records to electronic format, the healthcare industry needs to define better standards for secure logging and auditing in EHR systems.

We propose an orthogonal artifact to the HIPAA Privacy Rule's Accounting of Disclosure (AOD). Instead of the patient-centric AOD, we propose a provider-centric "Accounting of Relationships" that aggregates "data flows" involving PHI across all patients. This AOR artifact allows a number of complementary uses in conjunction with the AOD, but also allows meaningful comparisons of PHI data flows across provider institutions.