Towards a viable and secure health information system - Part 5

This is the fifth and the final of the series of blog posts that I have been writting on the $sbject, inspired by the paper[1].

Let me include the following diagram which illustrates the overall picture on the security requirements of a health information system.

In my previous four posts in this series, I have discussed about Identity Management/Authentication,, Authorization, Auditing and Cryptographic Operations related to the security of health information systems. In this post, I am going to write about another three aspects which are discussed in the paper[1]: de-identification of EMRs for research purposes, user interaction and dispute resolution and security metrics.

5. De-identification

While the EMRs are very useful in medical research as statistics, it should be guaranteed that the records are properly de-identified before disclosing them for research purposes.

Due to the ambiguities in related laws, complexities in de-identifying protected data and the risk involved, the data is rarely shared for research purposes which negatively affect the medical research.

The paper mentions that it is challenging task than implied in the report to develop cryptographic mechanisms to properly anonymize records as required by secondary use considerations.

I need to read about data de-identification before providing my on views on this. However, those techniques should use proper protection against re-identification in order to maintain individuals’ health privacy and build trust in the health care system.

During the research, I came across a description of an interesting research project named "Cloud DNA" [2]. This project is said to investigate on how to enable scientists to share properly de-identified EHRs in the cloud for easy storage, sharing and retrieval.

6.  User Interaction/Dispute Resolution

User Interaction:
Among other factor that we discussed, user interfaces for patients, providers and administrators are eaqully improtant for a secure system.
The paper suggests the following areas to be explored with regard to this aspect:
1. User friendly mechanisms to deal with complexity of user-selected privacy preferences.
2. How much data to make available to patients in what format
3. Techniques for patients to delegate their access rights

Educating the patients on how to use a PHR service or patient's interface of an EMR system is very important aspect in realizing the goal of a widespread health information echo system. While informing them that they have the control of outside access to their records, it is important to highlight that more it is accessible to physicians, better the service they get.

When the patient signs up for a PHR service or a health care provider, he can be presented with a set of easily understandable questions which ultimately defines the access control policies of their medical records.

Dispute resolution
While it needs for patient to have access to and control of their records, should the patients given the right to correct their record? Or else how to resolve disputes on the information in the records? Most administrators do not like this since they can not always trust patients to keep their medical records honestly.
But the patients should be given the chance to raise any dispute against the records in their profile.

The paper illustrated following aspects to be explored with regard to this:
1. Developing way for patients to securely and privately monitor their health records.
2. Allowing ways for patients to dispute the records while preserving original records
3. Coming up with ways to resolve conflicts on the deisputed records

In my view: Patients should have access to all his EMRs and should be able to establish access control over them. But they should not be able to change the medical records as they wish. If there is dispute, or if  a patient suspects a particular report, there should be a way to mark it as suspected immediately - but could only be changed by an authorized medical officer after further tests etc.

7. Security Metrics

Though it is obvious that EMRs have benefits over traditional paper based medical records, there should be proper security metrics to gauge the level of information security/privacy provided by a particular health care information system.

The paper mentions that in order to provide such assessment/analisis, meaningful matrics should be well developed and accepted which opens up research problems on which current work is also going on. Since the domain is limited, the paper believes that matrics can be developed.

Challenges in developpping such metrics are the variety and complexity of threat models and diffculty of measuring potential flaws in Software.

Research problems related to this aspect are:
1. developing threat models covering both electronic and paper based medical records.
2. developing techniques to quantify level of risk associated with sw based health information system

Conclusion:

• I have been writing this series of blog posts about the security, privacy, access control and identity management aspects related to health care IT systems from the  understanding that I got from various sources and my experiences as well. This was mainly inspired by the paper[1] which provides a research road map on the same topic.

• The paper[1] is mainly based on the PCAST report 2010 and this PCAST report have caused some arguments in the field. However, the paper[1] and this blog series has only taken the technical requirements that it has highlighted into consideration to identify the research problems and this blog series doesn't  intend to support or unsupport the report.

• Although the research community has identified and actively working on the research problems pertaining to the subject, there are many obstacles as well, such as difficulty in obtaining testbeds and test data for research  due to the sensitivity and critical nature of the data. Therefore it has been hard for research to comeup with successful results without realistic and live data and also those results obtained from sample mock data are unlikely to be accepted by the community.

• No matter how technically strong the healthcare IT solution is, there should be adequate and non-ambiguous legislation to fully realize the goal of a nation wide health IT echo system.

• During my research on this, I've come across some active and interesting research efforts from some research groups such as Health & Medical Security Lab[3], SHARPS [4] , CERIAS [5], and MediVault [5].

• The paper[1] provides a good overall understanding of the security requirements of a healthcare information system. Most importantly, it provides a very good understanding about the current research problems in the area for a budding researcher who is passionate about carrying out research in security, privacy and access control aspects, outcome of which can be contributed to realize the vision of the secured and viable health IT echo system. 

Related work:
I have done a webinar on Security Patterns with WSO2 ESB for which I picked use cases from health care domain and it was when I first got interested in investigating further on the security, privacy and identity management requirements of healthcare IS. In that effort, I mainly referred MSc thesis on the topic : Security in SOA-Based Healthcare Systems by Richard Sassoon.

References:
[1] A Research Roadmap for Healthcare IT Security inspired by the PCAST Health Information Technology Report
[2] Cloud DNA
[3] Health and Medical Security Lab
[4] SHARPS
[5] CERIAS
[6] MediVault
[7] Security in SOA-Based Healthcare Systems

Towards a viable and secure health information system - Part 4

This is the fourth of the series of blog posts that I have been writting on the subject, which was mainly inspired by the paper[1].

For the clarity and the ease of summarizing, let me include the following diagram which illustrates the overall picture on the security requirements of a health information system.

In my previous three posts in this series, I have discussed about Identity Management/Authentication, Authorization and Auditing. In this post, I am going to write about what role cryptographic techniques play in healthcare IS.

4. Cryptographic Techniques
Confidentiality, integrity and non-repudiation are key security requirements that should be met by any health information system. Encryption, digital signature are the de-facto mechanisms of achieving them. However, traditional encryption mechanisms have major limitations in accomplishing the goals of a distributed, country wide health information echo system.

Let me discuss this further adhering to my usual format: i.e discussing views from the paper[1] and me.

•  As in any security sensitive system, data both at rest and on the wire should be encrypted.
• Traditional public key cryptography has limitations to be used in a health information echo system because of the complexity in exchanging keys used to decrypt the EMRs, among the authorized principals who may come from around the country.
• Therefore, keys used to encrypt the data (we can call this cryptographic authorization as well) are not attached to individuals, but attached to role/identity attributes.
• If encrypted data is stored in one machine, the keys to decrypt should be obtained from  another service which is separately managed.
• The metadata related to EMR(which was discussed in detail in my second post) which contains information about access control to EMRs, should be digitally signed.
• Some of the metadata can be encrypted as well. Since the EMRs should be able to be searched from anywhere in the country, the keys to decrypt the metadata should be known to secure search engines but only the authorized personal should be able to decrypt the actual EMR data.

• The paper highlights the research problems motivated by the above requirements.
• Developing techniques to support flexible key management policies 
• Paper recommends using Attribute Based Encryption (ABE) for cryptographic access control and identifies research problems along that line as:

                  - Developing techniques to specify and enforce access control for EMRs based on ABE
                  - Developing key management solutions for ABE
                  - Provide cryptographic mechanisms to properly anonymize records as required by secondary use considerations such as research.

Here are some of my thoughts on the usage of cryptographic techniques in healthcare information systems

• As the paper suggests, Attribute Based Encryption(ABE) would provide a scalable solution for the cryptographic needs of a health information system and also a solution for the key management requirements.The post[2] describes ABE in detail, in summary what happens is:
  "The plaintext is encrypted with a set of attributes. The KGS(Key Generation Server), which possesses the master key, issues different private keys to users after authenticating the attributes they possess".

• The same post[2] describes two flavors of ABE which are Key Policy - Attribute Based Encryption and Ciphertext Policy Attribute Based Encryption. I believe the second one is more scalable since the keys are issued for the attributes that a principal possesses and whether the given cipher text can or can not be decrypted by that key is determined by the access policy enforced in the cipher text.

• In the paper[4], Akinyele et al. have implemented a solution for self protecting EMRs using Attribute Based Access Control. There, they have used a standard format (CCR) and an automated policy engine which assign a access policy for each record in patients' EMRs using which the records are encrypted with ABE.

• However, there is huge trust placed on Key Generation Server for correctly authenticating and validating the attributes that a user possesses before issuing keys. Therefore necessary actions should be taken in order to prevent it being a central point of failure.

• Performance should also be considered along with security. Public key cryptography is known to posses performance bottlenecks than symmetric key cryptography. However, symmetric key cryptography also has its own limitations. The thesis[3] introduces a symmetric cryptographic approach for key management known as Attribute Based Group Key Management.

Above are based on some of my readings about privacy preserving cryptographic techniques which can be used to accomplish the requirements of healthcare IT systems.

Another area related to the above discussion that I need to explore further is privacy preserving secure searching techniques to make the necessary EMRs available for the authorized physicians when they submit the search query from any location in the country.

References:
[1] A Research Roadmap for Healthcare IT Security inspired by the PCAST Health Information Technology Report
[2] Attribute Based Encryption
[3] Privacy Preserving Access Control for Third Party Data Management Systems
[4] Self-Protecting Electronic Medical Records Using Attribute-Based Encryption

Towards a viable and secure health information system - Part 3

This is the third of the series of blog posts that I have been writting, inspired by the paper[1].

Let me include the following diagram which illustrates the overall picture on the security requirements of a health information system.

In my previous two posts in this series, I have discussed about Identity Management/Authentication and Authorization. In this post, I am going to write about another important aspect of health care IS which is auditing.

3. Auditing

Auditing helps mainly in investigations about frauds or security breaches. In order to recreate an incident, meaningful and useful audit logs should be readily available. Protecting audit log archives is another challenge to be addressed.

Let me discuss this further adhering to my usual format: i.e discussing views from the paper[1] and me.

• The report mentions that the actions like the ones below in a health IT system should be monitored and audited by a security infrastructure which is independently managed.- Actions taken by different principals interacting with the system such as accessing, modifying and deleting EMRs
  - The policies/information used to authorize those actions.
  - Changes to authorization policies.

• It highlights the need of protecting audit logs with cryptographic mechanisms such that they can not be deleted, changed or tampered even by the administrators.

• It also raises the need of facilitating the patients to review audit records pertaining to their EMRs.

• The paper[1] draws attention towards an important concern related to auditing. That is: although it is easy to log every action, it generates lot of volume which causes problems in storage and retrieving info & recreatingan event when an incident occurs.

• Research problems identified by the paper in this space:- Exploring techniques to create audit logs in such a way that we can recreate events as well as limit the amount to store.
  - Finding new approaches for storage and retreival and also user-friendly access to logs.

Let me note down some of my ideas with this regard:

• Distributed logging standards such as XDAS[2] can be used in for auditing at a certain layer in the distributed health IT echosystem.

• Efficient digital signature mechanism needs to be in place for integrity protection of the log.

• Cassandra storage can be used to overcome the issue of large volumes of audit logs and a parallel processing techniques such as MapReduce can be used to efficient processing of audit logs at the retrieval stage. (Cassandra has been used in WSO2 Stratos which is the open source cloud middleware platform offered by WSO2. There, each tenant is able to view logs specific to that particular tenant. Similar techniques can be used to make audit records related to EMRs of a particular patient available to that patient which is a requirement raised in PCAST report as well.)

References:
[1] A Research Roadmap for Healthcare IT Security inspired by the PCAST Health Information Technology Report
[2] Introduction to XDAS