Securing electronic health records without impeding the flow of information

Abstract

Objective

We present an integrated set of technologies, known as the Hippocratic Database, that enable healthcare enterprises to comply with privacy and security laws without impeding the legitimate management, sharing, and analysis of personal health information.

Approach

The Hippocratic Database approach to securing electronic health records involves (1) active enforcement of fine-grained data disclosure policies using query modification techniques, (2) efficient auditing of past database access to verify compliance with policies and track security breaches, (3) data mining algorithms that preserve privacy by randomizing information at the individual level, (4) de-identification of personal health data using an optimal method of k-anonymization, and (5) information sharing across autonomous data sources using cryptographic protocols.

Conclusions

Our research confirms that policies concerning the disclosure of electronic health records can be reliably and efficiently enforced and audited at the database level. We further demonstrate that advanced data mining and anonymization techniques can be employed to analyze aggregate health records without revealing individual patient identities. Finally, we show that web services and commutative encryption can be used to share sensitive information selectively among autonomous entities without compromising security or privacy.

Introduction

The 1995 European Union Directive on Data Protection (“Directive”) [1] set forth stringent cross-industry standards regarding privacy and security of personal data. Pursuant to these standards, EU member states enacted data protection laws that obligate controllers of health data to provide all data subjects with: (1) notice of the purposes for which they collect and use personal data; (2) choice regarding whether their data may be disclosed to third parties or used for a different purpose than it was originally collected or subsequently authorized; (3) reasonable assurance that the data will be secured and its integrity maintained; (4) access to the data and the opportunity to correct inaccuracies; (5) legal recourse to ensure compliance with data protection requirements. EU states may allow processing of health data without patient consent for purposes of preventative medicine, diagnosis, treatment, management of medical services, or otherwise under professional confidentiality obligations, only if suitable safeguards are provided.

Similar laws in the United States [2], Canada [3], Australia [4], and Japan [5] require healthcare institutions to protect the privacy and security of personal health data. Advisory reports commissioned by the United States government [6], [7] also stress the importance of developing secure, interoperable electronic health records systems that preserve patient privacy. As countries around the world transition from paper-based to electronic health records infrastructures, compliance with these data protection laws will require sophisticated information management technologies. Healthcare organizations must implement privacy and security protections that do not unduly constrain proper use and dissemination of health data or inhibit scientific discovery. Technical and policy challenges concerning the widespread adoption of electronic health records systems have been discussed, for example, in [8] and [9].

The Hippocratic Database (“HDB”) [10] is an integrated set of technologies that manages disclosure of electronic health records in compliance with data protection laws without impeding the legitimate flow of information. HDB's Active Enforcement component limits disclosure of personal health information at a fine-grained level in strict accordance with enterprise policies, legal regulations, and individual patient choices. Its Compliance Auditing component efficiently tracks past disclosures to verify compliance with these policies. Finally, its data mining, de-identification, and information sharing components enable organizations to derive maximum value from sensitive data without compromising privacy or security.

The remainder of this paper is organized as follows. Sections 2 Active Enforcement, 3 Compliance Auditing describe Active Enforcement and Compliance Auditing. Sections 4 Privacy-Preserving Data Mining, 4.1 Privacy-Preserving Data Mining scenario, 5 Optimal, 5.1 Optimal, 6 Sovereign Information Integration discuss HDB's Privacy-Preserving Data Mining, Optimal k-Anonymization, and Sovereign Information Integration components. In each section, we include example scenarios demonstrating practical applications of these technologies. In Section 7, we suggest a number of opportunities for further research in securely managing electronic health records. We conclude in Section 8.