Ciphertext-Policy Attribute-Based Signcryption With Verifiable Outsourced Designcryption for Sharing Personal Health Records

There has been a consistent concern about the inadvertent disclosure of personal information through peer-to-peer file sharing applications, such as Limewire and Morpheus. Examples of personal health and financial information being exposed have been published. We wanted to estimate the extent to which personal health information (PHI) is being disclosed in this way, and compare that to the extent of disclosure of personal financial information (PFI). After careful review and approval of our protocol by our institutional research ethics board, files were downloaded from peer-to-peer file sharing networks and manually analyzed for the presence of PHI and PFI. The geographic region of the IP addresses was determined, and classified as either USA or Canada. We estimated the proportion of files that contain personal health and financial information for each region. We also estimated the proportion of search terms that return files with personal health and financial information. We ascertained and discuss the ethical issues related to this study. Approximately 0.4% of Canadian IP addresses had PHI, as did 0.5% of US IP addresses. There was more disclosure of financial information, at 1.7% of Canadian IP addresses and 4.7% of US IP addresses. An analysis of search terms used in these file sharing networks showed that a small percentage of the terms would return PHI and PFI files (ie, there are people successfully searching for PFI and PHI on the peer-to-peer file sharing networks). There is a real risk of inadvertent disclosure of PHI through peer-to-peer file sharing networks, although the risk is not as large as for PFI. Anyone keeping PHI on their computers should avoid installing file sharing applications on their computers, or if they have to use such tools, actively manage the risks of inadvertent disclosure of their, their family's, their clients', or patients' PHI.

Personal health record (PHR) is an emerging patient-centric model of health information exchange, which is often outsourced to be stored at a third party, such as cloud providers. However, there have been wide privacy concerns as personal health information could be exposed to those third party servers and to unauthorized parties. To assure the patients' control over access to their own PHRs, it is a promising method to encrypt the PHRs before outsourcing. Yet, issues such as risks of privacy exposure, scalability in key management, flexible access, and efficient user revocation, have remained the most important challenges toward achieving fine-grained, cryptographically enforced data access control. In this paper, we propose a novel patient-centric framework and a suite of mechanisms for data access control to PHRs stored in semitrusted servers. To achieve fine-grained and scalable data access control for PHRs, we leverage attribute-based encryption (ABE) techniques to encrypt each patient's PHR file. Different from previous works in secure data outsourcing, we focus on the multiple data owner scenario, and divide the users in the PHR system into multiple security domains that greatly reduces the key management complexity for owners and users. A high degree of patient privacy is guaranteed simultaneously by exploiting multiauthority ABE. Our scheme also enables dynamic modification of access policies or file attributes, supports efficient on-demand user/attribute revocation and break-glass access under emergency scenarios. Extensive analytical and experimental results are presented which show the security, scalability, and efficiency of our proposed scheme.

The adoption of Electronic Health Records (EHRs) in India has been rapid and the significance of protecting privacy of personal health information has proportionally increased as well. The research emanates from scenario of rapidly rising frequency of cyber-threats to personal health information and lower efficiency of the legal framework in handling such threats. The latest development made towards protection of general digital information Digital Personal Data Protection Act, 2023 ensures protection of digital personal data and incorporates important provisions which were not available in the former legislations and regulatory frameworks. However, the aforementioned Act still lacks several significant provisions in comparison to other legislations governing personal health information in other countries. The research identifies several lacunas existing in the Indian legal landscape which can consequently lay an adverse impact on the privacy of personal health information. Furthermore, it also analyzes the legal framework and further conducts a comparative review of the legislations in European Union and United States. The comparative assessment highlights absence of several provisions in Indian legal framework and consequently affecting the data privacy of health information. The analysis following the comparative assessment lays down broad spectrum of provisions which can be incorporated in the Indian legislative structure.

BackgroundWhile Personal Health Records (PHRs) are increasingly adopted globally, understanding public attitudes toward health information sharing remains crucial for successful implementation. This study investigated patterns in willingness to share personal health information among Japanese adults and identified factors influencing their sharing decisions.MethodsA nationwide cross-sectional web-based survey was conducted among 20,000 Japanese adults in December 2023. Participants were recruited through quota sampling based on age, gender, and prefecture population ratios from the 2020 National Census. The survey examined willingness to share personal health information with nine types of recipients (healthcare providers, ambulance crew, application providers, family members, local authorities, employers, pharmaceutical companies, government agencies, and research institutions), trust levels in these recipients, and 17 factors influencing sharing decisions across health benefits, convenience, economic incentives, social significance, information details, transparency, and privacy considerations. Clustering analysis using Uniform Manifold Approximation and Projection (UMAP) and Ordering Points to Identify the Clustering Structure (OPTICS) algorithms was performed to identify distinct patterns in sharing preferences.ResultsDespite low PHR familiarity (88.4% unfamiliar), participants showed willingness to share health information with healthcare providers (65.0%) and family members (65.6%), but expressed lower willingness toward government agencies (28.6%) and research institutions (28.8%). Five distinct clusters were identified: family-only sharers (3.9%), mixed preference sharers (47.9%), comprehensive sharers (12.9%), non-sharers (22.1%), and healthcare-selective sharers (13.2%). Trust levels were highest for family members (85.6%) and healthcare professionals (78.8%), while significantly lower for government agencies (44.2%). Higher education, income, and PHR familiarity were associated with greater willingness to share, while privacy and security concerns were universal across all clusters.ConclusionsThe heterogeneous patterns in health information sharing preferences suggest the need for tailored PHR implementation strategies that address varying privacy concerns and trust levels across different population segments. Success in PHR adoption requires balanced approaches to trust-building, robust data protection, and targeted communication strategies that acknowledge diverse user needs while promoting the benefits of health data sharing.

The sharing of personal health records can help to improve the accuracy of the doctor's diagnosis and to promote the progress of medical research. Currently, to reduce the maintenance cost of data, personal health records are usually outsourced to a third party such as the cloud service provider. In this case, patients may lose direct control over their personal health records and the semi-trusted cloud service provider may tamper with or reveal personal health records. Therefore, ensuring the privacy and integrity of personal health records and realizing the fine-grained access control are crucial issues when personal health records are shared. As a distributed architecture with decentralized and tamper-proof features, blockchain provides a new way to protect the personal health records sharing system. In this paper, we propose a new personal health records sharing scheme with data integrity verifiable based on blockchain. Aiming at the problems of privacy disclosure, limited keyword search ability and loss of control rights in the process of personal health record sharing, the new scheme uses searchable symmetric encryption and attribute-based encryption techniques to achieve privacy protection, keyword search, and fine-grained access control. Compared with the existing similar schemes, the new scheme allows patients to distribute attribute private key for users, avoiding many security problems caused by the existing of attribute authority in the scheme. Furthermore, the new scheme uses blockchain to manage keys in the scheme, avoiding the single point failure problem of centralized key management. In particular, the new scheme stores the hash values of encrypted personal health records in blockchain, and the related index set is stored in smart contract, which can further improve the efficiency of data integrity verification. Finally, performance evaluation and security analysis indicate that our scheme is secure and feasible for practical use.

Problem: "Does the use of PHR improve the health of their users?" Background: The Personal Health Record (PHR) is an electronic application through which individuals can manage and share their lifelong health information. An immediate source of reliable information concerning the past health conditions of the patient might enable the physician to make more accurate diagnosis, preventing medical error. Although PHRs can be shared with health providers, they are used by the patient for self-care and record keeping, matching population’s growing demand to play an active role in their health care. Aim: Our study aims to understand the impact of PHRs on patient’s health. Methods: A systematic review was performed. The unit of analysis was original articles evaluating the impact of PHRs. The sources of information were Pubmed, ISI and Scopus. A hand search was not performed. The articles were analysed considering the study type; PHR’s characteristics; patient’s description, health status, opinion and response; the costs and doctor-patient communication. We set our inclusion and exclusion criteria. The inclusion criteria were articles that evaluated the benefits of PHRs in health care; their effect on certain diseases or populations; their acceptance among populations; articles that reported PHRs as a tool for the physician or evaluated them as a bridge between patient and physician. Exclusion criteria: articles dated before 1990, with no available 2 abstract, not written in English or Portuguese, about electronic systems of health care providers or electronic health records. From the 698 articles, only 158 full-texts fulfilled the inclusion and exclusion criteria. They were read and confronted with our variables. We got results from 44 papers. SPSS® was used to perform all needed statistical analysis. Results: We obtained the frequencies of all variables, performed one smaple t-tests and chi-square tests. We considered as statistically significant results with p<0.05. We observed that this is a topic increasingly discussed in the scientific community, as the number of papers increased exponentially since 2005. Internet PHRs are the most used, followed by paper-based and USB-pen ones. Most PHRs were supported by medical. Many PHRs are used in the treatment of chronic diseases. PHRs improved the use of medication and patient/doctor relation. Conclusion: The results obtained allow us to conclude that PHRs, in fact, improve the health of their users, confirming our belief that further research would be extremely relevant. KEY-WORDS Personal Health Records; Personal Child Health Records; PHR; Health Impact.

—Health information custodians and networkproviders within the circle of care for a patient must meetcertain legal obligations regarding the collection, access anddisclosure of personal health information. We present aframework for consent and risk management that can be usedto help manage a patient’s consent for releasing personal healthinformation, and analyze the risk involved in handling this typeof data. A patient’s preferences for specific privacy policies(expressed in P3P) are elicited through querying, and extrainformation is inferred using a Bayesian network. A risk analysisis performed to help a custodian to make informed decisionswhen handling personal health information. Thus the custodianand provider can help each other meet their respective legalobligations, and patients are more easily able to exercise theirprivacy rights. I. I NTRODUCTION One of the major technical challenges faced by Ontarianhealth care providers under the Personal Health InformationProtection of Privacy Act, 2004 (PHIPA) is ensuring the pri-vacy and security of personal information collected from theirpatients. PHIPA governs practices to protect personal healthinformation (PHI), including consent, collection, use, disclo-sure and handling requests for access/correction to records byindividuals.Most patients deal with multiple health care workers, desig-nated as health information custodians (HICs) under PHIPA.Each HIC may need different levels of access and use to apatient’s health record in the course of providing care, all ofwhich are associated with new legal obligations under PHIPA.As a result, there are several concerns:1) How does a HIC meet their legal obligations surroundingindirect collection of PHI?2) How does a patient retain control over access to theirPHI? How does the primary care physician (PCP) ensurethat appropriate personnel have access to the informationwhen they need it, e.g. in an emergency situation?3) How does a HIC ensure that patient preferences sur-rounding disclosure are being acted on?Fulfillment of these legal obligations necessitates extractingspecific preferences from the patient. Determining qualitativeattitudes toward the handling of data, such as “I care mostabout my information being shared with third parties”, isnontrivial enough. However, determining a given patient’squantitative valuations of actions on their PHI, which isnecessary for a full risk analysis, can be a very difficult task.A HIC grappling with the risks of non-compliance canuse the services of a health information network provider(HINP) to enable electronic means to manage patient PHI.

Objective: This study was conducted to investigate public opinion regarding personal health management service using Personal Health Record (PHR) in Korea. Specifically, the relationships between consumer's demographic characteristics, need for health information, consumer's benefit and concern, type of health information, type of management and security of patient information using PHR and attitude to PHR were explored. Methods: A survey was conducted, using questionnaire developed by the study team based on literature review. Structured questionnaires were completed through a telephone survey for 715 consumers. Results: A key finding was the significant difference for customer's attitude towards using PHR by customer's characteristics. Regarding factors affecting attitudes of customers with higher concern about their health, considering authorization level to access their private information and using reliable method to certificate were more likely to prefer PHR system positively. Conclusion: Public opinion is reflected in policy of health information. Meeting consumers' needs sufficiently, the goal of health information service to improve consumers' accessibility to and satisfaction will archive successfully

Patients have long been concerned about the privacy of their health care information. How private is private'? is a question that echoes through the minds of patients every time they receive a stigmatizing diagnosis such as cancer, a sexually transmitted disease (STD), alcohol or drug dependency, a mental or emotional health problem, or trauma symptoms related to a personal and private experience. Federal regulations for health care providers that went into effect in April 2003 are touted as improving or ensuring the privacy of an individual's personal health information, but do they? We think not. The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (PL. 104-191) is a multitiered, comprehensive, convoluted, and controversial federal law for sweeping health care reform. Although HIPAA is dramatically broader in scope than privacy protections for health care information, a provision for privacy in the form of a Privacy Rule is included in Title II of HIPAA under the Administrative Simplification regulations; this regulation has created widespread controversy, as well it should, juxtaposed with both civil liberties and the tenets of our profession's ethical code. In preparation for the Privacy Rule compliance date in April 2003, executives of covered entities (CEs), which include health plans, health care clearinghouses, and health care providers, were involuntarily plunged into a mire of federal definitions, acronyms, regulations, and procedures that spiked the jargon meter. veritable compliance melee erupted as a result of struggles to comply with the letter of the law in the face of inability to decipher what the letter of the law was. health care network-wide plethora of brochures, forms, and flyers, ostensibly aimed at protecting patient privacy better than ever before, spilled from the many months of compliance preparations by each CE. But contrary to the HIPAA hype about patient protection, and despite the glacier of paperwork for protecting privacy that was spawned by the Privacy Rule, critics of HIPAA claim that this federal law erodes patients' right to privacy. Citizens for Health filed papers in the U.S. district court in Philadelphia alleging that HIPAA regulations threaten essential liberties [privacy] guaranteed by the Constitution (Dougherty, 2003). Privacy and confidentiality are in greater jeopardy than ever because of two security issues inherent in compliance with HIPAA regulations. The first security issue stems from the fact that health care providers are forced to use the Internet for sharing information and for billing purposes. Second, and counter to HIPAA's alleged intent, is the issue of access to private health information. According to a statement issued by Citizens for Health, virtually all personal health information about every aspect of an individual's life can be used and disclosed routinely without notice, without the individual's consent and against his or her (Dougherty, 2003). In the first instance, patient confidentiality is compromised by the federal government, health care workers, hackers, and the legal system. The federal government realizes a savings of billions of tax dollars by computerizing Medicare and Medicaid programs and HIPAA, and, except in very small practices, makes electronic billing mandatory. Also, to facilitate quick information exchange in medical emergencies, there is a push for universal patient identifiers, which relates to the second security issue. nationwide linking of all medical records is possible with such identifiers (Gelman, Pollack, & Weiner, 1999). A national health ID so presages a national health database that Congress has consistently refused to fund the program (Privacilla.org, 2003, p.11). Even so, increasing amounts of new private health information will be traveling the electronic highways, in addition to what is already stored in computers by managed care companies, as the private insurance companies follow the government's lead. …

A personal health record (PHR) system is a smart health system that serves patients and doctors. A PHR is usually stored in a cloud and managed by a semitrusted cloud provider. However, there is still a possibility of the exposure of personal health information to semitrusted parties and unauthorized users. To protect the privacy of patients and ensure that patients can control their PHRs, a patient-centric PHR sharing framework is proposed in this article. In this framework, all PHRs are protected with multiauthority attribute-based encryption before outsourcing, which solves the key hosting problem and achieves fine-grained access control to PHRs. Furthermore, an anonymous authentication between the cloud and the user is proposed to ensure data integrity on the cloud while not exposing the user's identity during authentication. The proposed authentication is issued from a new online-offline attribute-based signature. It can make the encrypted PHRs resist collusion attacks and not be forged during the period of sharing, which enhances patients' control of their PHRs. Online-offline and outsourcing decryption also reduces calculation costs and improves operational efficiency. Finally, comparisons are given based on numerical experiments.

Protecting personal health information has long been a key ethical concern in healthcare. With the rise of digital health systems, privacy concerns have intensified. In least developed countries like Myanmar, where digital literacy is low, public and governmental awareness of privacy issues is limited, and data protection laws are lacking, the health information privacy area remains largely unaddressed and understudied. This study, therefore, aimed to assess the level of privacy concerns related to personal health information in Myanmar and identify the factors associated with these concerns. A cross-sectional survey was conducted from March to May 2024 among 424 participants recruited online and through two private clinics. A validated 21-item scale measuring six domains: Collection, Errors, Unauthorized Secondary Use, Improper Access, Control, and Awareness, was used. Confirmatory factor analysis was performed to validate the scale, and logistic regression was used to identify factors associated with the concerns. Among the 424 participants, 77.83% reported high concerns. The highest concern was observed in the Awareness domain (mean 5.02, SD 1.65), while the Collection domain showed the lowest (mean 3.41, SD 1.44). Participants aged 45 years or older had significantly lower odds of high concerns compared to those aged 18-24 years, with an adjusted odds ratio (aOR) of 0.29 (95% CI 0.09-0.88). In contrast, those reporting good health (aOR 3.72, 95% CI 1.69-8.23) and high health concerns (aOR 5.26, 95% CI 3.02-9.45) had increased odds of high privacy concerns. These findings highlight the need for robust privacy safeguards, legal frameworks, and trust-building measures to support Myanmar's transition to digital health systems. Sampling via online channels and private clinics likely introduced an urban/educated bias, limiting generalizability. However, the findings may still provide insights relevant for other least developed countries facing similar challenges in balancing digital innovation with the protection of personal health information.

Consumers, industry, and government have recently focused attention on the potential of personal health records to empower patients in the health care process, improve patient-provider relationships, facilitate patient access to health information, and improve the quality of health care. A Personal Health Record (PHR) is a private and secure digital record that is created, managed, and owned by an individual, and contains the owner’s relevant health information. The benefits of PHRs have not yet been widely realized due to several significant challenges in their adoption, including the need for privacy, security, and interoperability, and the lack of accepted standards. Although many players in the healthcare arena are beginning to offer partial solutions, none have adequately addressed the full range of challenges. The adoption of PHRs can be significantly accelerated by the development of Open Source software that enables an individual to collect, create, organize, and manage his or her own private and secure PHR, using a standardized format and controlled vocabulary.

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

To provide optimized individual-oriented medical service, an open eco system is required so that personal health information could be safely recorded, managed, shared and viewed. However, the current health information is being separately collected, stored, managed by various management institutions, so data linkage is not guaranteed. The data ownership for personal health information belongs to management entities not an individual and also health information is electronically recorded and managed, so it’s vulnerable to forgery and leakage like other electronic data. This paper proposes a personal health information sharing platform applying the Hyperledger fabric. The proposed platform was designed based on blockchain to provide user-oriented health information management and access rights. Therefore, it is possible to create, manage and share reliable medical data.

Challenges and drawbacks of the health information management (HIM) curriculum at the Master's degree were examined, including lack of well-established computing sciences and inadequacy to give rise to specific competencies. Information management was condensed to the hospital setting to intensify the indispensability of a well-organized educational campaign. The healthcare information dimensions of a national health information infrastructure (NHII) model present novel requirements for HIM education. Articles related to challenges and barriers to adoption of the personal health record (PHR), the core component of personal health dimension of an NHII, were searched through sources including Science Direct, ProQuest, and PubMed. Through a literature review, concerns about the PHR that are associated with HIM functions and responsibilities were extracted. In the community/public health dimension of the NHII the main components have been specified, and the targeted information was gathered through literature review, e-mail, and navigation of international and national organizations. Again, topics related to HIM were evoked. Using an information system (decision support system, artificial neural network, etc.) to support PHR media and content, patient education, patient-HIM communication skills, consumer health information, conducting a surveillance system in other areas of healthcare such as a risk factor surveillance system, occupational health, using an information system to analyze aggregated data including a geographic information system, data mining, online analytical processing, public health vocabulary and classification system, and emerging automated coding systems pose major knowledge gaps in HIM education. Combining all required skills and expertise to handle personal and public dimensions of healthcare information in a single curriculum is simply impractical. Role expansion and role extension for HIM professionals should be defined based on the essence of HIM roles and responsibilities. Forming a curriculum development team consisting of various professional profiles brings divergent views regarding the HIM curriculum and paves the way for HIM to branch out at the Master's and Ph.D. levels based on advanced information technology.