Modeling Privacy Aware Health Information Exchange Systems

The rapid growth of the Internet has been accompanied by a proliferation of e-services targeting consumers. E-services are available for banking, shopping, learning, government online, and healthcare. However, each of these services requires a consumer’s personally identifiable information (PII) in one form or another. This leads to concerns over privacy. In order for e-services to be successful, privacy must be protected (Ackerman, Cranor, & Reagle, 1999). An effective and flexible way of handling privacy is management via privacy policies. In this approach, a consumer of an e-service has a personal privacy policy that describes what private information the consumer is willing to give up to the e-service, with which parties the provider of the e-service may share the private information, and how long the private information may be kept by the provider. The provider likewise has a provider privacy policy describing similar privacy constraints as in the consumer’s policy, but from the viewpoint of the provider, (i.e., the nature of the private information and the disclosure/retention requirements that are needed by the e-service). Before the consumer engages the e-service, the provider’s privacy policy must match with the consumer’s privacy policy. In this way, the consumer’s privacy is protected, assuming that the provider complies with the consumer’s privacy policy. Note that policy compliance is outside the scope of this work but see Yee and Korba (July, 2004). Initial attempts at conserving consumer privacy for e-services over the last few years have focused on the use of Web site privacy policies that state the privacy rules or preferences of the Web site or service provider. Some of these policies are merely statements in plain English and it is up to the consumer to read it. This has the drawback that very few consumers take the trouble to read it. Even when they do take the time to look at it, online privacy policies have been far too complicated for consumers to understand and suffer from other deficiencies (Lichtenstein, Swatman, & Babu, 2003; Jensen & Potts, 2004). Still other privacy policies are specified using P3P (W3C) that allows a consumer’s browser to automatically check the privacy policy via a browser plug-in. This, of course, is better than plain English policies but a major drawback is that it is a “take-it-or-leave-it” approach. There is no recourse for the consumer who has a conflict with the Web site’s P3P policy, except to try another Web site. In this case, we have advocated a negotiations approach to resolve the conflict (Yee & Korba, Jan., May, 2003). However, this requires a machine-processable personal privacy policy for the consumer. We assume that providers in general have sufficient resources to generate their privacy policies. Certainly, the literature is full of works relating to enterprise privacy policies and models (e.g., Barth & Mitchell, 2005; Karjoth & Schunter 2002). Consumers, on the other hand, need help in formulating machine-processable privacy policies. In addition, the creation of such policies needs to be as easy as possible or consumers would simply avoid using them. Existing privacy specification languages such as P3P, APPEL (W3C; W3C, 2002), and EPAL (IBM) are far too complicated for the average internet user to understand. Understanding or changing a privacy policy expressed in these languages effectively requires knowing how to program. Moreover, most of these languages suffer from inadequate expressiveness (Stufflebeam, Anton, He, & Jain, 2004). What is needed is an easy, semi-automated way of seeding a personal privacy policy with a consumer’s privacy preferences. In this work, we present two semi-automated approaches for obtaining consumer personal privacy policies for e-services through seeding. This article is based on our work in Yee and Korba (2004). The section “Background” examines related work and the content of personal privacy policies. The section “Semi-Automated Seeding of Personal Privacy Policies” shows how personal privacy policies can be semi-automatically seeded or generated. The section “Future Trends” identifies some of the developments we see in this area over the next few years. We end with ”Conclusion”.

The perspectives of families, and especially parents of children with special health care needs, need to be better understood by the government agencies, health care providers, associations, and information systems vendors that are integrating child health information systems. To date, research on children with special health care needs has not included the perspectives of parents on integrated child health information systems. Interviews were conducted with a limited number of parents of children with special health care needs and a young adult with special health care needs about their perspectives on integrated health information systems needs. The interviews revealed common themes: (1) parents have experienced the benefits of information technology for health care purposes, (2) parents believe integrated health information systems could help to coordinate their children's health care, (3) parents believe information technology can help improve accuracy and timeliness of information, (4) parents of children with special health care needs believe their children's health information should be available to those who need it, but safeguards must be in place, (5) parents believe health information systems can improve health care, but it is not the highest priority health care issue for them, and (6) parents believe that their involvement in issues related to children with special health care needs, including information technology, is critical. Parents of children with special health care needs hold strong opinions about their children's health care, including health information systems. Parents need to be central to discussions about development of integrated child health information systems if we are to develop information systems that serve the needs of children with special health care needs and their families.

PurposeHealth information exchange (HIE) initiatives utilize sharing mechanisms through which health information is mostly transmitted without a patient's close supervision; thus, patient trust in the HIE is the core in this setting. Existing technology acceptance theories mainly consider cognitive beliefs resulting in adoption behavior. The study argues that existing theories should be expanded to cover not only cognitive beliefs but also the emotion provoked by the sharing nature of the technology. Based on the theory of reasoned action, the technology adoption literature, and the trust literature, we theoretically explain and empirically test the impact of perceived transparency of privacy policy on cognitive trust and emotional trust in HIEs. Moreover, the study analyzes the effects of cognitive trust and emotional trust on the intention to opt in to HIEs and willingness to disclose health information.Design/methodology/approachAn online survey was conducted using data from individuals who were aware of HIEs through experience with at least one provider participating in an HIE network. Data were collected from a wide range of adult population groups in the United States.FindingsThe structural equation modeling analysis results provide empirical support for the proposed model. The model highlights the strategic role of the perceived transparency of the privacy policy in building trust in HIEs. When patients know more about HIE security measures, sharing procedures, and privacy terms, they feel more in control, more assured, and less at risk. The results also show that patient trust in HIEs may take the forms of intention to opt in to an HIE and willingness to disclose health information exchanged through HIE networks.Originality/valueThe findings of this study should be of interest to both academics and practitioners. The research highlights the importance of developing and using a transparent privacy policy in the diffusion of HIEs. The findings provide a deep understanding of dimensions of HIE privacy policy that should be addressed by health-care organizations to exchange personal health information in a secure and private manner.

As it becomes easy and inexpensive to store huge amount of data, concerns about privacy are increasing as well. Although service providers have privacy policies, research shows that users rarely read privacy policies. As a result, there has been little work done on how consumers respond to individual segments of privacy policies, which is important for organizations when designing privacy policies. In this study, the authors break down privacy policies of two well-known social network companies (Facebook, Twitter) and financial institution (Bank of America) into simple segments. They then use crowd sourcing to analyze consumers' response to these policy segments. The authors ask questions on users' awareness, expectations, familiarity, and privacy concerns of these policy segments. The relationships between various factors such as demographic factors, data type, data flow and consumers' privacy concerns were also investigated. The authors conclude with guidelines and suggestions for improvement and ways to increase users' awareness of privacy policies.

The privacy policies of online social network (OSN) service providers are criticised as falling short of satisfying their users' privacy expectations letting huge quantities of their personally identifiable information (PII) exposed to unknown audiences. The purpose of this paper is twofold: to assess the conformance of the privacy policies applied in the five topmost leading OSNs to an internationally acknowledged benchmark such as the ISO 29100:2011 standard, and to propose improvements based on the findings of the assessment. Further, as serious mismatches between these privacy policies and the adherence criteria set out in the ISO 29100:2011 standard were identified, a data lifecycle model is proposed as the basis for an improved OSN privacy policy. A restructuring of the existing policies according to the data lifecycle model will allow them to enjoy characteristics that are known to be important in forming users' perceptions.

In this paper, we consider a problem of monopolistic information management technologies. Most service providers have an access to any information. Even though the information is really a personal data, service providers can access with it merely with the user's first subscription. A collaborative privacy management system (Co- PMS) is suggested to satisfy the requirement. In this scheme, each user will provide ones own privacy policy by using a policy creation interface. The policy negotiation engine performs collaborative process with the certain service's data disclosure policy. This architecture provides more powerful right to each user to access ones own privacy policy and personal information. It also reinforces the security because of diverse privacy policy. It will develop the privacy policy based on security systems. We also expect the encrypted privacy policy to be used as an authentication certification.

IntroductionWHO’s reference classifications, ICD and ICF have traditionally served as standards for disease, health and disability related data. To meet the requirements of health (and disability) information systems in the 21st century WHO classifications need to represent the knowledge digitally in a coherent semantic structure. The knowledge representation in a classification requires that the information entities need to be identified with clear attributes and values and put into the context of an overall information model.AimsTo identify how we can possibly build mechanisms for meaningful data exchange in health information systems and discuss the prospects and implications for digital systems for public health.ResultsDigitalization of health and disability information system is an emerging need around the world. The transition from an analogue (and usually unsystematic information compilations) to digital health information system is a common observed trend which is expected to gain dominance in forthcoming decades. The information communication technology (ICT) developments have created multiple work streams to this field which are usually summarized as e-health. Further to the digital technology, the need to define and provide the content standards is a shared responsibility of the both content and technology stakeholders: one needs to define the content in a analogue form first, then convert into a digital application. Each health information rubric should be operationally defined and then be digitally represented in computerized information systems. To achieve this aim ontology as a computer science provides the scientific discipline and practical tools to define entities with their attributes and values. Creating the ontological basis for classifications will enable to represent the underpinning knowledge structure in an operational way; describe the logical rules as to how they relate to each other, identify measurable properties and provide a basis to share information both digitally and among humans irrespective of linguistic differences. In this way, health and disability information can be harmonized and aggregated at both individual and population levels.ConclusionsFormalized knowledge representation will allow for better construction of health and disability information, enable research and policy making by allowing meaningful exchange aggregation of data from multiple sources and enable science based decision-making.

Concerns about the protection of personally identifiable information are not unique to the health care industry; however, consumers view their medical records as more "private" than other information because involuntary disclosure can affect jobs or health insurance status. EPAL is a convenient way of capturing privacy policies. This paper presents an EPAL based privacy middleware architecture called Privacy Broker which attempts to reduce privacy violation risk and enforce committed privacy policy in health information system. This paper also provides a translation of SQL queries into Authorization Request in EPAL.

Ubiquitous computing (ubicomp) demands new security and privacy enhancing technologies for the new information and communication environments where a huge number of computers interact with each other in a distributed and ad hoc manner to access various resources and services. This paper surveys emerging security and privacy enhancing technologies, focusing on access control in ubiquitous computing environments because this is the underlying core technology to enforce security and privacy policies. We classify access control technologies into three types associated with the three access control phases of prevention, avoidance, and detection, and provide an overview of ubiquitous computing-oriented technologies and solutions, ranging from security and privacy models and policies to the enforcement of policies and system implementation.

In some developing countries health agencies and donors do not know how many people are dying or what the causes of death are. But with increased donor demands for transparency and performance measurement, countries are having to provide reliable health information and efforts are under way to help them. Countries that do not generate reliable health information or evidence lack the basis for making sound policy-decisions. "So you have a weak (health) sector with weak information. Therefore management decisions are often not rational; you don't provide enough information to get more resources, so it is vicious circle," said Bernhard Schwartlander, director of strategic information and evaluation at the Global Fund to Fight AIDS, Tuberculosis and Malaria. Schwartlander said that more than 90% of low-income countries do not have a well-functioning health information system, which is vital for generating basic health data. A health information system is essentially a collection of health statistics from various sources, used to derive information about health status, health care, provision and use of services, and the impact on a population's health. Until the 1990s, health information related mainly to clinical data and disease control and surveillance. Since then it has expanded to include population health data to determine major public health problems. The first aim of a health information system is to identify health issues, said Chris Scott, a development economist at the London School of Economics. It can also be used to inform health programme design and policy choice; it can help to forecast future health scenarios--as in the case of HIV/AIDS in Africa--and to monitor and evaluate the implementation of health policies, Scott said. For many low-income countries the problem is that even a rudimentary health information system costs too much. "As a result, decision-makers are unable to identify problems and needs and track progress, evaluate the impact of interventions and make evidence-based decisions on health policy, programme design, and resource allocation", according to a report by WHO's Health Metrics Network. This network is a new global partnership, hosted by WHO, that aims to tackle the health information bottleneck in low-income countries and help those countries build or consolidate their fledgling health information systems. "Health Metrics Network will work with countries to assess the current status, identify gaps, and develop a national plan for improving the health information system," said interim executive secretary Carla AbouZahr. The idea is that efforts to strengthen health information systems within countries would be financed by resources in the countries themselves, for example through multilateral development partners such as the World Bank, bilateral donors and global health initiatives such as the Global Fund and the Global Alliance for Vaccines and Immunization (GAVI). AbouZahr said that the Health Metrics Network hoped to sign agreements by October with a number of low- and middle-income countries to develop health information systems. Helping countries build and sustain health informations systems is a challenge. Scott said one way to address this would be for WHO to promote health information systems that are appropriate to the infrastructure, technological capacity and budgets of health ministries. In the poorest countries, it might be helpful to design and implement a simple pencil-and-paper-based health information system which contains data understood by and, therefore, more likely to be used by policy-makers at different levels, he added. "Launching directly a nationwide, computer-based health information system which is vulnerable to power failures, software crashes and inadequate IT skills of health staff is a high-risk strategy," Scott said. There may be a case in large federal states for experimenting with different types of health information systems in different parts of the country to see which one functions best in which set of circumstances, Scott said. …

The purpose of this study was to describe sets of nursing concepts including, for example, nursing diagnoses and interventions, which are knowledge-based and clinically relevant to support nursing practice. Health information systems using the International Classification for Nursing Practice (ICNP®) provide a platform for standardized nursing documentation for patients' health care, clinical decision support, and repositories for re-use of clinical data for quality evaluation, research, management decisions and policy development. Clinically relevant sets of ICNP concepts can facilitate implementation of health information systems for nursing. Descriptive analysis was used to examine the types of, and relationships among, existing nursing content sets. Findings included the need for various types of content sets, as represented in ICNP catalogues, for nursing documentation. Five types of ICNP Catalogues included Care Plans, Order Sets, Clinical Templates, Nursing Minimum Data Sets, and Terminology Subsets.

Data privacy laws require service providers to inform their customers on how user data is gathered, used, protected, and shared. The General Data Protection Regulation (GDPR) is a legal framework that provides guidelines for collecting and processing personal information from individuals. Service providers use privacy policies to outline the ways an organization captures, retains, analyzes, and shares customers’ data with other parties. These policies are complex and written using legal jargon; therefore, users rarely read them before accepting them. There exist a number of approaches to automating the task of summarizing privacy policies and assigning risk levels. Most of the existing approaches are not GDPR compliant and use manual annotation/labeling of the privacy text to assign risk level, which is time-consuming and costly. We present a framework that helps users see not only data practice policy compliance with GDPR but also the risk levels to privacy associated with accepting that policy. The main contribution of our approach is eliminating the overhead cost of manual annotation by using the most frequent words in each category to create word-bags, which are used with Regular Expressions and Pointwise Mutual Information scores to assign risk levels that comply with the GDPR guidelines for data protection. We have also developed a web-based application to graphically display risk level reports for any given online privacy policy. Results show that our approach is not only consistent with GDPR but performs better than existing approaches by successfully assigning risk levels with 95.1% accuracy after assigning data practice categories with an accuracy rate of 79%.

BackgroundThe Sars-CoV-2 pandemic exacerbates existing inequalities across health care systems globally, both within countries and between countries. It also highlights, like no other crisis before, existing weaknesses in health information systems (HIS). This article summarizes these key challenges for HIS in times of a pandemic and beyond, with a focus on European countries. It builds on the experiences of a large consortium representing HIS experts in key positions in national public health or similar institutes across Europe.MethodsData were collected in bi-weekly conference calls organized by the InfAct project between February and June 2020. Emerging themes were clustered and analysed around a WHO framework for health information systems (HIS). We analyse strengths of HIS at two levels: (i) dealing with health information directly, and (ii) dealing with other parts of information systems that allow for a holistic assessment of the pandemic (including health-related aspects).ResultsThe analysis highlights the need for capacity-building in HIS before a pandemic hits, the relevance of going beyond health information only related to health care but taking a broader perspective (e.g. on vulnerable groups), the need for strong reporting systems on staffing numbers and in primary care. Further, data linkage emerges as a crucial precondition to identify unmet needs for essential health care services in a timely manner. Finally, room for innovation and digitalisation is key to be able to react flexibly in times of crisis. Trust for health information stakeholders is another important factor to create strong HIS.ConclusionsThe strengths and shortcomings of European HIS that have been observed during the COVID-19 crisis highlight the need for strong HIS beyond the crisis. The experiences reported leave as a central message that successful reactions to the pandemic are (also) grounded in strong HIS that ultimately not only benefit the health of the population but also create a number of economic and psycho-social benefits. Strong data reporting schemes may also support fine-tuning of containment measures during a pandemic as well as transition phases.

Background How does your Health Information System (HIS) measure up to others in the EU? How can you empower national HIS players with an objective peer-reviewed HIS assessment? Nine InfAct partners engaged in a capacity building exercise where experts in rotating groups of three countries performed peer assessments of each other’s national HIS. Using a WHO Europe adapted and refined tool, assessors analysed the HIS of a country (data collection, processing, analysis, dissemination and use) and exchanged practices in an intensive 2-day schedule of interviews with established key stakeholders. Objectives The aim of the peer assessment is three-fold: to test the feasibility of a peer-review HIS assessment, to map heath information inequalities across EU MSs, and to strengthen the knowledge of HIS players. Results Two cycles are now complete and the feedback is overwhelmingly positive - from assessors and hosts alike. So far, the HIS assessment has been a major success in its ability to systematically and concisely analyse a HIS. It identifies gaps in the HIS through desk review and interviews, and provides a SWOT analysis and SMART recommendations to address these gaps. Additionally, this exercise has shown the ability to increase stakeholders’ awareness of their role in their national HIS, and to build new networks within and between MSs. The exercise is also perceived as an opportunity for cross-fertilisation of ideas and exploration of methodologies on how to address specific challenges. This will stimulate actions to improve national HISs, and will lead to the identification of good practices which can then be used by other EU countries. Conclusions By bringing together key HIS stakeholders from different countries and stimulating the improvement of HIS and the exchange of good practices, InfAct contributes to capacity building in the EU, which in turn may lead to the reduction of health information inequalities between countries.

As the amount of data being collected by service providers increases, privacy concerns increase for the data owners that must provide private data to get services. Legislative acts require enterprises protect the privacy of their customers and privacy policy frameworks such as P3P assist enterprises in demonstrating their privacy policies to customers (i.e. publishing privacy policy on websites). Unfortunately, defining these standards does not guarantee that the privacy policies are actually enforced since privacy is not central to conventional access control models. Furthermore, a privacy-preserving model should consider the privacy preferences of both data provider and data collector. This paper presents a Lattice-based Privacy Aware Access Control (LPAAC) Model. The key contribution is providing a privacy preserving model that enforces privacy policies and facilitates customization of privacy agreements and preferences of both data providers and organizations that collect data.