Search

Electronic Health Record System, EHRS, has recently become a common healthcare information technology that has been widely adopted by many physicians. Due to compromised internal structures and systems, safeguarding the privacy and security of EHRS becomes a very challenging issue based on the most recent studies on trends and characteristics of protected health information breaches in the United States. Traditionally intrusion detection systems were proposed to address security of EHRS infrastructure by detecting unauthorized accesses; they, however, tend to generate a large number of false alerts mainly due to lack of proper features to model normal behaviors and overfitting when using signature-based detection algorithms. In this paper we address this limitation and propose a mixture model combining both misuse detection and anomaly detection approaches to minimize the number of false alerts over a specific time period in real time through its self-learning-fixing-and-improving capability built upon the perceptron algorithm.

As smartphones and smartphone applications are widely used in a healthcare context (e.g., remote healthcare), these devices and applications may need to comply with the Health Insurance Portability and Accountability Act (HIPAA) of 1996. In other words, adequate safeguards to protect the user’s sensitive information (e.g., personally identifiable information and/or medical history) are required to be enforced on such devices and applications. In this study, we forensically focus on the potential of recovering residual data from Android medical applications, with the objective of providing an initial risk assessment of such applications. Our findings (e.g., documentation of the artifacts) also contribute to a better understanding of the types and location of evidential artifacts that can, potentially, be recovered from these applications in a digital forensic investigation.

The medical record is the work product of the healthcare team. The information contained in the medical record is comprised of patient complaints and recollections; medications and substance use history; data such as laboratory values, radiograph reports, and physical examination findings; and impressions and judgment. In order for patients to discuss their health issues frankly and honestly with healthcare professionals, there must be a sense of confidentiality and trust. In the past, handwritten medical charts could be lost or photocopied, but such breaches were limited in scope. The electronic medical record (EMR) created a cyberdocument that was ethereal that allowed for multiuser access, and which was portable; however, as with all electronic data, the EMR was subject to inadvertent large-scale dissemination and large-scale “hacking” access. In order to leverage the opportunities of the EMR and to best utilize the EMR for electronic data interchange and analysis, the passage of security laws was necessary. Laws and regulations regarding the privacy of medical information include not only HIPAA and HITECH but also state privacy laws and disciplinary rules and regulations. The scope and impact of such privacy rules and regulations on healthcare continue to evolve.

Security concerns on data transfer and data transactions arise when the Internet of Things (IoT) devices and other automatic health monitoring apps rise in popularity. Therefore, this chapter aims to develop a Protected Health Information (PHI), using blockchain-based smart contracts to assist safe data analysis, data sharing, data transfer, and data management to handle the secured health information of the smart telerehabilitation app. The app called Autism Telerehabilitation App (ATA) uses a private blockchain based on the Ethereum protocol to write history and records of all the electronic health records (EHRs) of patients from the smart device. Furthermore, this ATA would provide medical interventions and real-time patient observing by sending alerts to the patient and medical specialists. Besides, it can secure and maintain the record of who has initiated these activities. This proposed blockchain with ATA offers high data security taken and undertakes many safety susceptibilities related with patient notifications and patient monitoring to all involved parties.

Concerns of privacy are replete in dermatology, where digital imaging has become ubiquitous. This article explores the legal duties and privacy concerns that are incumbent upon health-care providers, particularly with the identification, use, storage, and submission of digital images.

The electronic health record (EHR) represents the evolution and convergence of technology and administration of medicine. Its advent has significantly changed the landscape in which medical policy and process can be created. As vast amounts of data are gathered in the management of care and administration of health systems, these clinical big data provide opportunities to enhance public health practice. This work delineates core functionalities and primary and secondary uses of EHRs that are aligned with these practices, including uses of EHRs for healthcare, public health, and population health outcomes. From EHRs origins as simple billing and accounting systems, to its adoption as, and progression toward, full-fledged interactive records, the medical, public health, and governmental stakeholders have at times been at odds to ensure their concerns and requirements are adequately represented in implementations. Legislation to promote the adoption of EHRs capable of recording and reporting health data in a standardized, structured, and secure format, and technologies to facilitate the progress towards the goals of EHRs, such as achieving portability, have had varying results. Various milestones to EHR goals are discussed, with respect to legislation, regulation, policies, and the importance of standards and technologies. This work examines some lessons learned from EHR developments and implementations, which also exposes limitations, disparities, and unintended consequences of EHR adoption and progression globally. It concludes with forward looking perspectives on EHRs, a crucial cornerstone of public health informatics and information systems.

The security challenges faced by public health systems have some commonalities with all systems, but also some unique issues. The large amounts of sensitive data collected by public health, combined with the importance of public health to the well-being of the population, make security a crucial issue. US Homeland Security has categorized Healthcare and the Public Health Sector as one of the 16 critical infrastructure sectors.

Clinical Named Entity Recognition for identifying sensitive information in clinical text, also known as Clinical De-identification, has long been critical task in medical intelligence. It aims at identifying various types of protected health information (PHI) from clinical text and then replace them with special tokens. Along with the development of deep learning technology, lots of neural-network-based methods have been proposed to deal with Named Entity Recognition. As one of the state-of-the-art methods to address this problem, Bi-LSTM-CRF has become the mainstream due to its simplicity and efficiency. In order to better represent the entity-related information expressed in the context of clinical text, we design a novel Capsule-LSTM network that is able to combine the great expressivity of capsule network with the sequential modeling capability of LSTM network. Experiments on 2014 i2b2 dataset show that the proposed method outperforms the baseline and thus reveal the effectiveness of the newly proposed Capsule-LSTM network.

Mobile applications are quickly replacing traditional desktop computing for gaming, social media, email, web browsing, health and fitness, business usage, etc. Many of these mobile apps require that sensitive information (protected health information (PHI) and personally identifiable information (PII)) be displayed, accessed, modified, and stored. In the healthcare domain, there is a need for health information exchange (HIE) among patients and medical providers across a wide range of health information technology (HIT) systems such as electronic health records, e-prescribing, etc., all of which involve highly-sensitive data (PII and PHI) that is exchanged back and forth between the mobile application and its server-side repository/database. In the U.S. in 2015, the Office of the National Coordinator issued a report on certification rules for EHRs that has required that HIT vendors develop RESTful APIs for EHRs and other systems so that patients and medical providers using mobile health (mHealth) applications via the cloud can easily access their healthcare data from multiple sources. This necessitates the consideration that access control mechanisms are candidates to protect highly-sensitive data of such applications via the control of who can call which service. The paper presents the attainment of role-based (RBAC), mandatory (MAC), and discretionary (DAC) access control for RESTful API and cloud services via an Intercepting API Calls approach that is able to define and enforce users of mobile apps to limit the API/cloud services that can be invoked depending on a user’s permissions. The presented Intercepting API Calls approach is demonstrated via an existing mHealth application.

Scientists conduct genetic research to find ways to prevent and to cure diseases caused by genetic predispositions. It is critically important that the research be conducted in a way that protects the privacy of the participants. The main way to achieve that goal is to take steps to ensure that no one discloses confidential genetic information. That task is made more difficult by the fact that researchers are turning to electronic databases to keep up with the massive amount of information they have to decipher. Privacy laws were put in place at a time when most medical information was kept on paper. In fact, numerous health care providers still keep their medical records in paper form. Unfortunately, privacy laws have not kept pace with the ingenuity of persons seeking to steal sensitive health information. Genetic privacy is crucial because if a person’s genetic information ends up in the wrong hands he or she may be the subject of genetic discrimination. Most genetic discrimination occurs in health and employment settings, the two places were persons are the most vulnerable. Congress has enacted statutes to protect people from being discriminated against because of their genetic predispositions. Nonetheless, the laws contain loopholes and weak enforcement mechanisms. In a profit-driven world, it is not surprising that there is now a market for genetic information and genetic materials. The law makes it clear that a person cannot sell a kidney or a liver; however, that person can sell blood or sperm. It is too early to tell whether genetic material will be treated like the former or the latter. But, we do know that as long as private companies are involved in genetic research commercialization will continue to occur.

De-identification in electronic health records is a prerequisite to distribute medical records for further clinical data processing or mining. In this paper, we introduce a framework based on recurrent neural network to solve the de-identification problem, and compare state-of-the-art methods with our framework. It is integrated, which includes records skeleton generation, chunk representation and protected information labeling. We evaluate our framework on three datasets involving two English datasets from i2b2 de-identification challenge and a Chinese dataset we created. To the best of our knowledge, we are the first to apply RNN model to the Chinese de-identification problem. The experimental results indicate that our framework not only achieves high performance but also has strong generalization ability.

Consent, at its heart, is a process—an exchange of information capped by subject agreement. The form is not the consent (Lidz et al. 1988; Davis and Hurley 2014, p. 18). Nonetheless, IRBs pragmatically use the consent form as the primary tool to determine how subjects will be informed about a study. Consent honors subjects’ right to choose and promotes their best interests as they define them.

The practice of pediatric oncology presents health-care professionals, patients, and family members with ethical tensions that should provoke discussion and reflection among these various moral stakeholders. For example, medical decision-making has experienced a paradigm shift from the practice of medicine dominated by paternalism to one that champions autonomy. With this shift, the practice of informed consent has become an integral part of oncology practice, yet we lack consensus about what it means to be informed and about how to optimize the roles of children and adolescents in decision-making. In addition, pediatric oncology has achieved dramatic improvement in outcomes due to research on child subjects. Yet the history of research involving children contains numerous examples of practices that exploited and sometimes harmed children who must therefore be considered a vulnerable population of potential research subjects. Also, the care of children with cancer may create a need to provide ethically sound care at the end of life. Despite legal precedent to guide many of our practices in this setting, decisions arising at the end of life continue to present ethical quandaries.

The vision of creating a more comprehensive understanding of human health and disease calls for collecting ever-greater volumes of information about individuals, in continuous, real-time streams, and from sources outside of the clinic. Such data is heterogenous and high-dimensional, requiring the use of big data analytics. Big data has been granted considerable perceived authority to solve problems in healthcare and biomedicine. At the same time, there is potential for tremendous impact on social and political life more broadly. For this reason, it is important to elucidate less-visible ethical issues related to the infrastructures being built to support big data projects in biomedical science and clinical medicine. The constellation of changes in laws, institutional arrangements, and new forms of expertise being brought together are reordering relations among patients, clinical and family caregivers, researchers and payers, with potentially long-term effects. For example, conventional concepts of autonomy are challenged when data is collected ubiquitously and passively, and notions of expertise are provoked when ‘non-medical’ experts (including patients themselves) participate more directly in processes of defining health, illness, and care. In the process, the distinction between research and clinical activities (which have been conceptually kept apart for decades) becomes blurred, and the definition of ‘research subject’ is confounded.

Health Information Exchanges (HIEs) constitute a powerful mechanism for sharing Electronic Health Records (EHRs) across organizational boundaries in healthcare systems. The electronic sphere of patient data is growing but some patients and medical providers remain hesitant to adopt networked information technology due to privacy and security concerns. The U.S. Government has recognized the importance of safeguarding and preserving the privacy of patient data in HIEs, establishing and endorsing privacy standards and information sharing guidelines. This chapter explores the issues and principles shaping HIE privacy solutions, and discusses emerging trends that will influence the design and implementation of privacy-preserving technologies for HIEs.

This chapter presents key issues and techniques for preserving privacy of neuroimage datasets. Neuroimages pose unique challenges to medical privacy and image datasets. In addition to PII commonly found in medical image meta data, the data in a neuroimage itself may contain distinctive facial features that permit the identification of a subject. The chapter begins with a discussion of the identifying properties of neuroimage data, along with established processes and popular tools for storage, analysis and processing. Next, privacy risks and hazards of neuroimages are explored, including those posed by meta data and data alike. Volume rendering and facial reconstruction provide platforms for re-identification of sanitized neuroimage data. Tools for scrubbing meta data and for defacing neuroimage data are essential components to neuroimage archive and repository workflow pipelines.

We’ve repeatedly emphasized that successful management of chronic diseases in our highly specialized and fragmented healthcare system requires digital data that can be shared to coordinate care. However, patient-specific healthcare data is highly sensitive and is protected by HIPAA which calls for severe penalties for failures to properly secure so-called protected health information (PHI).

Preparing narrative medical records for use outside of their originating institutions requires that protected health information (PHI) be removed from the records. If researchers intend to use these records for natural language processing, then preparing the medical documents requires two steps: (1) identifying the PHI and (2) replacing the PHI with realistic surrogates. In this chapter we discuss the challenges associated with generating these realistic surrogates and describe the algorithms we used to prepare the 2014 i2b2/UTHealth shared task corpus for distribution and use in a natural language processing task focused on de-identification.

This chapter addresses important issues related to the process and content of informed consent when providing services via clinical videoconferencing (CV). Relevant differences between in-person services and CV services are highlighted for modifying the informed consent form (ICF) and process. ICF modifications are also considered regarding the various settings and contexts within CV services. The chapter also highlights helpful ground rules for communication in CV contexts.

There is great potential for volunteered geographic information (VGI) to augment data used for public health disease surveillance, in areas such as mass gatherings and qualitative GIS. The goal of this chapter is to explore these important issues of patient privacy, ethics, and liability, as they pertain to the use of VGI to augment health information exchanges (HIEs) in providing data for public health research programs. The current attention on health reform and HIEs provide professional geographers with an excellent opportunity to explore the contributions of VGI to this field. The chapter begins by briefly describing the legislation of patient privacy and protection in the United States, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the American Recovery and Reinvestment Act of 2009. It also discuss the appropriate and inappropriate disclosures of protected health information (PHI). Next, it examines the ethical and legal issues surrounding the use of VGI in disease surveillance. Finally, the chapter will demonstrate that VGI yields tremendous value in providing sensitive and timely surveillance data when reliable and consistent communications between health care providers and regional health authorities are not possible.

The phrase case manager has been defined many ways since the enactment of the Health Maintenance Organization Act of 1973 (http://www.ncbi.nlm.nih.gov/pubmed/803289). Case managers initially served as resource managers, discharge planners, and utilization managers. Roles now include care coordinators, patient navigators, and transitional care managers. Practice settings can vary widely as well as the education and professional experiences of individual case managers, however essential skills are carried across roles. Founded in 1990, the Case Management Society of America (CMSA) is the leading non-profit association dedicated to the support and development of case management. The CMSA developed Standards of Practice that provides a foundation for case managers (http://www.cmsa.org/portals/0/pdf/memberonly/StandardsOfPractice.pdf). The standards were first published in 1995 and revised in 2002 and 2010. Case managers have come a long way over the years in gaining recognition for their endeavors and the role is expected to grow as the Affordable Care Act is fully implemented.

This chapter explores the legal and ethical challenges one faces by providing behavioral health in a medical setting. The information presented is based on findings from ongoing research and analysis of current literature in addition to discussions with leaders in the field, communications with lawyers and administrators of advocacy and government agencies pertaining to integrated primary care (IPC). The authors propose standards of care that are established based on a myriad of factors, including professional codes of ethics, case law, state and federal laws, professional standards, existing best practices, current professional guidelines, administrative rules and regulations, and licensing board regulations. Regulations may differ for behavioral health and medical providers, posing challenges in IPC settings. This chapter provides a review of these regulations, particularly 42CFR Part 2, a federal law governing confidentiality for substance abuse programs, Health Insurance Portability and Accountability Act (HIPAA), and state laws relevant to patient care in IPC settings as they apply to common ethical issues that arise in an IPC setting. The authors present ethical quandaries through case studies to illustrate decision points and make recommendations related to patient care practices concerning informed consent and release of information procedures, and treatment protocols. These considerations are in light of existing practices and laws that lag behind the tenants of integration. The authors advocate for policy changes to be more compatible with collaboration in the primary care setting.

Healthcare information systems needs to share and to reuse the patient’s information not only in a department where the information is being formed, but also between the departments of an organization and also among the different organizations. The requirements of health services like providing efficient services and ensuring continuity causes privatization of information. As patient health information is dispersed and specialized, sharing personal health information became more prevalent. A blood test ontology in a clinical information system could help physicians to learn more about the patient’s health status. Hence, patient’s medical history is widely recognized as a good indicator for the patient’s treatment plan. In this work, a methodology is proposed to infer the opportunities of using blood test with the help of semantic web knowledge representation. In order to provide a personalized, manageable and privacy protected system, user profiles are fully integrated with blood test ontology and consent management model.