Search

This article addresses the privacy of medical and health data in the US. It analyzes the scope and requirements of federal and state laws in the US, and it discusses the weaknesses in the US protection of medical privacy. Then, this article explains how the weak US system of privacy protection was unable to handle many important privacy issues in the COVID-19 pandemic. Finally, the article concludes with some recommendations for action.

Healthcare data are arguably the most private of personal data. This very private information in the wrong hands can lead to identity theft, prescription fraud, insurance fraud, and an array of other crimes. Electronic-health systems such as My Health Record in Australia holds great promise in sharing medical data and improving healthcare quality. But, a key privacy issue in these systems is the misuse of healthcare data by “authorities.” The recent General Data Protection Regulation (GDPR) introduced in the EU aims to reduce personal-data misuse. But, there are no tools currently available to accurately reconcile a domestic E-health policy against the GDPR to identify discrepancies. Reconciling privacy policies is also non-trivial, because policies are often written in free text, making them subject to human interpretation. In this article, we propose a tool that allows the description of E-health privacy policies, represents them using formal constructs making the policies precise and explicit. Using this formal framework, our tool can automatically reconcile a domestic E-health policy against the GDPR to identify violations and omissions. We use our prototype to illustrate several critical flaws in Australia’s My Health Record policy, including a non-compliance with GDPR that allows healthcare providers to access medical records by default.

The obligation of physicians and other health professionals under Art. 240 § 1 of the Criminal Code instructs them to notify the law enforcement authority responsible for prosecuting crimes (in particular the Police or public prosecutor’s office) when prohibited acts are committed, attempted, or prepared. The list of such acts is enumerative, indicating the numbers of the relevant articles and paragraphs. On 13th July 2017 Art. 156 of the Criminal Code extended the list, adding grievous bodily harm as a prohibited act. Accordingly, this act introduced the legal obligation of denunciation, which outweighs medical privacy in such situations. As it can be difficult for a clinician to identify which injuries meet the criteria of grievous bodily harm, the authors of the paper have described in detail all of its forms with specific examples, since failure to comply with that obligation is punishable by up to three years of deprivation of liberty. Na lekarzach i innych pracownikach medycznych spoczywa obowiązek prawny wynikający z art. 240 § 1 Kodeksu karnego (k.k.), który nakazuje im zawiadomić organ powołany do ścigania przestępstw (tj. Policję lub prokuraturę) o dokonanym czynie zabronionym, jak również o jego karalnym przygotowywaniu lub usiłowaniu. Wykaz czynów podlegających takiej denuncjacji został podany enumeratywnie, ze wskazaniem numerów artykułów i paragrafów. Wyliczenie to zostało rozbudowane w wyniku nowelizacji k.k. dokonanej 13 lipca 2017 r. W jej wyniku do tego katalogu dodano art. 156 k.k., w którym spenalizowany jest ciężki uszczerbek na zdrowiu. Tym samym czyn ten został objęty prawnym obowiązkiem denuncjacji, który jest w takiej sytuacji ważniejszy niż tajemnica medyczna. Z uwagi na to, że dla lekarza klinicysty rozpoznanie, jakie obrażenia spełniają znamiona ciężkiego uszczerbku na zdrowiu, może być trudne, autorzy niniejszej pracy szczegółowo omówili wszystkie jego postaci z podaniem konkretnych przykładów, biorąc pod uwagę, że niewykonanie tej powinności jest zagrożone karą pobawienia wolności do lat 3.

In recent years, the Internet of Things (IoT) has gained increasing popularity due to the usage of Internet-enabled devices. However, Internet-enabled devices, also known as smart devices, share the information using an insecure channel, i.e., the Internet. Hence, the security and privacy of shared information remain the biggest concern. To ensure both security and privacy, many smart card based and biometric based schemes have been proposed for different Internet-based applications. Telecare Medical Information System (TMIS) is such an application which makes medical treatment easier by interacting with the patient and doctors. However, the transmission of the patient’s private information over an insecure channel is prone to several attacks. In order to protect the medical privacy of the patient and the reliability of the system, both the patient and medical server should be mutually authenticated. In this paper, we propose a three factor-based authentication scheme for health care system using IoT enabled devices (TFASH) that are secure and more efficient than other relevant schemes. We use Elliptic Curve Cryptography (ECC) for the scheme due to its smaller key size and high level of security. The session key security and the mutual authentication of the TFASH scheme have been proved using Real-Or-Random (ROR) model and Burrows–Abadi–Needham (BAN) logic. The simulation result of the proposed scheme shows that the scheme is safe under the OFMC and CLAtSe models. Moreover, compared to the existing schemes, the TFASH scheme provides better communicational and computational cost, which makes it suitable for practical use.

With the flourishing of ubiquitous healthcare and cloud computing technologies, medical primary diagnosis system, which forms a critical capability to link big data analysis technologies with medical knowledge, has shown great potential in improving the quality of healthcare services . However, it still faces many severe challenges on both users’ medical privacy and intellectual property of healthcare service providers, which deters the wide adoption of medical primary diagnosis system. In this paper, we propose an effi c ient and priv a cy-preserving m edical p rimary diagno s is framework (CAMPS). Within CAMPS framework, the precise diagnosis models are outsourced to the cloud server in an encrypted manner, and users can access accurate medical primary diagnosis service timely without divulging their medical data. Specifically, based on partially decryption and secure comparison techniques, a special fast secure two-party vector dominance scheme over ciphertext is proposed, with which CAMPS achieves privacy preservation of user’s query and the diagnosis result, as well as the confidentiality of diagnosis models in the outsourced cloud server. Through extensive analysis, we show that CAMPS can ensure that users’ medical data and healthcare service provider’s diagnosis model are kept confidential, and has significantly reduce computation and communication overhead . In addition, performance evaluations via implementing CAMPS demonstrate its effectiveness in term of the real environment.

Introduction. The development and application of medical robotics, medical robotic devices, automated technical systems in the field of health care are already quite successful and have great potential. Such large-scale technological changes inevitably actualize the social roles of law, that should properly settle, protect and guide the development of nascent social relations, which until recently occurred everywhere in a kind of regulatory vacuum. Material and methods. The methodological basis of the study included general scientific methods (dialectical, logical, systemic, historical, sociological, statistical) and private scientific methods of legal science (formal-legal, historical-legal and comparative-legal). The empirical basis of the study was Russian and foreign regulatory legal acts and law enforcement practice, as well as legal doctrine. Results. Based on the comparative legal study a legal definition of the medical robots and various options for their classification, among them a special one, including surgical robots, robots used in restorative medicine, rehabilitation of immobilized patients, nursing and care robots, have been developed. Cyborgs are biological organisms containing mechanical or electronic components are allocated to a special group. Legal mechanisms for ensuring security and cybersecurity in this area are highlighted. The necessity of more flexible legal regulation of personal data concerning the health of citizens and medical confidentiality under new technological conditions is justified. Discussion. Legal regulation of the medical robots should be of a staged nature. General norms of sectoral significance can be formulated at later stages. At the moment, it is more rational to direct efforts to determine the legal regime of certain types of created artificial intelligence systems in the healthcare sector. Conclusion. The legal concept of robotics in healthcare should take a significant place in a wide range of scientific studies of the development of new technologies for the benefit, not to the detriment, of a person.

A set of 20 short tandem repeats (STRs) is used by the United States criminal justice system to identify suspects, and to maintain a database of genetic profiles for individuals who have been previously convicted or arrested. Some of these STRs were identified in the 1990s, with a preference for markers in putative gene deserts to avoid forensic profiles revealing protected medical information. We revisit that assumption, investigating whether forensic genetic profiles reveal information about gene expression variation, or potential medical information. We find six significant correlations (FDR = 0.23) between the forensic STRs and the expression levels of neighboring genes in lymphoblastoid cell lines. We explore possible mechanisms for these associations, with evidence compatible with forensic STRs causing expression variation, or being in LD with a causal locus in three cases, and weaker or potentially spurious associations in the other three cases. Together, these results suggest that forensic genetic loci may reveal expression level and, perhaps, medical information.

Background: The secret of medicine or medical secrets is the right of the patient, this secret is a moral obligation based on the norms of decency originating from Hippocratic oaths, maintaining the secret of medicine is the duty of doctors to carry out their duties and practices. This provision is regulated in Article 48 of Law Number 29 of 2004 concerning Medical Practice, if this secret is leaked it can be held liable for violators. The purpose of this study was to solve legal issues and at the same time provide a prescription regarding the need for legal sources in the form of primary legal materials and secondary legal materials. Subjects and Method: This was a systematic review with normative juridical methods to solve legal issues. Results: Legal liability for medical secrets in health service facilities can be applied to the Criminal Code (KUHP). Disputes that occur regarding doctors or health personnel are resolved through professional organizations. Doctors through the Indonesian Doctors Discipline Honorary Council (MKDKI) but MKDKI did not have the authority to examine Criminal cases. Violations of medical secrets or job secrets, legal liability is not regulated or not based on legislation in force in the health sector, but the legal liability of violations of medical secrets comes from the general Criminal Code (KUHP). Conclusion: The secret of medicine is the autonomy right of patients. Maintaining the secret of medicine is the duty of doctors to health service facilities, the secret of medicine is not absolute and can be opened in certain circumstances, but this secret can be opened in accordance with the provisions of legislation. If the secret is leaked, violators can be asked for legal responsibility, especially Article 322 of the Criminal Code. Keywords : Medical Secrets, Criminal Legal Accountability, Health Services. Correspondence: Ridwan. Masters Program in Law, Universitas Sebelas Maret, Jl. Ir. Sutami No. 36 A, Surakarta, Central Java 57126. Email: ridwanozil16@yahoo.com. Mobile: +6281237553434 Journal of Health Policy and Management (2019), 4(1): 67-75 https://doi.org/10.26911/thejhpm.2019.04.01.08

5G networks have an efficient effect in energy consumption and provide a quality experience to many communication devices. Device-to-device communication is one of the key technologies of 5G networks. Internet of Things (IoT) applying 5G infrastructure changes the application scenario in many fields especially real-time communication between machines, data, and people. The 5G network has expanded rapidly around the world including in healthcare. Telemedicine provides long-distance medical communication and services. Patient can get help with ambulatory care or other medical services in remote areas. 5G and IoT will become important parts of next generation smart medical healthcare. Telemedicine is a technology of electronic message and telecommunication related to healthcare, which is implemented in public networks. Privacy issue of transmitted information in telemedicine is important because the information is sensitive and private. In this paper, 5G-based federated anonymous identity management for medical privacy protection is proposed, and it can provide a secure way to protect medical privacy. There are some properties below. (i) The proposed scheme provides federated identity management which can manage identity of devices in a hierarchical structure efficiently. (ii) Identity authentication will be achieved by mutual authentication. (iii) The proposed scheme provides session key to secure transmitted data which is related to privacy of patients. (iv) The proposed scheme provides anonymous identities for devices in order to reduce the possibility of leaking transmitted medical data and real information of device and its owner. (v) If one of devices transmit abnormal data, proposed scheme provides traceability for servers of medical institute. (vi) Proposed scheme provides signature for non-repudiation.

Blockchain technologies have been benefiting many industries by being decentralized, secure and confidential. They offer great potential in pandemic impacted scenarios as well. Contact tracing helps to mitigate the transmission of disease by alerting people who may have been exposed so they can act on time to protect themselves. Contact tracing systems face some challenges related to issues of medical privacy, data security and transparency. Multiple researches show concern that contact tracing discourages people to seek medication because of the fear of loss of data, subsequent stigma, discrimination, or abuse. In this paper, we discuss how contact tracing can be improved using blockchain technology and could be able to solve these issues. The aim of our proposed system would be to reduce the impact of pandemic, to implement this merger of the blockchains and the Contact tracing app and to ensure user privacy and avoid data misuse by incorporating a symmetric key cryptographic mechanism. To tackle the scalability related issues of Blockchain this framework uses IPFS, a distributed file storage system also known as Interplanetary File System. This blockchain based solution system will enhance contact tracing by making it more stable, secure, performant, highly useable and above all effective in the fight against any pandemic.

CiteSpace refers to a kind of citation visual analysis software developed on the basis of scientometrics and data virtualization. To explore the hot spot of social risk and regulation of international artificial intelligent (AI) in medical treatment, this paper retrieves the paper in 2000–2019 by taking the paper core set of Web of Science as the retrieval database and inputting keywords and then reflects the structure, rules and distribution of science and technology knowledge of the retrieved information, through visual means via CiteSpace. By analyzing data from such aspects as the number of publications and citations, ranking of publishing journals, clustering analysis of co-cited literatures and co-occurrence analysis of keywords, this paper brings the following discoveries: there are few research results related to “AI + social risk and regulation+medical”, EU's leading status in the study of AI ethnics and law, and the scholars' focus in recent years: 1. Some new issues of DNA sequencing technology in terms of laws and ethnics; 2. Personal information privacy at the medical data collection end and AI application end and medical privacy safety; 3. Decision-making of medical robot; 4. The standard application of AI in medical field; 5. Standardization of AI medical device; 6. Nanometer safety. Among all the issues above, the ethnic reorganization of doctor-patient relationship of AI-aided medical treatment triggers extensive concerns.

Background: Based on the patients’ and relatives’ views on the level of preservation of privacy rights of individuals, we propose a way to reduce problems and disagreements about the competence of the provider and recipient of bad news. Methods: In the current cross-sectional study, the participants were recruited from the main northwest hospital of Iran. It was also conducted to study the scope of medical privacy and competence of bearers or receivers of bad news. After the literature review, two questionnaires were designed and administered. They contained items pertinent to the scope of medical privacy and competence of bearers and receivers of bad news. Each item of the original questionnaire was scored on a 5-point Likert scale. Results: The model quality and significance level were obtained using KMO and Bartlett tests. The results (patient’s attitudes questionnaire: KMO=0729 and P

The 19th Workshop on Privacy in the Electronic Society (WPES 2020) was held as a virtual conference on 9 November, 2020, in conjunction with the 27th ACM Conference on Computer and Communication Security (CCS 2020). The goal of WPES is to bring together privacy researchers and practitioners to discuss the privacy problems that arise in an interconnected society and solutions to those problems. The program for the workshop contains 12 full papers and 3 short papers selected from a total of 34 submissions. Specific topics covered in the program include but are not limited to: communication privacy, data anonymization, differential privacy, medical privacy, mobile privacy, privacy engineering, privacy policies, user perception of privacy, and Web privacy.

With the rapid development of the mobile Internet and the increasing popularity of smart terminals, various mobile social applications are emerging. Medical data has become a valuable data asset and is being continuously explored and utilized, which has greatly promoted the improvement of the medical service level. However, publishing and using user data makes the user vulnerable to reasoning attacks. Due to the special nature of the medical field, medical data not only carries the health status of patients and medical process information but also involves individual sensitive information of a large number of patients. Allowing users to fully enjoy the advantages brought by social networks while ensuring security is an important issue that needs to be solved urgently in the era of big data. In this paper, we first provide an overview of social network data privacy risks and various types of attacks. Aiming at the privacy leakage of weighted social networks, we propose a privacy protection recommendation algorithm based on differential privacy. The algorithm utilizes the change of edge weight grouping, which greatly reduces the amount of calculation and satisfies the user's rapid response. It minimizes a privacy leak of user private data under data availability while supporting personalized rankings. Compared to the most advanced methods, this method protects users from reasoning attacks and reduces the distortion of ranking results caused by data confusion to ensure the accuracy of recommendations. Experiments on real-world datasets show that our framework can achieve more effective and lasting protection for user-sensitive data.

This chapter explores contemporary regulation of medical privacy in the United States and Europe and its challenges. The need for privacy is a fundamental human necessity. Privacy relates to human beings’ ability to maintain their dignity and avoid disclosure of information that might be deemed unpleasant. It is also associated with personal autonomy and informational self-determination. At the same time, however, some degree of data sharing is essential to the appropriate treatment of patients as well as to the proper functioning of society in general and the healthcare system in particular. Thus, privacy cannot be limitless. Hence, this chapter discusses regulatory strengths and shortcomings and highlights gaps in the law. It also suggests further safeguards that policy-makers should implement in order to protect patients and data subjects.

Legal and administrative documents are provided that include a form for consent to share medical information.

Objective Parents routinely access young children’s medical records, but medical societies strongly recommend confidential care during adolescence, and most medical centers restrict parental records access during the teen years. We sought to assess public opinion about adolescent medical privacy. Materials and Methods The Cornell National Social Survey (CNSS) is an annual nationwide public opinion survey. We added questions about a) whether parents should be able to see their 16-year-old child’s medical record, and b) whether teens would avoid discussing sensitive issues (sex, alcohol) with doctors if parents could see the record. Hypothesizing that highlighting the rationale for adolescent privacy would change opinions, we conducted an experiment by randomizing question order. Results Most respondents (83.0%) believed that an adolescent would be less likely to discuss sensitive issues with doctors with parental medical record access; responses did not differ by question order (P = .29). Most also believed that parents should have access to teens’ records, but support for parental access fell from 77% to 69% among those asked the teen withholding question first (P = .01). Conclusions Although medical societies recommend confidential care for adolescents, public opinion is largely in favor of parental access. A brief “nudge,” asking whether parental access might harm adolescent–doctor communication, increased acceptance of adolescent confidentiality, and could be part of a strategy to prepare parents for electronic patient portal policies that medical centers impose at the beginning of adolescence.

Objective Medical privacy policies, which are clear-cut for adults and young children, become ambiguous during adolescence. Yet medical organizations must establish unambiguous rules about patient and parental access to electronic patient portals. We conducted a national interview study to characterize the diversity in adolescent portal policies across a range of institutions and determine the factors influencing decisions about these policies. Methods Within a sampling framework that ensured diversity of geography and medical organization type, we used purposive and snowball sampling to identify key informants. Semi-structured interviews were conducted and analyzed with inductive thematic analysis, followed by a member check. Results We interviewed informants from 25 medical organizations. Policies established different degrees of adolescent access (from none to partial to complete), access ages (from 10 to 18 years), degrees of parental access, and types of information considered sensitive. Federal and state law did not dominate policy decisions. Other factors in the decision process were: technology capabilities; differing patient population needs; resources; community expectations; balance between information access and privacy; balance between promoting autonomy and promoting family shared decision-making; and tension between teen privacy and parental preferences. Some informants believed that clearer standards would simplify policy-making; others worried that standards could restrict high-quality polices. Conclusions In the absence of universally accepted standards, medical organizations typically undergo an arduous decision-making process to develop teen portal policies, weighing legal, economic, social, clinical, and technological factors. As a result, portal access policies are highly inconsistent across the United States and within individual states.

Traditional medical privacy data are at a serious risk of disclosure, and many related cases have occurred over the years. For example, personal medical privacy data can be easily leaked to insurance companies, which not only compromises the privacy of individuals, but also hinders the healthy development of the medical industry. With the continuous improvement of cloud computing and big data technologies, the Internet of Things technology has been rapidly developed. Radio frequency identification (RFID) is one of the core technologies of the Internet of Things. The application of the RFID system to the medical system can effectively solve this problem of medical privacy. RFID tags in the system can collect useful information and conduct data exchange and processing with a back-end server through the reader. The whole process of information interaction is mainly in the form of ciphertext. In the context of the Internet of Things, the paper presents a lightweight RFID medical privacy protection scheme. The scheme ensures security privacy of the collected data via secure authentication. The security analysis and evaluation of the scheme indicate that the protocol can effectively prevent the risk of medical privacy data being easily leaked.

Policy Points: Frequent data breaches in the US health care system undermine the privacy of millions of patients every year-a large number of which happen among business associates of the health care providers that continue to gain unprecedented access to patients' data as the US health care system becomes digitally integrated. Implementation of the HIPAA Omnibus Rules in 2013 has led to a significant decrease in the number of privacy breach incidents among business associates. Context Frequent data breaches in the US health care system undermine the privacy of millions of patients every year. A large number of such breaches happens among business associates of the health care providers that continue to gain unprecedented access to patients' data as the US health care system becomes digitally integrated. The Omnibus Rules of the Health Insurance Portability and Accountability Act (HIPAA), which were enacted in 2013, significantly increased the regulatory oversight and privacy protection requirements of business associates. The objective of this study is to empirically examine the effects of this shift in policy on the frequency of medical privacy breaches among business associates in the US health care system. The findings of this research shed light on how regulatory efforts can protect patients' privacy. Methods Using publicly available data on breach incidents between October 2009 and August 2017 as reported by the Office for Civil Rights (OCR), we conducted an interrupted time-series analysis and a difference-in-differences analysis to examine the immediate and long-term effects of implementation of HIPAA omnibus rules on the frequency of medical privacy breaches. Findings We show that implementation of the omnibus rules led to a significant reduction in the number of breaches among business associates and prevented 180 privacy breaches from happening, which could have affected nearly 18 million Americans. Conclusions Implementation of HIPAA omnibus rules may have been a successful federal policy in enhancing privacy protection efforts and reducing the number of breach incidents in the US health care system.

Multiple surveys show that patients want medical privacy; however, there are costs to maintaining privacy. There are also risks if information is not shared. A review of previous surveys found that most surveys asked questions about patient's privacy concerns and willingness to share their medical information. We found only one study that asked about sharing medical information for better care and no survey that asked patients about the risk, cost or comparison between medical privacy and privacy in other areas. To fill this gap, we designed a survey to: (1) compare medical privacy preferences to privacy preferences in other areas; (2) measure willingness to pay the cost of additional privacy measures; and (3) measure willingness to accept the risks of not sharing information.A total of 834 patients attending physician offices at 14 sites completed all or part of an anonymous questionnaire.Over 95% of patients were willing to share all their medical information with their treating physicians. There was no difference in willingness to share between primary care and specialty sites including psychiatry and an HIV clinic. In our survey, there was no difference in sharing preference between standard medical information and information with additional legal protections including genetic testing, drug/alcohol treatment and HIV results. Medical privacy was ranked lower than sharing social security and credit card numbers, but was deemed more private than other information including tax returns and handgun purchases. There was no statistical difference for any questions by site except for HIV/AIDS clinic patients ranking privacy of the medical record more important than reducing high medical costs and risk of medical errors (p .05). Most patients were willing to spend a modest amount of additional time for privacy, but few were willing to pay more for additional medical privacy. Most patients were unwilling to take on additional risks to keep medical information hidden.Patients were very willing to share medical information with their providers. They were able to see the importance of sharing medical information to provide the best possible care. They were unwilling to hide information from providers if there was increased medical risk. Patients were willing to spend additional time for privacy, but most were unwilling to spend extra money. Sixty-eight percent of patients favored reducing medical costs over privacy.