Search

The facilitation of sharing and exchanging patients' health records is a paramount opportunity in e-health, enabling healthcare providers to garner a comprehensive and clear perspective of patients' medical histories without necessitating direct inquiries. Besides this great advantage, it introduces substantial issues on security and privacy, mainly related to unauthorized access to e-health records when different healthcare service providers maintain records. In this paper, we deal with this problem and propose using the blockchain technology (1) to obfuscate the linkage between patients' identities and their e-health records and (2) to grant access to e-health records exclusively to entities authorized by patients themselves. Key outcomes include using a digital identity based on the Electronic Identification, Authentication, and Trust Services Regulation (eIDAS) to control access to these records, and a concrete implementation by adopting the Ethereum blockchain. Our solution relies on using a public blockchain, which is an improvement for the state of the art, in which only private or consortium blockchains have been proposed. The resulting solution has been analyzed, and the effectiveness and affordability of the proposal have been shown. [ABSTRACT FROM AUTHOR]

As with any other sector, the healthcare industry is also prone to cyber threats. Though the nature of threats is similar to any other industries, it does need to address sector-specifics risks along with security risks in its operating environments. Every day the Hospitals need to ensure that the information is adequately secured. Currently Chief Information Officer (CIOs) and Chief Information Security Officer (CISOs) are trying to protect their hospital Information Systems (IS) departments from security threats. It's imperative to take necessary measures to ensure risk management and business continuity. The paper addresses some of the challenges faced by healthcare organizations in the selection of a cyber-security framework by reviewing some of the common standards and frameworks that are used by healthcare organizations. The also paper highlights the advantages and disadvantages of each of the standards as: international organization for standardization (ISO)/IEC 27799, Health Insurance Portability and Accountability Act (HIPAA), HITRUST, Nation Institute of Standards and Technology (NIST) has developed the Cyber Security Framework (CSF) and General Data Protection Regulation (GDPR) and compare and the additional directives provided by this standards. [ABSTRACT FROM AUTHOR]

Background The health information system provides an integrated platform and an information connection between the actors of the health system regardless of temporal and spatial limitations. Objective This study aims to investigate the factors affecting the development of electronic health record (EHR) system and predict the future of this system in Iran. Methods In this descriptive study, identification of the main factors for the development of HER and designing the future scenarios of this system was done using a questionnaire completed by 33 managers and experts of information technology in hospitals and medical universities in Guilan and Qazvin provinces of Iran. Data were analyzed in SPSS v. 22 and Expert Choice v. 11 applications. Results Three dimensions and six criteria were determined to explain the HER development. Dimensions included: information content, information architecture, and information security. The criteria were: Manpower, hardware and software infrastructure, speed of access to health services, operating costs, not dependent on the internet, and comprehensiveness. Moreover, eight scaled scenarios were determined for the future of the EHR system. Conclusion It is necessary to pay attention to information content, architecture, and security in development of the HER system in Iran. [ABSTRACT FROM AUTHOR]

Despite the numerous and noticeable inherited gains of Mobile Cloud Computing (MCC) in healthcare, its growth is being hindered by privacy and security challenges. Such issues require the utmost urgent attention to realize its full scale and efficient usage. There is a need to secure Health Information worldwide, regionally, and locally. To fully avail of the health services, it is crucial to put in place the demanded security practices for the prevention of security breaches and vulnerabilities. Hence, this research is deliberated on to provide requirement-oriented health information security using the Modular Encryption Standard (MES) based on the layered modeling of the security measures. The performance analysis shows that the proposed work excels, compared to other commonly used algorithms against the health information security at the MCC environment in terms of better performance and auxiliary qualitative security ensuring measures.

Background: Health information governance (IG) in Australian hospitals was hitherto unexplored. Objectives: To determine hospitals' health IG status and maturity in Victoria, Australia, identify drivers and barriers affecting IG adoption, examine electronic health data breach response plan usage and assess employees' electronic data breach awareness. Method: Mixed-methods descriptive study utilising an online survey of directors – clinical/health information services and chief health information managers (HIMs) in Victorian hospitals, ≥50 beds. Results: Response rate: 42.9% (n = 36). Fifty percent (n = 17) of respondent-hospitals had an IG program. IG equally supported decision-making and risk identification and prevention. The greatest potential organisational damages from system disruption or failure were information loss (66.7%) and clinical risks (63.9%). HIMs in 15 (55.6%) hospitals had knowledge to monitor and detect electronic data breaches. Staff in 19 (70.4%) hospitals knew who to inform about a suspected breach. Most hospitals had mature health information-related IG practices, most (88.9%, n = 24) provided IG-related education, 77.8% (n = 21) regularly reviewed data breach response plans. The strongest IG drivers were privacy-security compliance and changes to data capture or documentation practices (82.8%, n = 24); the greatest barriers were implementation complexity (57.1%, n = 16) and cost (55.6%, n = 15). Conclusion: These baseline Australian data show 50% of respondent-hospitals had no formal health IG program. Privacy-security compliance, and audits, needed improvement; however, most hospitals had well-developed medical record/health information IG-relevant schedules, policies and practices. HIMs, the professionals most engaged in IG, required upskilling in electronic data breach detection. [ABSTRACT FROM AUTHOR]

Regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), establish standards to protect patients' medical records from security breaches. Insiders' prosocial misbehaviour within healthcare organisations can cause significant damage to relevant stakeholders. Such behaviour without malicious intention needs to be better understood and carefully managed from the perspective of prosocial behaviour. For this study, a research model was developed that includes the factors influencing student nurses' intention to disclose patient health information. The model was empirically tested with nursing students in South Korea with a scenario‐based experiment. We find that both altruistic (impact on others) and egoistic (impact on the self) motivations are significantly important in raising situational empathy. On the other hand, an egoistic motivation (impact on the self) significantly affects people's perception of their responsibility, which mediates the relationship between situational empathy and prosocial intention to disclose. The implications of our findings are discussed. [ABSTRACT FROM AUTHOR]

Cybercriminals have begun to target the healthcare industry with ransomware, malware that encrypts an infected device and any attached devices or network drives. After encryption, cybercriminals demand a ransom before releasing the devices from encoding. Without adequate disaster recovery and backup plans, many businesses are forced to pay the ransom. We examined the extent of recent ransomware infections in healthcare settings, the risk liabilities and costs associated with such infections, and possible risk mitigation tactics. The methodology of this study was a literature review. The review was limited to sources published in English from 2005 to 2017. Of the 118 sources found, 74 were used in the results section. We also performed two semistructured interviews, one with an expert in health care law and the other with a chief information officer from a local teaching hospital who was an expert in healthcare information technology. Financial costs associated with business recovery after ransomware attacks on healthcare facilities are significant and are growing in both magnitude and scope. Other risks are a loss of future business and reputation damage. Research has suggested that the best plan of action is to have a proper business continuity and disaster plan with adequate data backups and to be vigilant in educating employees about the sources of ransomware to prevent potential attacks. [ABSTRACT FROM AUTHOR]

The healthcare industry has increasingly been targeted by cybercrime putting patients, organizations, and employees at risk for financial loss and breach of privacy. Malware events compromise system integrity and patient privacy which could lead to delays in treatment, loss of patient data, inability to provide care, and increase in patient harm. In addition, these attacks may also compromise private and personal information for those targeted. Nurses represent a large portion of frontline healthcare workers and are uniquely positioned to help prevent cyber-attacks. Nursing curriculum should include education about the risks to patient safety from cybercrime and the nurse's role in preventing cybercrime. Nursing education has focused on hygiene for patient safety. Adding cyber hygiene to the essential practices of pre-licensure and advanced practice nurses is a first step to protecting patients, organizations, and employees from the repercussions of a healthcare cyber-attack. [ABSTRACT FROM AUTHOR]

• We proposed a framework for securely sharing healthcare consumer information with healthcare team in social networks. • Our proposed protocol is resistant to security attacks. • The proposed framework enables healthcare consumers to control every data access and modifications after data sharing. Healthcare consumers should have control over their shared health data in social networks and cloud-based systems through specifying their data protection policies, and preventing unauthorized data access and modifications. This consumer-centered approach requires a completely secure framework and protocol that enables consumers to easily revoke users and have control over their data after data sharing. We aimed to develop a security framework that enables consumers to securely share data with the healthcare team, revoke users, and control their data after sharing, considering a complete authenticity between all parties involved in data sharing. Using the ElGamal and the ciphertext-policy attribute-based encryption (CP-ABE) algorithms, we developed a hardware-independent, role-based, and data type-based framework. We evaluated our framework in terms of "Secret x ", "Alive", "Niagree, "WeakAgree" and "Nisynch" security claims. We also evaluated the secrecy of the suggested protocol by using an automated security verification tool (ProVerif). We evaluated the scalability of our solution to measure the maximum workload that it can tolerate. We also evaluated our framework in terms of the required time and volume of data to encrypt and access the data. The security evaluation showed that our framework for the four roles of consumer, physician, cloud server, and proxy server are secure against the security claims. ProVerif simulation results indicated that the suggested protocol was safe for consumers' private information. Our resource utilization experiment showed that on average for 1617.1015 KB of input data, 10.282 seconds were needed. In addition, on average for 1617.0742 KB of data consumed, 0.797 s were required. The scalability test showed that the proxy server could respond to 2885 concurrent requests in 60 s and the cloud server could respond to 777 concurrent requests in 60 seconds. In comparison with the state-of-the-art approaches, the evaluations demonstrate that our framework provides more features such as flexible access control after data sharing and is also more efficient in terms of the computational cost of user revocation. [ABSTRACT FROM AUTHOR]

Objective: Healthcare professionals are known to use their personal devices extensively for work purposes (Bring-Your-Own-Device). However, it is also a source of major concern for healthcare organisations, given the heavy reliance of patient data privacy on clinician's usage behaviour and higher risk of data breaches. Previous research into hospital BYOD security has been scarce and fragmented. Therefore, the aim of this paper is to understand the preferences, behaviour, and knowledge of Australian hospital clinical staff with respect to BYOD security through a survey.Method: An online survey was conducted among clinicians working in Australian hospitals, asking them about their BYOD related user behaviour, knowledge of best practices, and support received from their hospitals. Descriptive statistical analysis and cross tabulation were carried out on the survey data.Results: Majority of the surveyed clinicians used BYOD (87%). Some of the good behavioural practices found included use of passcode: (91.95%), never disclosing password (67.82%); strong passwords (63.22%) and no storage of patient data (59.77%) on BYOD devices. However, several risky practices were also found, particularly when usability or clinical workflow mattered to clinicians including use of personal/social apps for clinical communication (e.g. SMS: 57.47%, WhatsApp: 39.08%); connecting BYOD devices containing patient data to public hotspots (40.23%) and use of a common data backup platform for personal and patient data (79.93%). A large proportion of surveyed clinicians were either unaware or didn't receive BYOD related security training (74.71%) or policy (39.08%), but those who did were more confident across all aspects of BYOD security asked in the survey, indicating their importance.Conclusion: By taking a wholistic and socio-technical view, this study helps us to better understand BYOD related security behaviour of hospital-based clinicians and its consequential implications. It can therefore provide important insights for both technical and clinical stakeholders of BYOD within hospitals. [ABSTRACT FROM AUTHOR]