A Security Policy Model for Clinical Information Systems

A Security Policy Mo del for Clinical Information Systems Ross J Anderson University of Cambridge Computer Lab oratory Pembroke Street Cambridge CB QG rossandersonclcamacuk Abstract up a numb er of centralised applications that will use it One of them will centralise the billing of hospital The protection of personal health information has treatment in a single system that will pro cess large become a live issue in a number of countries including amounts of p ersonal health information and make the USA Canada Britain and Germany The debate various analyses available to administrators Do ctors has shown that there is widespread confusion about will remain resp onsible for the security of clinical in what should be protected and why Designers of mil formation which they originate yet the do ctors main itary and banking systems can refer to Bel lLaPadula professional organisation the British Medical Asso and ClarkWilson respectively but there is no com ciation BMA has b een refused information ab out parable security policy model that spel ls out clear and the security mechanisms that are supp osed to protect concise access rules for clinical information systems patient information on the new network and its appli In this article we present just such a model It cations was commissioned by doctors and is driven by medical It also b ecame clear that there was much confu ethics it is informed by the actual threats to privacy sion ab out the actual threats and ab out the protec and reects current best clinical practice Its eect tion measures that it would b e prudent to take For is to restrict both the number of users who can ac these reasons the BMA asked the author to study cess any record and the maximum number of records the threats to p ersonal health information And accessed by any user This entails control ling infor Andc and then to draw up a security p olicy mo del mation ows across rather than down and enforcing Anda and interim guidelines for prudent practice a strong notication property We discuss its rela Andb In this pap er we present the p olicy mo del tionship with existing security policy models and its The presentation is of necessity abbreviated and read possible use in other applications where information ers are urged to obtain a the full do cument from the exposure must be localised these range from private BMA or via the web Anda banking to the management of intel ligence data A note on terminology Intro duction We dene and discuss the terminology at length in the full p olicy so it is merely summarised here The intro duction of nationwide health information By clinician or clinical professional we mean a li networks has caused concern ab out security Do c censed professional such as a do ctor nurse pharma tors are worried that making health information more cist radiologist or dentist who has access in the line of widely available may endanger patient condentiality duty to p ersonal health information by this we mean In the USA there is controversy over a prop osed law any information concerning a p ersons health or treat on medical privacy Ben In Ontario an attempt ment that enables them to b e identied By patient to give the Minister of Health access to all medical we mean the patient or his representative who ever records was defeated after intense pressure by the pub must give consent and b e notied We ignore dele lic and the Ontario Medical Asso ciation Lan In gation of access to p ersons such as receptionists as a Germany there has b een disquiet ab out the intro duc clinician remains resp onsible for their actions tion of a uniform national smartcard system to handle For economy of expression we will assume that the health insurance payments clinician is female and the patient male The fem In the UK the government has commissioned a na inist versus grammarian issue is traditionally solved tionwide health information network and is setting in the crypto literature by assigning denite gender A numb er of exceptions to this rule have develop ed roles with the females b eing at least as high status over time For example Britain has rules on noti as the males Our choice is not meant to assert that able diseases adverse drug reactions nonaccidental the clinician has higher status than the patient in the injuries and tness to drive Boy However these therap eutic partnership b etween them exceptions are p eripheral as disclosures are rare and Finally some authors draw a distinction b etween are typically made on pap er condentiality which protects the interests of the organisation and privacy which protects the auton Threats to clinical condentiality omy of the individual We will rather follow the com Many organisations have replaced disp ersed manual mon medical usage in which b oth words interchange record keeping systems with centralised or networked ably mean privacy computer systems which give b etter access to data The ethical basis of condentiality Their exp erience is that the main new threat comes from abuse by insiders For example most of the big The Hipp o cratic oath says UK banks now let any teller access any account The eect is that private eyes get hold of information by Whatso ever I shall see or hear in the course bribing tellers and sell it for $ or so LB The of my dealings with men if it b e what should practice was made illegal by a recent amendment to not b e published abroad I will never divulge the Data Protection Act but there have still b een no holding such things to b e holy secrets prosecutions of which we are aware The eects of aggregating data should have b een Do ctors in most countries interpret the words exp ected The likeliho o d that information will b e im should not in terms of consent In Britain for exam prop erly disclosed dep ends on its value and the num ple the do ctors disciplinary b o dy is the General Med b er of p eople who have access to it Aggregation in ical Council which expresses the duty of condence as creases b oth these risk factors at the same time It follows GMC may also create a valuable resource which brings p olit ical pressure for legalised access by interests claiming Patients have a right to exp ect that you will a need to know Smu not pass on any p ersonal information which you learn in the course of your professional Health systems are no dierent At present privacy duties unless they agree dep ends on the fragmentation and scattering inherent in manual systems and standalone computers remov The GMC further stipulates that do ctors who ing this without intro ducing eective comp ensating record or who are the custo dians of condential infor controls is unethical There have b een p ersistent UK mation must make sure that it is eectively protected press rep orts of health records b eing sold by private against improp er disclosure when it is stored trans detectives for as little as $ LB RL Perhaps the most serious rep orted case is that of Dr Jackson mitted received and disp osed of GMC Other clini cians such as nurses pharmacists and physiotherapists a Merseyside sex stalker who wins the condence of are under similar professional obligations Finally a young women by discussing their family medical his tory over the telephone urges them to examine them numb er of countries have laws on data protection and from an EU directive on data protection will selves tries to arrange meetings and then attempts to comp el Europ ean countries to make patient consent ab duct them Police b elieve that he is a health worker the paramount principle in the protection of p ersonal or a computer hacker ISM health information The US exp erience is much worse This may b e partly due to the control exerted by HMOs and insur Consent must b e informed and voluntary For ex ample patients must b e made aware that information ance companies and partly b ecause networking has may b e shared b etween memb ers of a care team such advanced somewhat more than in Britain 1 as a general medical practice or hospital department a banker on a state health commission had access and if researchers want access to records which cannot to a list of all the patients in his state who had eectively b e made anonymous then every eort must b een diagnosed with cancer He crossreferenced b e made to inform the patient and gain his consent it with his client list and called in the patients which must b e renewed every ve years Som loans HRM 1 the UK general practitioner or GP is the primary care physician or family do ctor a Harris p oll on health information privacy showed that of resp ondents were worried AIDS suerers to assist in estimating the need for ab out medical record privacy and a quarter had lo cal community services is b eing resisted by the pro p ersonal exp erience of abuse GTP fession In addition the EU directive is ab out to enforce the Forty p ercent of insurers disclose medical infor principle of consent throughout Europ e So adminis mation to lenders employers or marketers with trators are scrambling to redene consent out customer p ermission CR and over half of The UK governments initial p osition was that a Americas largest companies admitted using patient gave implied consent to information sharing medical records to make hiring and other p erson by the mere act of seeking treatment More recently nel decisions Bru ocials have tried to redene informed consent as the consequence of putting up notices informing patients The problem was studied by the US governments that their p ersonal health information may b e shared Oce of Technology Assessment which conrmed

Load more