Abstract
The HIPAA regulations will require that institutions ensure the prevention of unauthorized access to electronically stored or transmitted patient records. This paper discusses a process for analyzing the impact of security mechanisms on users of computerized patient records through "behind the scenes" electronic access audits. In this way, those impacts can be assessed and refined to an acceptable standard prior to implementation. Through an iterative process of design and evaluation, we develop security algorithms that will protect electronic health information from improper access, alteration or loss, while minimally affecting the flow of work of the user population as a whole.
Full text
PDF




Selected References
These references are in PubMed. This may not be the complete list of references from this article.
- Appelbaum P. S. Threats to the confidentiality of medical records--no place to hide. JAMA. 2000 Feb 9;283(6):795–797. doi: 10.1001/jama.283.6.795. [DOI] [PubMed] [Google Scholar]
- Asaro P. V., Herting R. L., Jr, Roth A. C., Barnes M. R. Effective audit trails--a taxonomy for determination of information requirements. Proc AMIA Symp. 1999:663–665. [PMC free article] [PubMed] [Google Scholar]
- Barrows R. C., Jr, Clayton P. D. Privacy, confidentiality, and electronic medical records. J Am Med Inform Assoc. 1996 Mar-Apr;3(2):139–148. doi: 10.1136/jamia.1996.96236282. [DOI] [PMC free article] [PubMed] [Google Scholar]
- Bowen J. W., Klimczak J. C., Ruiz M., Barnes M. Design of access control methods for protecting the confidentiality of patient information in networked systems. Proc AMIA Annu Fall Symp. 1997:46–50. [PMC free article] [PubMed] [Google Scholar]
- Brannigan V. M. A framework for "Need to Know" authorizations in medical computer systems: responding to the constitutional requirements. Proc Annu Symp Comput Appl Med Care. 1994:392–396. [PMC free article] [PubMed] [Google Scholar]
- Buckovich S. A., Rippen H. E., Rozen M. J. Driving toward guiding principles: a goal for privacy, confidentiality, and security of health information. J Am Med Inform Assoc. 1999 Mar-Apr;6(2):122–133. doi: 10.1136/jamia.1999.0060122. [DOI] [PMC free article] [PubMed] [Google Scholar]
- Chilton L., Berger J. E., Melinkovich P., Nelson R., Rappo P. D., Stoddard J., Swanson J., Vanchiere C., Lustig J., Gotlieb E. M. American Academy of Pediatrics. Pediatric Practice Action Group and Task Force on Medical Informatics. Privacy protection and health information: patient rights and pediatrician responsibilities. Pediatrics. 1999 Oct;104(4 Pt 1):973–977. [PubMed] [Google Scholar]
- Dargahi R., Classen D. W., Bobroff R. B., Petermann C. A., Moreau D. R., Beck J. R., Buffone G. J. The development of a data security model for the Collaborative Social and Medical Services System. Proc Annu Symp Comput Appl Med Care. 1994:349–353. [PMC free article] [PubMed] [Google Scholar]
- Gritzalis D. A. Enhancing security and improving interoperability in healthcare information systems. Med Inform (Lond) 1998 Oct-Dec;23(4):309–323. doi: 10.3109/14639239809025367. [DOI] [PubMed] [Google Scholar]
- Halamka J. D., Safran C. Virtual consolidation of Boston's Beth Israel and New England Deaconess Hospitals via the World Wide Web. Proc AMIA Annu Fall Symp. 1997:349–353. [PMC free article] [PubMed] [Google Scholar]
- Herting R. L., Jr, Asaro P. V., Roth A. C., Barnes M. R. Using external data sources to improve audit trail analysis. Proc AMIA Symp. 1999:795–799. [PMC free article] [PubMed] [Google Scholar]
- Hodge J. G., Jr, Gostin L. O., Jacobson P. D. Legal issues concerning electronic health information: privacy, quality, and liability. JAMA. 1999 Oct 20;282(15):1466–1471. doi: 10.1001/jama.282.15.1466. [DOI] [PubMed] [Google Scholar]
- Hripcsak G., Cimino J. J., Sengupta S. WebCIS: large scale deployment of a Web-based clinical information system. Proc AMIA Symp. 1999:804–808. [PMC free article] [PubMed] [Google Scholar]
- Masys D. R., Baker D. B. Patient-Centered Access to Secure Systems Online (PCASSO): a secure approach to clinical data access via the World Wide Web. Proc AMIA Annu Fall Symp. 1997:340–343. [PMC free article] [PubMed] [Google Scholar]
- Myers D. L., Culp K. S., Miller R. S. Use of a Web-based process model to implement security and data protection as an integral component of clinical information management. Proc AMIA Symp. 1999:897–900. [PMC free article] [PubMed] [Google Scholar]
- Wang J. Z., Wiederhold G. System for efficient and secure distribution of medical images on the Internet. Proc AMIA Symp. 1998:907–911. [PMC free article] [PubMed] [Google Scholar]