• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.1
• /
• pp.437-454
• /
• 2020

According to the privacy regulations of the health insurance portability and accountability act (HIPAA), patients' control over electronic health data is one of the major concern issues. Currently, remote access authorization is considered as the best solution to guarantee the patients' control over their health data. In this paper, a new biometric-based key management scheme is proposed to facilitate remote access authorization anytime and anywhere. First, patients and doctors can use their biometric information to verify the authenticity of communication partners through real-time video communication technology. Second, a safety channel is provided in delivering their access authorization and secret data between patient and doctor. In the designed scheme, the user's public key is authenticated by the corresponding biometric information without the help of public key infrastructure (PKI). Therefore, our proposed scheme does not have the costs of certificate storage, certificate delivery, and certificate revocation. In addition, the implementation time of our proposed system can be significantly reduced.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.13 no.6
• /
• pp.66-76
• /
• 2017

In this study, we investigated how to protect personal healthcare information when constructing OMOP (Observational Medical Outcomes Partnership) CDM (Common Data Model). There are two proposed methods; to restrict data corresponding to HIPAA (Health Insurance Portability and Accountability Act) PHI (Protected Health Information) to be extracted to CDM or to disable identification of it. While processing sensitive information is restricted by Korean Personal Information Protection Act and medical law, there is no clear regulation about what is regarded as sensitive information. Therefore, it was difficult to select the sensitive information for protecting personal healthcare information. In order to solve this problem, we defined HIPAA PHI as restriction criterion of Article 23 of the Personal Information Protection Act and maps data corresponding to CDM data. Through this study, we expected that it will contribute to the spread of CDM construction in Korea as providing solutions to the problem of protection of personal healthcare information generated during CDM construction.

• Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology
• /
• v.6 no.8
• /
• pp.15-23
• /
• 2016

Recently the interest in secondary use of medical information has emerged. But the domestic legislation or guidelines, such as being able to say that already specialize in healthcare information, can be seen a 'national medical privacy guidelines'. However the guidelines have suggested that only a violation of privacy laws in the medical information, it does not defined clearly with respect to protected health information(PHI) for secondary use. In this paper, we learn the HIPAA(Health Insurance Portability and Accountability Act) Privacy Rule of the US legislation which provides a non-identifiable screen instructions for secondary utilization of medical information, domestic guidelines and other country's guidelines. comparing with the HIPAA, national medical privacy guidelines and the domestic studies, we propose a new domestic target non-identifying information suitable for the domestic field and present future research direction.

• Review of KIISC
• /
• v.21 no.6
• /
• pp.67-72
• /
• 2011

카네기멜론 대학의 SEI(Software Engineering Institute)는 개인 의료 정보의 보안을 규정한 HIPP A(Health Insurance Portability and Accountability Act)의 조항을 미 국방부(DoD)가 제청하면서 직면하게 된 보안 준수의 난항을 해결하기 위해서 TATRC(Telemedicine and Advanced Technology Research Center)와 공동으로 자산 식별 및 정보보호 위험평가를 위한 방법론인 OCTAVE를 개발하였다. 이후 조직의 운영 과정에서 발생하는 위험의 내성을 높이기 위한 질적 위험평가 기준이 개발되었으며 이를 통해 조직의 중요한 자산 및 잠재적 위협과 취약점을 식별하는 위험평가 방법으로 발전하였고, 2005년에는 100명이하의 소규모 조직에 적합한 OCTAVE-S가 발표되었다. 오늘날 급변하고 있는 IT 환경에서 기존의 OCTAVE 보다 간소화되고 최적화된 위험평가 프로세스를 제공하기 위해서 2007년에 OCTAVE Allegro 프레임워크가 개발되었다. 본고에서는 기존의 OCTAVE 방법론의 주요 특정을 살펴보고, 정보자산 중심의 OCTAVE Allegro 위험 평가 방법론을 소개한다.

• Journal of radiological science and technology
• /
• v.31 no.4
• /
• pp.347-353
• /
• 2008

This study is to prepare an evaluation standard about personal information protection and security management of a medical institution and to build up a grade standard of evaluation in PACS environment. We built up evaluation index based on 10 detailed items in four big categories (political security, technical security, data management security and physical security) by referring to ISO17799 (BS 7799), HIPPA (Health Insurance and Portability and Accountability Act of 1996) and domestic medical law. We have investigated at the thirty places where medical facility with the extracted security criteria and security evaluation index. Average score of physical security list, one of the big categories, was 18.5/20 (93%) at all medical institutions. Political security score was 18.5/30 (62%), data management security score was 12/20 (60%) and technical security score was 17.5/30 (58%). Therefore, security evaluation score was average 67 in 30 general hospitals, which was 4th level. The results showed that it is necessary to establish evaluation and management standard about personal information protection and security consciousness which are weak in PACS environment.

• Archives of Plastic Surgery
• /
• v.50 no.4
• /
• pp.443-444
• /
• 2023

Point-of-care photography and photo sharing optimize patient outcomes and facilitate remote consultation imperative for resident surgeons. This literature review and external pilot survey study highlight the risks associated with current practices concerning patient privacy and biometric security. In a survey of 30 plastic surgeon residents and attendings, we found that the majority took photos of patients with their iPhones and shared them with colleagues via Apple iMessage. These findings corroborate previous reports and highlight a lack of physician user acceptance of secure photo-sharing platforms. Finally, we frame a successful example from the literature in the context of a postulated framework for institutional change. Prioritizing the privacy and safety of patients requires a strategic approach that preserves the ease and frequency of use of current practices.

• Journal of Korean Library and Information Science Society
• /
• v.47 no.1
• /
• pp.149-173
• /
• 2016

As cloud computing becomes more and more popular and ubiquitous, many organizations are deciding to move their whole information infrastructure to the cloud. The healthcare industry is one of those that is beginning to utilize cloud-based solutions en masse. Cloud based computing and storage offers numerous benefits including scalability, cost efficiency, and accessibility, which in turn have the potential to streamline hospital operations. Despite the potential benefits of acquiring this system, considerations must still be given to the migration of the massive amounts of personal and highly protected data to a cloud-based solution. Health care organizations must consider all matters of security, reliability, and availability, to ensure that patients' data remains compliant to the Health Insurance Portability and Accountability Act (HIPAA) compliant. This paper will examine the benefits and challenges of such operation to determine the best practices for the utilization of Electronic Medical Record (EMR) cloud based networking and storage for small to mid-sized hospitals.