since the early days of medicine , 
 and before the advent of computers , people have managed healthcare data 
 manually , accumulating drug prescriptions , examination results , and other 
 medical documents , all of which were inscribed on paper and stored in physical 
 folders at home or at the family doctor office .
although archaic by today 's 
 standards , this manual information sharing scheme provided the data owner 
 ( i.e. , the patient ) with control over the sharing and usage of his or her 
 information with the advised assistance of his family doctor and under the 
 protection of the hippocratic oath .
the patient control was not compromized by 
 the digitization of medical documents in a first stage , simply because the 
 information was scattered among several incompatible information systems in 
 hospitals , clinics , and practitioner 's offices .
no one knows where the 
 information is , how to access it , whether it is complete and accurate , and 
 under which format it has been produced . during the last decade , several countries 
 launched ambitious electronic healthcare record ( ehr ) programs with the 
 objective to increase the quality of healthcare while decreasing its cost .
for example , the 
 national connecting for health ( http://www.connectingforhealth.nhs.uk ) program 
 in the uk , the national switch point ( https://www.nictiz.nl ) managed by nictiz in the netherlands , or the healthcare system infoway ( http://www . 

infoway-inforoute.ca/en/home/home.aspx ) in canada are all running projects aiming at building a wide scale ehr . in a recent report , french deputy 
 j .- p .
door identified more than 100 ehr running projects worldwide at the scale 
 of a country or region in a recent report .
the objective of centralizing medical information in 
 database systems is manifold ( centralization refers 
 to the fact that the data is stored , organized , made available , and controlled by database servers , whatever the computer system infrastructure is ) : 
 completeness ( i.e. , to make the information complete and up to date ) , availability ( to make it accessible through the internet 24 hours/7 days a week ) , usability ( to organize 
 the data and make it easily queryable and interpretable ) , consistency ( to guarantee integrity constraints and enforce atomicity 
 and isolation of updates ) , durability ( to protect the data against failure ) , and security ( to protect the data against illegal accesses ) . on the other hand , studies in 
 different countries [ 3 , 4 ] , show that several patients and even 
 practitioners are reluctant to use ehr systems arguing increasing threats on 
 individual privacy .
this 
 suspicion is fuelled by computer security surveys pointing out the vulnerability 
 of database management systems ( dbmss ) against external and internal attacks . indeed , centralizing 
 and organizing the information make it more valuable , thereby motivating 
 attacks , and facilitates abusive usages . in consequence , ehr 
 providers must comply with very stringent legislation regarding the storage and 
 preservation of medical data .
regardless of the security procedures put in 
 place at the server and their effectiveness , the patient has the sense of losing 
 control over his or her data .
guidance of the patient consent : the patient is usually asked to give his consent to an access control policy specifying who ( individuals or 
 roles ) is granted access to which part of his folder . even with the help of a 
 practitioner , it is difficult to ensure that this consent is fully enlightened . 

this is due to the high number of people interacting with the folder , the 
 diversity of their roles , the complexity of the medical information , and the 
 intrinsic difficulty to determine which data ( or data association ) reveals a 
 given pathology .
consequently , the patient usually adheres to a predefined 
 access control policy that he does not really master .
complementary to access control , 
 audit trails can help the patient tracking a posteriori who accessed 
 which part of his folder and when .
however , audit trails exploitation is fairly 
 complex and may require a dedicated query language .
with respect to the free expression 
 of the patient consent , ehr systems can not compete with the archaic manual information 
 sharing scheme . 

unbounded data retention : limited data retention is one of the central principles of 
 laws related to the safeguard of personal data .
limited data 
 retention attaches a lifetime to a data ( e.g. , 10 years for a given court 
 sentence ) after which it must be withdrawn from the system .
unfortunately , limited 
 data retention conflicts with the primary objective of an ehr , that is building 
 a complete medical history of each patient .
in addition ,   highlighted the difficulty to physically 
 destroy information stored in existing dbmss , showing that it can be recovered 
 by a forensic analysis in many ways .
a side effect is that the patient may 
 choose not to store some information in his folder ( synonym of incompleteness 
 and lower quality of healthcare ) because he can not assess a priori the 
 sensitiveness of this information . 

no 
 security guarantee outside the server domain : healthcare data is likely to 
 be extracted from the server and hosted in a client device ( e.g. , the doctor 's or 
 the patient 's device ) . typically , healthcare folders need to be extracted for 
 use in a disconnected mode , for example , to provide healthcare at home
. this 
 situation will remain the rule for a while , that is until every point of the 
 territory be connected through a secure , fast , reliable , and free of charge 
 network .
unfortunately , the hosting device is much more spyware , trojan , and 
 virus prone than the server , introducing an important security breach in the 
 architecture . 

no 
 disconnected access to the folder : ehr has been designed with online usage in mind . 

this may constitute a real barrier for a large category of patients ( e.g. , 
 elderly , disabled , and needy people ) , the prerequisite to get access to their folder 
 being either to use a terminal at some public place or to own a pc , to master 
 its use ( including the computer administration burden ) and to pay for an 
 internet connection .
if these latter conditions are not satisfied , a practitioner 
 providing healthcare at home will have to download on his mobile device the 
 folders of all visited patients , a complex and time - consuming task , beside the 
 security breach mentioned above . 
 

guidance of the patient consent : the patient is usually asked to give his consent to an access control policy specifying who ( individuals or 
 roles ) is granted access to which part of his folder . even with the help of a 
 practitioner , it is difficult to ensure that this consent is fully enlightened . 

this is due to the high number of people interacting with the folder , the 
 diversity of their roles , the complexity of the medical information , and the 
 intrinsic difficulty to determine which data ( or data association ) reveals a 
 given pathology .
consequently , the patient usually adheres to a predefined 
 access control policy that he does not really master .
complementary to access control , 
 audit trails can help the patient tracking a posteriori who accessed 
 which part of his folder and when .
however , audit trails exploitation is fairly 
 complex and may require a dedicated query language .
with respect to the free expression 
 of the patient consent , ehr systems can not compete with the archaic manual information 
 sharing scheme . 

unbounded data retention : limited data retention is one of the central principles of 
 laws related to the safeguard of personal data .
limited data 
 retention attaches a lifetime to a data ( e.g. , 10 years for a given court 
 sentence ) after which it must be withdrawn from the system .
unfortunately , limited 
 data retention conflicts with the primary objective of an ehr , that is building 
 a complete medical history of each patient .
in addition ,   highlighted the difficulty to physically 
 destroy information stored in existing dbmss , showing that it can be recovered 
 by a forensic analysis in many ways .
a side effect is that the patient may 
 choose not to store some information in his folder ( synonym of incompleteness 
 and lower quality of healthcare ) because he can not assess a priori the 
 sensitiveness of this information . 

no 
 security guarantee outside the server domain : healthcare data is likely to 
 be extracted from the server and hosted in a client device ( e.g. , the doctor 's or 
 the patient 's device ) . typically , healthcare folders need to be extracted for 
 use in a disconnected mode , for example , to provide healthcare at home .
this 
 situation will remain the rule for a while , that is until every point of the 
 territory be connected through a secure , fast , reliable , and free of charge 
 network .
unfortunately , the hosting device is much more spyware , trojan , and 
 virus prone than the server , introducing an important security breach in the 
 architecture . 
 no 
 disconnected access to the folder : ehr has been designed with online usage in mind . 

this may constitute a real barrier for a large category of patients ( e.g. , 
 elderly , disabled , and needy people ) , the prerequisite to get access to their folder 
 being either to use a terminal at some public place or to own a pc , to master 
 its use ( including the computer administration burden ) and to pay for an 
 internet connection .
if these latter conditions are not satisfied , a practitioner 
 providing healthcare at home will have to download on his mobile device the 
 folders of all visited patients , a complex and time - consuming task , beside the 
 security breach mentioned above . in 
 this paper
, we propose a novel organization of ehr aiming at circumventing these 
 four drawbacks .
this organization capitalizes on a new hardware device called secure portable token ( spt ) . roughly speaking
, an spt combines 
 a secure microcontroller ( similar to a smart card chip ) with a large external flash 
 memory ( gigabyte sized ) on a usb key form factor [ 10 , 11 ] .
an spt can host 
 onboard data and run onboard code with proven security properties thanks to its 
 tamper - resistant hardware and a certified operating system .
embedding a database 
 system and a web server in an spt gives the opportunity to manage a healthcare 
 folder ( or a part of it ) outside the ehr server with no loss of security .
accessing 
 the onboard folder while being disconnected from the network requires a simple rendering 
 device equipped with a usb port and running a web browser .
more , the embedded 
 dbms can be made self - administered so that the patient keeps a full control 
 over the onboard data , with no external intervention of a database 
 administrator .
the data retention period and the sharing of onboard data can be 
 organized similarly to the previous manual scheme , under the patient control .
the 
 resulting architecture is decentralized , with a central server managed by a 
 public or private database service provider and one embedded local server per 
 patient . splitting the folder in a centralized part and a local part remains 
 under the patient 's responsibility .
however , the local server can not provide 
 properties like availability and durability on the local data on its own .
we 
 will show that combining the capacities of the central server and the local 
 servers restores these fundamental properties .
a growing number of initiatives are using 
 smart cards ( e.g. , the french sesam vitale , the patient 
 health smart card in new york , the national 
 health card system , ( 24 millions of smart cards , see 
 http://www.gi-de.com/portal/page?_pageid=42,55000&_dad=portal&_schema=portal . ) , in taiwan , etc . ) to carry patient 's national 
 security number and practitioner 's certificate in order to implement a strong 
 identification process .
also , the german ehr initiative plans to use smart cards 
 to carry recent prescription information . as our project
, 
 the german initiative underlines the interest of holding part of the patient 's folder 
 locally .
however , this project uses a traditional smart card technology thereby 
 proscribing storing a significant volume of patient 's records locally ( the 
 smart card is endowed with less than 100 kb of stable memory , ( wiki 
 in   german : http://www.de.wikipedia.org/wiki/ 
 elektronische_gesundheitskarte ) , versus 256 mb for the preliminary 
 spt we are currently working on ) . to the best of our knowledge , our project is 
 the first to tackle the technical challenges related to the management 
 ( storage , querying , and secure sharing ) of large folders embedded in secure 
 token .
section 2 introduces the functional architecture 
 of the proposed ehr system and discusses different scenarios , showing the 
 benefit of combining a central ehr server with secure portable folders .
section 4 describes 
 an application of our solution to a medical network providing healthcare at 
 home and section 5 concludes .
the proposed ehr architecture , pictured in figure 1 , is built around a 
 central dbms server providing the functionalities mentioned above ( completeness , availability , usability , 
 consistency , durability , and security ) on all patient 's folders .
this server 
 offers an internet access to all authorized users ( e.g. , doctors , nurses , etc . ) 
 and enforces access control policies defined by the patients .
these policies are 
 based on default policies promoted by ehr groups like the gip dmp ( the gip dmp is in charge of 
 setting up the french medical folder project called dmp ( dossier mdical personnel ) .
see http://www.d-m-p.org/docs/englishversiondmp.pdf and http://www.d-m-p.org/ ) and can be refined with the help of practitioners . 
 to allow disconnected accesses to any patient folder
, a folder replica is 
 managed on a secure portable token ( spt ) provided to each patient . once endowed 
 with the appropriate embedded software ( typically a web server and a dbms ) and timely 
 synchronized with the central server , spt servers successfully to surrogate the central server . 
 the access control policy defined by the patient
note that the synchronization between central and spt servers must 
 occur in all situations ( e.g. , even if an spt remains at patient 's home and is 
 never connected to the network ) .
spt is the means by which a patient 
 can recover a full control over his folder , similarly to the manual sharing 
 scheme .
let us assume that 
 a patient is 
 willing to hide information he judges as highly sensitive ( e.g. , because it may 
 reveal a serious or shameful disease ) . in a traditional ehr system , if the 
 patient does not fully trust the server or does not fully understand the access 
 control policy ( for the reasons mentioned above ) , he has no other choice than 
 discarding this information , thereby producing an incomplete folder . here , the 
 patient can store this information , called hidden 
 data ( hd ) , locally on his spt 
 without replicating it on the central server . a data which is not hidden is 
 called regular data ( rd ) and is replicated on the spt and the 
 central server .
if the patient changes his mind afterwards ( e.g. , following the 
 advice of his doctor ) , he still has the opportunity to change the status of a 
 data from hidden to regular . note 
 that the reverse conversion ( from regular to hidden ) is uncertain since the 
 data could have been queried and/or copied beforehand .
hiding data 
 matches the privacy objective but the durability property is lost for this data 
 since a portable token is by nature not durable ( it might be lost or 
 destroyed ) .
durability can be restored by using the central server as a 
 repository for cryptoprotected data ( i.e. , encrypted and signed ) . to this end
, 
 hidden data is encrypted by the patient 's spt and stored encrypted on the 
 central server but the encryption keys are never revealed to the central 
 server .
( note that 
 encryption techniques are sometimes used by central servers to protect the 
 database footprint . with such 
 server - based encryption solutions ,
server - based encryption is thus orthogonal to the spt - based 
 encryption applied to hidden data ) .
encryption keys stay under the spt 
 control and make themselves 
 durable thanks to a trusted depositary .
the central server guarantees the durability 
 and availability of hidden data without being able to interpret its content .
let us now assume that the patient is 
 willing to share hidden data among a restricted trusted circle of persons .
the patient can define appropriate 
 access control rules on this data so that it becomes accessible to these people 
 in the presence of the patient and of his spt ( as in a paper - based scheme ) .
the patient 
 may grant a trusted circle of participants to access his hidden data even if it is not together at the 
 same physical place .
this may be helpful in case of emergency or if a remote 
 diagnosis is required .
this can be implemented by sharing the encryption keys 
 of the hidden data among the spts of people participating in the same trusted 
 circle so that only these spts are able 
 to free the hidden data from its cryptoprotection .
note that those 
 keys are never externalized from the spt , thus allowing enforcing access 
 control rules locally ( those rules are stored encrypted along with the hidden 
 data on the central server ) . to distinguish them in figure 1 , regular ( resp .
, 
 hidden ) data and its 
 related access control rules are pictured in white ( resp . ,
as mentioned 
 above , the access control policy defined by a patient must be enforced 
 uniformly on the central dbms and on the spt , independently of the status of 
 the data . with 
 hidden data ,
the access 
 control policy is strengthened by the obligation of physically sharing the 
 encryption keys , and this sharing is totally under the patient control .
once 
 decrypted , hidden data is still protected by the access control policy enforced 
 by the spt .
let us illustrate the behavior of 
 the system through a scenario involving three participants : an elderly patient named 
 bob , his family doctor jim , and a nurse lucy .
several 
 medical examinations are prescribed to bob who designates a subset of them as hidden 
 ( the others being considered as regular ) .
results corresponding to hidden data are 
 cryptoprotected using bob 's public key before being pushed .
( bob 's 
 public key is delivered by a pki server while bob 's private key is replicated 
 on every spt belonging to bob 's trusted circle .
the management of private keys 
 is under the control of the secure chip and even the spt holder can not 
 interfere or tamper it . for the sake of conciseness , we do not detail further 
 the key exchange protocol among spt . for efficiency , 
 asymmetric
encryption is used only to encrypt symmetric keys used to protect 
 the hidden data ) .
thus , lucy acts as a 
 synchronization means for bob 's folder ( as any other person visiting bob and 
 owning an spt ) . before the visit , lucy downloads from the central server only 
 the latest updates , either hidden or regular , performed in bob 's folder .
the latest updates from the central server are integrated in 
 bob 's local folder .
conversely , the latest updates performed in bob 's local 
 folder , if any , are loaded on lucy 's spt .
this allows refreshing the central 
 server replica the next time lucy will connect to the server .
synchronized data 
 is only delivered to the recipient ( i.e. , central server or patient 's spt ) 
 using a secure protocol ( authentication and encryption ) .
lucy can not get access 
 to this data , protected by the tamper resistance of the spt .
, he can connect to the central server and view bob 's up - to - date folder , 
 including the results of the recent examinations and possible updates carried back 
 by lucy ( in the limit of jim 's access rights granted by bob ) .
when visiting bob 
 at home , jim can get the same level of information by connecting locally to bob 's spt
. to summarize , any authorized people 
 ( or people playing an authorized role ) can connect to the central server or to 
 an spt local server and retrieve the regular data he is granted access to by 
 the access control policy .
no people outside the trusted circle can get access 
 to the hidden data , whatever their role(s ) and privilege(s ) .
indeed , this hidden data is 
 cryptoprotected on the central server and the encryption keys are only known by 
 the patient 's spt and by the spts of people belonging to her trusted circle .
hidden 
 data stored on the patient 's spt benefits from the spt 's tamper resistance . 
 encryption keys ( symmetric and private keys ) are transmitted from the patient 's 
 spt to the spts of the trusted circle using a secure protocol ( based on symmetric 
 encryption ) .
this transmission may happen either in a connected mode or via 
 another spt as part of the synchronization described above .
finally , 
 synchronized data ( regular , hidden , or encryption keys ) is never disclosed to 
 anyone except the recipient and is also protected during transmission by a 
 secure protocol .  
first , attacks 
 conducted at the server can only reveal regular data , hidden data being absent 
 from the server or encrypted with keys that are let under the control of the clients ' 
 spts .
most advanced server - based security solutions , even those using encryption , can not offer 
 such a level of protection because encryption keys remain accessible at the 
 server side to enable query execution .
second , attacks conducted at the client terminal 
 can not reveal more than the data displayed by the application at runtime , but 
 no data is ever stored on client terminals in the clear .
third , the spt 
 inherits its security from a tamper - resistant hardware and a certified embedded 
 code ( certified cc eal4 or 5 , fips or using other relevant scheme ) .
we do not 
 argue that spt is provably unbreakable because ultimate security does not exist 
 but it makes the attacks so complex and costly to implement as they become 
 meaningless in practice . to make the analysis complete ,
breaking a patient 's spt will lead to disclose her 
 medical folder stored locally ( hidden and regular data ) ; breaking a doctor 's 
 spt will lead to disclose the encryption keys of the patients having registered 
 this doctor in their trusted circle ; finally , breaking an spt serving for 
 synchronization ( typically a nurse 's spt ) will not disclose any information .
many technical challenges are introduced by the proposed ehr architecture , 
 like the access control definition and enforcement , the management of encryption 
 keys , the data synchronization between the central server and the embedded 
 local servers , and so forth . due to space limitation , this section focuses on 
 the challenges related to the spt and the embedded data management techniques 
 which are central to the architecture .  
an spt aims at combining in the 
 same hardware platform a secure chip and a mass storage nand flash memory 
 ( several gigabytes soon ) .
the secure chip is of the smart card type , with a 32 bit risc cpu clocked at about 50 mhz , memory modules composed of rom , tens of 
 kb of static ram , a small quantity of internal stable storage ( nor flash ) and 
 security modules .
a first obvious challenge is to produce this hardware platform 
 and assess its tamper resistance and performance . in this platform , the mass 
 storage nand flash memory is outside the secure chip ( connected by a bus ) and 
 does not benefit from the chip hardware protection .
a second challenge is then to 
 enforce the integrity and the confidentiality of the data stored in mass 
 storage thanks to the cryptographic capability of the secure chip , with a 
 minimal impact on read / write performance . considering the increasing storage 
 capacity , computation power and communication throughput of this new generation 
 of smart tokens , integrating them in a distributed architecture as regular 
 computers is a third challenge .
gemalto , the smart card world 
 leader , is developing an experimental spt platform .
this platform includes a 
 new multitasking operating system allowing the development of web applications 
 based on java and servlet technology , and thus offering a standardized means to 
 integrate services or embedded web applications to the spt .
the operating 
 system supports natively : 
 the usb 2.0 protocol and the internet 
 protocol ip for communicating with the external world ; multithreaded java applications;cryptographic primitives ( some of which being implemented in hardware);memory management and garbage collection;servlet management and web server . 
  the usb 2.0 protocol and the internet 
 protocol ip for communicating with the external world ; multithreaded java applications ; cryptographic primitives ( some of which being implemented in hardware ) ; memory management and garbage collection ; servlet management and web server
. the internal architecture of the 
 spt in described in 
 figure 2 . for more technical details , we refer the reader to .
dbms designers have produced light versions of their systems for 
 personal assistants ( e.g. , oracle - lite , db2 everyplace , sql server for window 
 ce ) but they never addressed the more complex problem of embedding a dbms in a 
 chip .
initial attempts toward a smart card dbms were isol 's sql java machine , the iso 
 standard scql , and the 
 mastercard open data storage .
all these 
 proposals concerned traditional smart cards with few resources and therefore 
 proposed basic data management functionalities ( close to sequential files ) . 

managing embedded medical folders requires much more powerful storage , 
 indexation , access control , and query capabilities .
picodbms was the first full - fledged 
 relational dbms embedded in a smart card   and was implemented on top of gemalto 's smart 
 card prototypes .
the 
 peculiarities of secure chip environments compel to deeply revisit existing 
 dbms techniques like storage and indexing models , query execution strategies 
 and transaction management .
picodbms has been designed for managing databases 
 stored in a ( megabyte sized ) eeprom stable memory integrated in the secure chip 
 and protected by the chip tamper resistance .
how to support complex access rights and 
 queries over a gigabyte - sized onboard database ( compared to picodbms , the 
 database size grows by three orders of magnitude while the ram resource was multiplied 
 roughly by 5)?how to organize the data storage and the 
 indexes with an acceptable insert / update time considering the peculiarities of 
 nand flash memory ( fast reads , costly writes , block - erase - before - page - rewrite 
 constraint)?how to protect the onboard database 
 against confidentiality and integrity attacks without degrading the query 
 performance ; this challenge is related to the flash protection problem 
 mentioned in section 3.1 but solutions specific to database management can be 
 devised to provide optimal performance ? 
  how to support complex access rights and 
 queries over a gigabyte - sized onboard database ( compared to picodbms , the 
 database size grows by three orders of magnitude while the ram resource was multiplied 
 roughly by 5 ) ? how to organize the data storage and the 
 indexes with an acceptable insert / update time considering the peculiarities of 
 nand flash memory ( fast reads , costly writes , block - erase - before - page - rewrite 
 constraint ) ? how to protect the onboard database 
 against confidentiality and integrity attacks without degrading the query 
 performance ; this challenge is related to the flash protection problem 
 mentioned in section 3.1 but solutions specific to database management can be 
 devised to provide optimal performance ? 

figure 3 depicts the main software 
 modules of the embedded dbms , tagged with numbers indicating the related technical 
 challenge .
the query manager is in charge of parsing the incoming sql query , 
 building an optimal query execution plan , and executing it .
this module must 
 consider peculiar execution strategies to answer complex sql queries over a 
 large quantity of data ( gigabytes ) while coping with the spt hardware constraints 
 ( challenge 1 ) . to tackle this challenge , we designed a massive indexing scheme presented in , which allows processing complex queries while consuming as little ram as 
 possible and still exhibiting 
 acceptable performances .
the idea is to combine in the same indexing model 
 generalized join indices and multitable selection indices in such a way that 
 any combination of selection and join predicates can be evaluated by set 
 operations over lists of sorted tuple identifiers .
the operator library 
 ( algorithms for the operators of the relational algebra , e.g. , select , project , 
 join , and aggregate ) and the execution engine integrate those techniques .
the storage manager , on which the query manager relies to access the 
 database content ( index and tables ) , is directly concerned with challenge 2 . 

indeed , the proposed massive 
 indexation scheme causes a difficult problem in terms of flash updates , due to 
 the severe read / write constraints of nand flash .
therefore , we designed 
 a structure which manages data and index keys sequentially so that the number of rewrites in flash 
 is minimized .
the use of summarization structures ( based on bloom filters ) and vertical 
 partitioning reduce the cost of index lookups .
a first implementation of this principle has been 
 patented jointly by inria and gemalto   and is integrated in the current dbms 
 prototype .
the hardware manager embeds 
 the methods for accessing the different memory modules of the spt ( through the 
 flash translation layer ( ftl )   or with direct access ) .
it includes techniques 
 associated with challenge 3 , to protect the confidentiality and the integrity 
 of the data , in an efficient way with respect to dbms access patterns .
indeed , our 
 massive indexation technique leads to numerous , random , and fine grain accesses 
 to raw data .
we conducted preliminary studies , in which we combine 
 encryption , hashing , and timestamping techniques with query execution techniques in order to satisfy three conflicting 
 objectives : efficiency , high security , and compliance with the chip hardware 
 resources .
finally , the metadata manager manages the dbms metadata , the access 
 control rules regulating the access to regular and hidden data and the encryption keys .
the functional architecture presented in section 2 will be experimented 
 in the context of a medicosocial network providing medical care and social 
 services at home for elderly people in the yvelines district , france . today , 
 the coordination among the participants of this network ( doctors , nurses , 
 physiotherapists , social workers , etc .
first , instead of 
 providing a natural and controlled way of sharing medical and social 
 information , the paper - based folder is the primary source of confidentiality 
 breach in this setting .
indeed , this folder must be shared by all participants 
 but there is no means by which an effective access control policy can be 
 implemented .
second , the folder can not be accessed and filled remotely , 
 precluding remote diagnosis , and is often incomplete due to its physical 
 centralization .
replacing this paper - based folder system by a traditional ehr 
 would introduce the drawbacks mentioned in section 1 .
the proposed 
 experimentation will combine a central database with medicosocial folders 
 embedded in spt , according to the architecture presented in the previous 
 section .
this experimentation will be conducted with a population of about 100 
 volunteer patients and 25 practitioners and social workers in the yvelines 
 district in france . 

it involves the following partners : the french national research institute in 
 computer sciences ( inria ) , university of versailles , santeos 
 ( ehr provider for the prefiguration phase of the french national healthcare folder 
 system ) , gemalto ( world leader in the smart card domain ) , alds ( a home healthcare 
 association ) , and cogitey ( a clinic with a section dedicated to elderly 
 people ) .
this project is partly funded by the yvelines district council and by 
 the french national agency for research ( anr ) .
the design phase started in 
 january 2007 and the experimentation in the field will be conducted fall 2009 . in the experiment , the final user ( either practitioner or patient ) will 
 be able to connect to a server ( either central or embedded ) with a web browser 
 running on any terminal ( fixed or mobile ) .
a web - based interface ( gui ) is 
 provided to browse the patient folder . by manipulating the gui ,
the user 
 generates http requests to the server , thereby activating servlets which in 
 turn generate database queries and build the next page of the interface .
whatever 
 the server it is connected to , the gui provides similar functions , for example , 
 access to patients ' folders , authorization management , and so forth . the software 
 platform enabling this behavior
the central server is equipped with commercial software including a web 
 server ( the gui is generated using servlets and javaserver pages ) , a relational 
 dbms ( to store , index , and retrieve patients ' folders ) , and a server of 
 identities ( to manage certificates and identifiers for medical and social 
 workers and patients ) . the spt embeds a proprietary web server and servlets communicating with 
 a lightweight dbms engine via a jdbc - like driver .
a synchronization module is 
 also embedded in the spt to synchronize the embedded folder with the copy 
 stored in the central server .
thus , the software deployed on the central server 
 and the spt provide 
 similar functionalities while relying on highly different technology to cope 
 with the spt hardware constraints . for more information about the software 
 platform
in this paper , we presented an 
 alternative to centralized ehr systems , relying on a new hardware portable 
 device called secure portable token ( spt ) .
this 
 architecture is being implemented in the scope of the dmsp and plugdb projects 
 started in november 2006 and will be experimented in the fall of 2009 in the context of a medical social network providing medical care and 
 social services at home for elderly people .
the objectives pursued are 
 to build a 
 shared medicosocial folder providing the highest degree of availability , 
 whatever the mode of operation ( disconnected or not);to reestablish 
 a natural and powerful way of protecting and sharing highly sensitive 
 information among trusted parties . 
  to build a 
 shared medicosocial folder providing the highest degree of availability , 
 whatever the mode of operation ( disconnected or not ) ; to reestablish 
 a natural and powerful way of protecting and sharing highly sensitive 
 information among trusted parties .
the expected outcome of this project is to demonstrate that these two 
 objectives can be reached with a positive impact on the coordination of medical 
 and social workers and on the acceptation of patients of an electronic usage of 
 their medical history .
 electronic health record ( ehr ) projects have been launched in most developed countries to increase the quality of healthcare while decreasing its cost . 
 the benefits provided by centralizing the healthcare information in database systems are unquestionable in terms of information quality , availability , and protection against failure . 
 yet , patients are reluctant to give to a distant server the control over highly sensitive data ( e.g. , data revealing a severe or shameful disease ) . 
 this paper capitalizes on a new hardware portable device , associating the security of a smart card to the storage capacity of a usb key , to give back to the patient the control over his medical data . 
 this paper shows how this device can complement a traditional ehr server to ( 1 ) protect and share highly sensitive data among trusted parties and ( 2 ) provide a seamless access to the data even in disconnected mode . 
 the proposed architecture is experimented in the context of a medicosocial network providing medical care and social services at home for elderly people . 
1. INTRODUCTION
2. FUNCTIONAL ARCHITECTURE AND SCENARIOS
3. TECHNICAL CHALLENGES
4. EXPERIMENTAL PLATFORM
5. CONCLUSION