conjunction with encryption presents particular challenges (Reference Other columns may here). require cryptographic metadata for facilitating aggregation and deduplication. The HL7 standards organization is currently studying this set of related use cases. Application Privacy-preserving data analytics Searching on encrypted data and proofs of data Provider Data possession. Identification of potential adverse → Consumer experience due to clinical trial participation. Identification of potential professional patients. Trends and epidemics, and co-relations of these to environmental and other effects. Determination of whether the drug to be administered will generate an adverse reaction, without breaking the double blind. Patients will need to be provided with detailed accounting of accesses to, and uses of, their EHR data. Compliance with regulations HIPAA security and privacy will require detailed accounting of access to EHR data. Facilitating this, and the logging and alerts, will require federated identity integration with data consumers. Where applicable, compliance with US FDA CFR Title 21 Part 56 on Institutional Review Boards is mandated. Government access to data and CDC, law enforcement, subpoenas and warrants. freedom of expression concerns Access may be toggled based on occurrence of a pandemic (e.g., CDC) or receipt of a warrant (e.g., law enforcement). Data Provider Data-centric security such as Row-level and column-level access control ↔ Framework identity/policy-based encryption Provider Policy management for access Role-based and claim-based. Defined for PHI control cells Computing on the encrypted data: Privacy-preserving access to relevant events, anomalies, and trends for CDC and other homomorphic encryption relevant health organizations Audits Facilitate HIPAA readiness and HHS audits Framework Securing data storage and Need to be protected for integrity and privacy, Provider transaction logs but also for establishing completeness, with an emphasis on availability. Key management Federated across covered entities, with the need to manage key life cycles across multiple covered entities that are data sources Security best practices for End-to-end encryption, with scenario-specific data stores schemes that respect min-entropy to provide richer query operations without compromising patient privacy Security against distributed denial A mandatory requirement: systems must survive
conjunction with encryption presents particular challenges (Reference here). Other columns may require cryptographic metadata for facilitating aggregation and deduplication. The HL7 standards organization is currently studying this set of related use cases. Application Provider → Data Consumer Privacy-preserving data analytics Searching on encrypted data and proofs of data possession. Identification of potential adverse experience due to clinical trial participation. Identification of potential professional patients. Trends and epidemics, and co-relations of these to environmental and other effects. Determination of whether the drug to be administered will generate an adverse reaction, without breaking the double blind. Patients will need to be provided with detailed accounting of accesses to, and uses of, their EHR data. Compliance with regulations HIPAA security and privacy will require detailed accounting of access to EHR data. Facilitating this, and the logging and alerts, will require federated identity integration with data consumers. Where applicable, compliance with US FDA CFR Title 21 Part 56 on Institutional Review Boards is mandated. Government access to data and freedom of expression concerns CDC, law enforcement, subpoenas and warrants. Access may be toggled based on occurrence of a pandemic (e.g., CDC) or receipt of a warrant (e.g., law enforcement). Data Provider ↔ Framework Provider Data-centric security such as identity/policy-based encryption Row-level and column-level access control Policy management for access control Role-based and claim-based. Defined for PHI cells Computing on the encrypted data: homomorphic encryption Privacy-preserving access to relevant events, anomalies, and trends for CDC and other relevant health organizations Audits Facilitate HIPAA readiness and HHS audits Framework Provider Securing data storage and transaction logs Need to be protected for integrity and privacy, but also for establishing completeness, with an emphasis on availability. Key management Federated across covered entities, with the need to manage key life cycles across multiple covered entities that are data sources Security best practices for data stores End-to-end encryption, with scenario-specific schemes that respect min-entropy to provide richer query operations without compromising patient privacy Security against distributed denial A mandatory requirement: systems must survive