Feasibility analysis of the privacy attributes of the personal wellness information model

Feasibility Analysis of the Privacy Attributes of the Personal Wellness Information Model Pirkko Nykänena, Antto Seppäläa, Pekka Ruotsalainena, Bernd Blobelb aSchool of Information Sciences, Center for Information and Systems, University of Tampere, Finland beHealth Competence Center, University Hospital Regensburg, Germany Abstract A feasibility analysis has been performed to study the applicability of privacy attributes with a developed wellness information model. Information privacy concerns specifically access to individually identifiable personal information and one’s ability to control information about oneself. We carried out a user scenario walk-through of the privacy attributes related to the wellness components. The walk-through showed a need to relate self-regulating privacy policies to the pervasive context so that during various trust-building processes, a person is aware and can control the use, disclosure and even secondary use of his personal, private wellness information. Keywords: Feasibility, privacy, personal wellness, information model. Introduction A feasibility study is an important phase in the development of models and services. The ultimate goal of a feasibility study is to outline and clarify the things and factors connected to developed models and solutions [1]. This kind of study collects information and evidence on the feasibility of research results before the results are actually implemented in practice. Thus, the feasibility study provides the proof-of-the concept, information for further planning and refinement and it forms the framework for further system development project and for further studies. The phases in our preliminary feasibility study were planned following the GEP-HI evaluation guideline [2]: preliminary study planning with the purpose to outline and analyze the attributes and factors of interest of the wellness information model with related privacy concepts; study implementation planning to select the analysis criteria and methods; execution of the study, and reporting of the complete study following the STARE-HI guideline [3]. This paper presents a short summary of the proof-of-concept phase of our feasibility study. Materials and Methods The model and privacy attributes The wellness information model aims at covering the essential aspects of personal wellness information. Major components of the model are: Emotional and mental wellness, occupational wellness, environmental factors, social networks, lifestyle aspects, physiological information, and health care service (Figure 1). The components are further divided into concept classes and sub concepts. The wellness information model has been developed in a 4year research project1with literature analyses and empirical research [4-6]. The interesting components of our feasibility study are: Health care services provision, lifestyle, social networks, and emotional and mental wellness. These were selected to be objects in our analysis because they summarize well the aspects of the holistic health and wellness. Many wellness models in the literature remain at very high-level and traditional health care related models or ontologies focus on specific diseases or medical conditions and do not consider the holistic view of wellness and health [7-11]. Today issues of lifestyle and social networks are more and more important for persons in their wellness management and control [12-13]. Also in our empirical focus groups, the social networks and lifestyle aspects were emphasized by the participating persons [4-5]. Figure 1Major components of the personal wellness model Information privacy has become a very important issue with the growth of ubiquitous computing which allows many options for collecting and using personal information. Also, the global and open nature of the Internet enables easy collection, storage and utilization of personal information [14]. In health care environment, information privacy is especially important as personal health information is confidential and should be protected from un-authorized use, access, and disclosure. Privacy concerns rise from the growing interest for reuse and for secondary use of personal information for other purposes; it was originally collected in modern dynamic environments [1417]. Privacy refers to person’s ability to control the collection, use and dissemination of one’s personal information [15]. Westin [17] sees the communication aspect important in privacy by emphasizing privacy as the claim of individuals, groups, and institutions to determine for themselves when, how, and to 1Trusted eHealth and eWelfare Information Space (THEWS) MEDINFO 2013 C.U. Lehmann et al. (Eds.) © 2013 IMIA and IOS Press. This article is published online with Open Access by IOS Press and distributed under the terms of the Creative Commons Attribution Non-Commercial License. doi:10.3233/978-1-61499-289-9-219 219 what extent information about them is communicated to others. Personal information is always related to the social context where the privacy issues are raised and challenged [18-19]. The socio-technical aspect of privacy means that the users should be aware of the type of information collected, exchanged and processed in order to be able to make choices regarding who, why, and where his/her personal information can be used. Privacy is a personal and situation depending concept. Therefore, “good/bad privacy” seems to be just a qualitative opinion. A better approach is to measure the privacy level or attributes. Privacy metrics can be used to assess the degree to which a particular ubiquitous application complies with privacy requirements. Metrics suggested in [20] provide options: no control (0), control over disclosure of one kind of information (1), control over two kinds of information (2), and control over all three kinds of information (3). The types of information covered by this metrics are contents, location, and identity. Trust is an interrelated variable to information privacy; trust is mediating between information privacy and willingness to disclose private information [14]. In a contextual situation, trust and needed level of privacy are interrelated and increased level of trustworthiness reduces the need for privacy [21-22]. In relation to the wellness concepts, we defined the privacy attributes for each concept in Table 1. The attributes are based partly on our empirical research [4-6] and partly on the performed recent literature search which covered electronic literature databases with keywords: privacy, personal wellness, and pervasive health. We identified attributes which are further studied in this feasibility analysis with the specific focus on the personal wellness information [21-22]. The motivation was to have a deeper understanding on privacy. Earlier research has been much focused on types of privacy information, on privacy metrics, and policies; privacy attributes have so far been not much discussed [14-17]. Table 1 - Privacy attributes of the selected wellness components Wellness model component Privacy attributes Health care Context, capability, competence, reliability, benefit, benevolence, confidence Lifestyle Context, confidence, reliability, benefit, value Social networks Context, confidence, reliability, benefit, value Emotional and mental wellness Context, confidence, reliability, benefit, value The meanings of the attributes come from IT literature. Context refers to type or domain of the research, to the phenomena that exist in the environment, time (when), location (where), occupation (who), culture (with whom), and rationale (why) [23]. Capability refers to the ability of the information entity to show the attribute values, competence presents the level of privacy demonstration, and reliability describes how reliable information or source is considered by a person. Benefit presents the privacy benefits and confidence describes how confident the user is with information. Benevolence is the extent to which an individual is perceived to have good intention toward others without profit motive [24]. Value presents how valuable privacy is considered by a person in action or activity. The framework and analysis method The theoretical framework for our study is the design science intent of IT with the focus on conceptualization and representation of real problems and on implementation and evaluation of solutions using appropriate criteria [25-26]. Design science attempts to create things that serve human purposes and its products are assessed against criteria of value or utility - does it work? Is it an improvement? In our research, we have aimed to produce as outputs concepts and a model. The personal wellness model identifies relevant concepts and thus presents a vocabulary of personal wellness. Following from the framework, our analysis questions are: Are the created wellness concepts better than the old ones, i.e. those presented in previous research and literature? Does our wellness model give a feasible classification for concepts and does it relate the privacy attributes to the concepts? Do these attributes cover the required privacy needs? Does the wellness model contribute to having a better understanding of personal wellness, its contents and limits? The first step in our feasibility analysis was to analyze the concepts. The method for concept development was an analysis of earlier published research. We searched for published articles with keywords personal health, pervasive health, wellness, welfare, and information model [4-6]. The second step was to analyze the developed conceptual model with related privacy attributes. The method applied in this analysis was an empirical user scenario walk-through to study the feasibility of the related privacy attributes. Results The conceptual analysis has been performed and reported in detail in [5]. The results show that the concepts in our wellness model describe the personal wellness domain in more detail than models presented in the literature do. We have presented more concepts, relationships and properties in the model than the earlier general models did. The focus in our model is broader as we address the wellness from the information systems science perspective with the purpose to present a model that enables implementation [5]. For the second step, we developed a user scenario to walk through the selected model components in order to analyze the privacy attributes related to these wellness components. The scenario with privacy attributes is presented in Table 2. The privacy attributes with the components originate both from non-regulated and regulated contexts and privacy and trust in the non-regulated context are not ensured. However, the personal value of the attributes is high and they are considered highly beneficial. This gives a mixed situation between regulated and non-regulated contexts for personal wellness information. The person involved in pervasive wellness environment wants to be aware and wants to control his/her personal information, its use, access and disclose, and he/she would need ensured means to achieve this. In our analysis, we walked through all the four selected wellness information model components. As an example, a more detailed analysis of the privacy attributes of the lifestyle component scenario is presented in Table 3. As privacy specifically concerns one’s ability to control information about oneself, we have studied the privacy attributes in the walk-through from this ability-to-control perspective. P. Nykänen et al. / Feasibility Analysis of the Privacy Attributes of the Personal Wellness Information Model220 Table 2 – User scenario with components and related privacy attributes – A person, 50-year old healthy, employed man, diagnosed as diabetes mellitus type 2 (DM T2) Model component Activity / Action Privacy attributes Attribute Contents Healt h care Receives treatment, medication and guidance for home care of DM T2 Context regulated Capability capable to provide privacy and trust Competence assumed to be high Reliability organizationbased trust Benefit high personal benefit Benevolence good intention Confidence required procedures, standards and safeguards have been implemented Lifestyle Starts to improve his lifestyle, uses a personal wellness diary system in PC Context non-regulated Confidence reputation-based Reliability past historybased Benefit high personal benefit Value high personal value Social network s Searches for peersupport in the Internet, and for information on DM T2 Context non-regulated Confidence reputation-based Reliability past historybased Benefit personal benefit considered high Value personal value considered high Emotional and mental wellness Searches for recovery from depressed moods and support for higher spirits Context non-regulated Confidence reputation-based Reliability past historybased Benefit personal benefit considered high Value personal value considered high The walk-through clearly shows that in the pervasive context, it is difficult for a person to know what the actual privacy status of the service or the service provider is, especially when the provider is a non-regulated one such as lifestyle or social networks. The walk-through also shows that the person does not have trust on privacy of the non-regulated information and its reliability is not controlled by the person. Table 3 –Details of the lifestyle component walk-through User actions Privacy attribute – one’s ability to control Person searches for information on DM T2, on medication and treatment, on healthy life style, on peer support in the Internet Context – Internet, non-regulated – ability to control: only with certified sites which provide trust, other sites: no control Confidence – certificates provide some confidence, otherwise: confidence does not exist Reliability – certified sites are considered somewhat reliable, otherwise reliability does not exist Benefit – benefit is considered high, controlled by a person Value – Information value is high, very meaningful for the person, the value is determined and controlled by the person Person starts a healthy diet and documents his eating and blood sugar levels in his own wellness diary in a PC Context – non-regulated, control by the person (what to document, where to documen, when to document) Confidence – the person may /or may not be confident (depending on his abilities and on the security status of his/her PC) Reliability – PC reliability is controlled normally by PC security service provider, sometimes by a person, blood glucose meter reliability is not controlled by a person Benefit – benefit is considered high, controlled by a person Value – high value for the person’s DM management and healthy lifestyle Person stores the data he receives from a doctor into his notebook (diagnosis, medication, treatment guidelines) for his personal use Context – data is coming from regulated context, stored in non-regulated context, person controls (what, where) Confidence – the person may /or may not be confident (depending on his abilities and on the security status of his/her notebook) Reliability – data is considered reliable, high trust by the person (data is transferred from an organizational trusted source) Benefit – benefit is considered high, controlled by a person Value – high value, important for home care, for DM management and healthy lifestyle Our analysis shows that when information is transferred from regulated source to non-regulated source, the information is considered to be reliable when the person trusts that the required procedures, standards, and safeguards have been implemented for data security and privacy management. However, after the data is transferred, the original data security and privacy policies and values of privacy attributes are no longer valid. The same situation concerns certified Internet sites; when a person receives the third party certificate, he/she has P. Nykänen et al. / Feasibility Analysis of the Privacy Attributes of the Personal Wellness Information Model 221 high trust and confidence on the reliability of the site. When a person is accessing lifestyle information from non-certified sites, there is no trust on the privacy and no reliability on the information source. Discussion To achieve good privacy status, the non-regulated and regulated domains need to be integrated in such way that the person having health and wellness services is always aware and can control the privacy status of the services he/she uses. The person wants to be confident, to have trust on the privacy of his/her wellness information in all situations. For this purpose, we need to develop special privacy services for non-regulated environment that can be integrated with the regulated service access and disclose [23-24].These special services enable users to monitor privacy attributes, to connect metrics to them, and to measure the degree to which the users have control over their private information. This research suggests incorporating trust-building measures to the non-regulated context. Examples of trust-building measures are third party certificates, branding, owner disclosure which means explicitly presenting the ownership or the sponsorship of the context, self-regulating policies that explicate the rules and guiding principles of the context, and source disclosure that identifies the source of information presented [24]. With pervasive health, the self-regulating policies are the most essential, other measures are more applicable to health information websites. A self-regulating policy means that for each concept in the wellness information model, the privacy attributes are defined. In all cases, when the concept is accessed, stored, processed, or transferred, the privacy attribute values are activated and made known, controllable and measurable. This is a process-driven approach for a dynamic, contextsensitive ubiquitous environment as the trust-building measure is always related to the trust-building processes [24] such as calculative, predictive, intentionality, capability, and transference processes. For personal wellness information, important and essential processes would be the predictive, intentionality, capability and transference processes. Predictive trust building in pervasive health means reputation-based trust-building; a person can build trust if he/she knows about the past behavior of the pervasive service. Intentionality, process would mean that trust can be developed if we have perceptions on the intensions of the service or service provider. Capability based trust building requires that a person is able to evaluate the ability of the service or service provider to deliver the service. Finally, the transference process refers to a situation when information is transferred from a regulated context to the nonregulated pervasive health context. With all these processes, the self-regulating policies are needed to explicate the rules and guiding principles in the context. With our wellness information model, self-regulating policies mean that we define the privacy attributes for each concept of the components and connect privacy measure to the attribute. Management of personal information privacy is important as many studies [11, 14-17] indicate that privacy is a top reason for citizens’ reluctance to adopt personal health and wellness systems. Privacy is also the driver for non-regulated health service business model. Many of the existing personal health systems do not cover privacy and security regulations for health information or services. For citizens, this means low trustworthiness that their data and information are properly protected. A recent study [27] shows that personal dispositions should be taken into consideration when examining privacy concerns and behavioral intentions to disclose health information online or in pervasive environment. This opens new and interesting paths for the future research, e.g. study of personalized privacy measures and processes to support personally each individual in pervasive environment. Conclusions Our feasibility analysis questions were: Does our wellness model relate the privacy attributes to the concepts? Do these attributes cover the required privacy needs? This is an additional request to the previous models presented in the literature. Our developed wellness model represents essential concepts and gives a structure to the presentation. The model can be used to build instantiations. If the model helps both the user and the developer to better understand the problem at hand, or to develop better instantiations based on better understanding, the model gives more possibilities than the earlier ones. However, the problem in the model is the mix of regulated and non-regulated information access, use and disclose. The currently regulated privacy regulations do not support this kind of pervasive health and wellness information environment [21]. We have analyzed the status of the privacy attributes with a restricted scenario walk-through and have found that the attributes presented help a person to be aware of, to control and to measure the privacy of his/her personal wellness information. The attributes emphasize the dynamic characteristics of the wellness information model in the pervasive health environment. However, in the non-regulated environment, we need technical solutions on how these attributes are managed and made known, available, and controllable. Our research has shown that trust-building processes are needed to ensure the trust development. Information privacy is not yet properly managed in non-regulated environments and many challenges are offered by the personal health systems which often integrate data from regulated and non-regulated sources. These systems may be very beneficial for citizens and therefore privacy and trust concerns are essential and require solutions. This research has presented an approach for definition and management of privacy attributes with personal information models. Though this is a restricted study, we have provided contribution to information privacy research in two important aspects: applying design science approach and approaching the privacy attributes from the users’ perspective. These issues have not been included in most information privacy research as Belanger and Crossler [15] found in their extensive information privacy research review. These findings call for further research to study all potential approaches and to find innovative, feasible and implementable solutions for information privacy in pervasive health. Acknowledgments The authors acknowledge the funding of Trusted eHealth and eWelfare Information Space (THEWS) research by the Finnish Academy of Sciences in the MOTIVE Research Programme during 2009-2012. P. Nykänen et al. / Feasibility Analysis of the Privacy Attributes of the Personal Wellness Information Model222 References [1] Bryce T, The elements of good feasibility study. http://www.projectsmart.co.uk/pdf/elements-of-a-goodfeasibility-study.pdf (Accessed 1.12.2012). [2] Nykänen P, Brender J, Talmon J, de Keizer N, Rigby M, Beuscart-Zephir MC, Ammenwerth E, Guideline for good evaluation practice in health informatics (GEP-HI). Int J Med Inform 2011: 80(12):815-27. [3] Talmon J, Ammenwerth E, Brender J, de Keizer N, Nykänen P, Rigby M, STARE-HI – Statement on reporting of evaluation studies in health informatics. Int J Med Inform 2009:78:1-9. [4] Seppälä A, Nykänen P, Contextual analysis and modeling of personal wellness. In: Filipe J and Dietz JLG (Eds.), KEOD 2011, Proceedings of the International Conference Knowledge Engineering and Ontology Development. Paris, France, 26-29 October 2011: SciTePress - Science and Technology Publications, 2011, 202-207. [5] Seppälä A, Nykänen P, Ruotsalainen P, Development of personal wellness information model for pervasive healthcare. Journal of Computer Networks and Communications, 2012, Article ID 596749, 10 pages, doi:10.1155/2012/596749. [6] Nykänen P and Seppälä A, Collaborative approach for sustainable citizen-centered health care. In: N Wickramasinghe, R K Bali, S Kirn and R Suomi (Eds.), Critical issues of sustainable E-health solutions. Health care delivery in the information age. Springer Verlag, 2012, 115134. [7] Myers JE and Sweeney TJ, The indivisible self: an evidence-based model of wellness. Journal of Individual Psychology, 2004: 60(3): 234–245. [8] Soomlek C and Benedicenti L, Operational wellness model: a wellness model designed for an agent-based wellness visualization system. 2nd International Conference on eHealth,Telemedicine, and Social Medicine (ETELEMED ’10), 2010, 45–50. [9] Kirsten TGJC, van der Walt HJL and Viljoen CT, Health, well-being and wellness: an anthropological ecosystemic approach, Health SA Gesondheid, 2009: 14: 1–7. [10]Schuster TL, Dobson M, Jauregui M and Blanks RHI, Wellness lifestyles: a theoretical framework linking wellness, health lifestyles, and complementary and alternative medicine. Journal of Alternative and Complementary Medicine, 2004: 10(2): 349–356. [11]Codagnone C, Reconstructing the Whole: Present and Future of Personal Health Systems, PHS2020, European Commission, 2009, http://ec.europa.eu/information_society/activities/health/docs/p rojects/phs2020/phs2020-book-rev16082009.pdf (Accessed 25.11.2012). [12]Denecke, K and Nejdl, W, How valuable is medical social media data? Content analysis of the medical web. Information Sciences, 2009: 179: 1870-1880. [13]Eysenbach, G, Medicine 2.0: Social Networking, collaboration, participation, apomediation, and openness. Journal of Medical Internet Research, 2008: 10: 3, e22. [14] Pavlou PA, State of the information privacy literature: where are we now and where should we go? MIS Quarterly 2011: 35(4): 977–988. [15]Belanger F, Crossler RE, Privacy in the digital age: a review of information privacy research in information systems. MIS Quarterly, 2011:35(4):1017–1041. [16]Smith JH, Dinev T and Xu H, Information privacy research: an interdisciplinary review. MIS Quarterly, 2011, 35(4): 989-1015. [17]Westin A, Social and political dimensions of privacy. J Social Issues, 2003: 59(2): 431–453. [18]Rallapalli M, Trust factors in privacy framework enabled socio-technical systems. Int J of E-Business Development, 2012: 2(4): 165-169. [19]Nissenbaum H, Privacy in context: Technology, policy and the integrity of social life. Stanford University Press, USA, 2010. [20] Jafari S, Mtenzi F, O’Driscoll C, Fitzpatrick R and O’Shea B, Measuring privacy in ubiquitous computing applications. Int J of Digital Society, 2011: 2(3):547-550. [21]Ruotsalainen P, Blobel B, Nykänen P, Seppälä A, Sorvari H, Framework model and principles for trusted information sharing in pervasive health. In: A Moen, SK Andersen, J Aarts and P Hurlen (eds.), User Centred Networked Health Care. Proceedings of the MIE2011, Oslo, IOS Press, Amsterdam, 2011, 497-501. [22]Ruotsalainen P, Blobel B, Seppälä A, Sorvari H, Nykänen P, A Conceptual Framework and Principles for Trusted Pervasive Health. J Med Internet Res 2012: 14(2):e52 [23]Bansal G, Zadehi F and Gehen D, The moderating influence of privacy concerns on the efficacy of privacy assurance mechanisms for building trust: A multiplecontext investigation. In: Proc. of the 29th Int Conference on Information Systems (ICIS2008), Paris, 2008. [24]Luo W and Najdawi M, Trust-building Measures: A Review of Consumer health portals. Communications of the ACM, January 2004: 47(1):109-113. [25]March ST and Smith GF, Design and natural science research on information technology. Decision Support Systems, 1995: 15(4): 251–266. [26]Hevner AR, March ST, Park J and Ram S, Design science in information systems research. MIS Quarterly, 2004:28(1): 75-105. [27]Bansai G, Zahedi FM, Gehen D, The impact of personal dispositions on information sensitivity, privacy concerns and trust in disclosing health information. Decision support systems, 2010: 49(2): 138-160. Address for correspondence Pirkko Nykänen, University of Tampere, School of Information Sciences, PO Box 607, FIN-33014 Email: Pirkko.Ny[email protected]i, GSM +358 40 1901 720. P. Nykänen et al. / Feasibility Analysis of the Privacy Attributes of the Personal Wellness Information Model 223