Trust Information-Based Privacy Architecture for Ubiquitous Health
Full text
O iginal Pape
T us In o ma ion-Based P i acy A chi ec u e o Ubiqui ous Heal h
Pekka Saka i Ruo salainen1*, DSc (Tech); Be nd Blobel2*, PhD; An o Seppälä1*, MSc; Pi kko Nykänen1*, PhD
1School o In o ma ion Sciences, Cen e o In o ma ion and Sys ems, Uni e si y o Tampe e, Tampe e, Finland
2eHeal h Compe ence Cen e , Uni e si y Hospi al Regensbu g, Uni e si y o Regensbu g, Regensbu g, Ge many
*all au ho s con ibu ed equally
Co esponding Au ho :
Pekka Saka i Ruo salainen, DSc (Tech)
School o In o ma ion Sciences
Cen e o In o ma ion and Sys ems
Uni e si y o Tampe e
Kansle in inne 1
Tampe e, 33014
Finland
Phone: 358 505 004 046
Fax: 358 405261336
Email: [email p o ec ed]i
Abs ac
Backg ound: Ubiqui ous heal h is de ined as a dynamic ne wo k o in e connec ed sys ems ha o e s heal h se ices independen
o ime and loca ion o a da a subjec (DS). The ne wo k akes place in open and unsecu e in o ma ion space. I is c ea ed and
managed by he DS who se s ules ha egula e he way pe sonal heal h in o ma ion is collec ed and used. Compa ed o heal h
ca e, i is impossible in ubiqui ous heal h o assume he exis ence o a p io i us be ween he DS and se ice p o ide s and o
p oduce p i acy using s a ic secu i y se ices. In ubiqui ous heal h ea u es, business goals and egula ions sys ems ollowed
o en emain unknown. Fu he mo e, heal h ca e-speci ic egula ions do no ule he ways heal h da a is p ocessed and sha ed.
To be success ul, ubiqui ous heal h equi es no el p i acy a chi ec u e.
Objec i e: The goal o his s udy was o de elop a p i acy managemen a chi ec u e ha helps he DS o c ea e and dynamically
manage he ne wo k and o main ain in o ma ion p i acy. The a chi ec u e should enable he DS o dynamically de ine se ice
and sys em-speci ic ules ha egula e he way subjec da a is p ocessed. The a chi ec u e should p o ide o he DS eliable us
in o ma ion abou sys ems and assis in he o mula ion o p i acy policies. Fu he mo e, he a chi ec u e should gi e eedback
upon how sys ems ollow he policies o DS and o e p o ec ion agains p i acy and us h ea s exis ing in ubiqui ous
en i onmen s.
Me hods: A sequen ial me hod ha combines me hodologies used in sys em heo y, sys ems enginee ing, equi emen analysis,
and sys em design was used in he s udy. In he i s phase, p inciples, us and p i acy models, and iewpoin s we e selec ed.
The ea e , unc ional equi emen s and se ices we e de eloped on he basis o a ca e ul analysis o exis ing esea ch published
in jou nals and con e ence p oceedings. Based on p inciples, models, and equi emen s, a chi ec u al componen s and hei
in e connec ions we e de eloped using sys em analysis.
Resul s: The a chi ec u e mimics he way humans use us in o ma ion in decision making, and enables he DS o design
sys em-speci ic p i acy policies using compu a ional us in o ma ion ha is based on sys ems’ measu ed ea u es. The us
a ibu es ha we e de eloped desc ibe he le el sys ems o suppo awa eness and anspa ency, and how hey ollow gene al
and domain-speci ic egula ions and laws. The moni o ing componen o he a chi ec u e o e s dynamic eedback conce ning
how he sys em en o ces he polices o DS.
Conclusions: The p i acy managemen a chi ec u e de eloped in his s udy enables he DS o dynamically manage in o ma ion
p i acy in ubiqui ous heal h and o de ine indi idual policies o all sys ems conside ing hei us alue and co esponding
a ibu es. The DS can also se policies o seconda y use and euse o heal h in o ma ion. The a chi ec u e o e s p o ec ion
agains p i acy h ea s exis ing in ubiqui ous en i onmen s. Al hough he a chi ec u e is a ge ed o ubiqui ous heal h, i can easily
be modi ied o o he ubiqui ous applica ions.
(JMIR Mheal h Uheal h 2013;1(2):e23) doi:10.2196/mheal h.2731
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.1h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
KEYWORDS
ubiqui ous heal h; p i acy; compu a ional us ; policy; con ex -awa eness
In oduc ion
O e iew
Bo h ubiqui ous heal h and pe asi e heal h a e e ms ha
desc ibe a new business model ( hese e ms ha e been used in
many pape s synonymously). Simila ly o heal h ca e, i s goal
is o make heal h se ices a ailable o e e yone, bu many o
i s ea u es sepa a e i om heal h ca e [1]. Acco ding o
Ruo salainen e al, ubiqui ous heal h is a me asys em ha is a
dynamic ne wo k o in e connec ed sys ems o e ing heal h
se ices o a da a subjec (DS) in an unsecu e in o ma ion space
[1]. Con a y o heal h ca e whe e he se ices a e de ined by
heal h p o essionals, in ubiqui ous heal h, he DS c ea es he
ne wo k, selec s he sys ems, and se s ules (policies) ha
egula e how and by whom he DS’heal h in o ma ion is used
and sha ed. In ubiqui ous heal h, he exis ence o p ede ined
us be ween he DS and sys ems canno be assumed, and
sys ems’ ea u es, hei business goals, and egula ion sys ems
ollowed a e o en unknown. Fu he mo e, heal h ca e-speci ic
egula ions do no ule he ways heal h da a is p ocessed and
sha ed [1]. I is e iden ha ubiqui ous heal h ea u es gene a e
p i acy and us wo hiness challenges ha should be sol ed o
make i success ul.
P i acy is a complex, pe sonal, and si ua ion-depending concep
ha can be in e p e ed in a ious ways [2]. Wes in de ined
p i acy as “ he claim o an indi idual o de e mine wha
in o ma ion abou himsel o he sel should be known o o he s
and wha uses will be made o i by o he s” [3]. P i acy is also
a human igh ha is p o ec ed by in e na ional di ec i es and
cons i u ions. P i acy p o ec ion app oaches aim a hiding use ’s
iden i y and/o some pa o he pe sonal iden i iable in o ma ion
(PII), whe eas p i acy managemen o e s anspa ency o he
DS conce ning he collec ion and p ocessing o PII.
T us can be unde s ood as he subjec i ely pe cei ed p obabili y
by a DS ha a sys em will pe o m an ac ion be o e he DS can
moni o i [4]. I indica es unce ain y abou he ea u es o
communica ion pa ne s [5,6]. T us is also con ex -dependen
and he ways i is o mula ed a y, o example, i can be based
on he ecommenda ion ecei ed om o he s, i can be
epu a ion-based, o i may be a subjec i e deg ee o belie o
o he s [7,8].
P i acy and us a e in e ela ed concep s, ha is, “da a
disclosu e means loss o p i acy, bu an inc eased le el o
us wo hiness educes he need o p i acy” [1]. The DS
in e es is o ge maximum bene i om se ices and a he same
ime o minimize he loss o p i acy.
In heal h ca e, in e na ionally accep ed p inciples, good p ac ice
ules, and domain-speci ic legisla ion de ine pa ien ’s igh s
and se ice p o ide s’ esponsibili ies. Heal h ca e-speci ic
legisla ion also s a es how pa ien ’s p i acy mus be p o ec ed
[1]. Resea che s ha e s a ed o de elop such kind o p inciples
o ubiqui ous heal h. Ruo salainen e al ha e de eloped he
THEWS (T us ed eHeal h and eWel a e Space) p inciples o
us wo hy ubiqui ous heal h. The THEWS p inciples s a e ha
he DS possesses he igh [1]: o e i y he us wo hiness any
sys em ha collec s o p ocesses his o he pe sonal heal h
in o ma ion (PHI). P inciples s a e ha DS should also ha e he
igh o con olling he p ocessing o PHI, bo h inside he
sys ems and be ween hem. DS should de ine pe sonal p i acy
policies, which egula e how his o he heal h da a is collec ed,
p ocessed, disclosed, sha ed, s o ed, o des oyed. The p inciples
also equi e he DS o be awa e o all e en s, si ua ions, and
con ex s whe e his o he heal h da a is collec ed, p ocessed,
s o ed, and disclosed.
Fu he mo e, sys ems and s akeholde s ha e he esponsibili y
o publish in o ma ion needed o us e i ica ion and suppo
openness and anspa ency o da a p ocessing.
Ubiqui ous heal h ea u es and i s ubiqui ous en i onmen
sugges ha us wo hiness and p i acy a e eal conce ns [9,10].
In ubiqui ous heal h, i is di icul o unde s and he p ocessing
o da a inside he sys ems [11], as sys ems do no always
pe o m in acco dance wi h hei policies, and he p i acy
p e e ences o DS migh con lic wi h he business objec i es
o he sys em [12]. As a esul , he DS canno assume ha he
exis ing legal amewo k gua an ees he p ocessing o PHI
law ully and acco ding o he ules p oposed by him o he
[13,14]. In addi ion, DS also canno assume ha sys ems ha e
implemen ed secu i y ules and unc ional p i acy equi emen s
de i ed om laws and s anda ds [1,15]. A big challenge in
ubiqui ous heal h is ha di e en s akeholde s (eg, sys ems,
cus ome s, hi d pa ies, and egula o s) can ha e hei own
p i acy policies.
He e we hypo hesize ha in o de o be success ul, ubiqui ous
heal h equi es us wo hiness and p i acy managemen made
by he DS. Wi hou hese wo ea u es, DS will no da e o use
i s se ices. Fu he mo e, he a chi ec u e suppo ing ubiqui ous
heal h should ul ill he THEWS p inciples p esen ed abo e.
As adi ional secu i y and us mechanisms used in oday’s
heal h ca e in o ma ion sys ems may no p o ide adequa e
secu i y and p i acy in ubiqui ous heal h [1,2,16], a no el
a chi ec u e is equi ed.
P io Wo k
The de elopmen o ubiqui ous sys ems and he g owing use
o ubiqui ous compu ing ha e aised he ollowing ques ion:
Wha kind o us and p i acy models, se ices, and
a chi ec u es o e s accep able le el o p i acy and
us wo hiness?
T us Models
T us models such as belie , o ganiza ional us , disposi ional
us , ecommended us , and di ec us ha e been p oposed
o pe asi e sys ems [8,17,18]. Disposi ional us desc ibes
he gene al us ing a i ude o he us o [17]. Di ec us is
de i ed om he ou comes o in e ac ions wi h pee s [19]. In
ecommended us , an agen makes a ecommenda ion based
on he belie s ha o he en i y is us wo hy a ce ain deg ee.
O ganiza ional o ins i u ion-based us is based on he
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.2h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
pe cei ed p ope ies o , o he eliance placed on, a sys em o
ins i u ion [7]. Repu a ion is a ecommended a ing based on
he opinions o o he s [8]. All o hem a e si ua ional, ha is,
he amoun o us ha a DS expe iences depends dynamically
on si ua ion and se ice-speci ic us ea u es [20,21].
A us is ypically based on he us o ’s cha ac e is ics such
as abili y, in eg i y, and bene olence and should no be a blind
guess [5]. I is exp essed ei he by alue, a ing, o anking o
as p obabili y o belie [22]. T us a ibu es such as in eg i y,
mo i a ion, compe ence, and p edic abili y a e p oposed o
measu e he con idence le el [23]. A ibu es p oposed by
Hussin include us ee’s iden i ie , ce i ica e, abili y,
p edic abili y, us ee’s p i acy policy, legal equi emen s, and
sys em’s p ope ies such as anspa ency, au hen ici y,
con iden iali y, and non epudia ion [24]. Resea che s ha e
de eloped ma hema ical me hods such as Bayesian p obabili y,
Be a p obabili y, maximum likelihood, game heo y, weigh ed
a i hme ic means, and a e age o weigh ed ecommenda ions
o measu e he deg ee o belie o ecommended us [25-27].
T us deg ee can also be measu ed om in e ac ion equencies
be ween us o and us ee [28], o om con ex -dependen
di ec and indi ec ecommenda ions collec ed om selec ed
use s [19].
In con as o belie and ecommended us , compu a ional us
buil on abs ac ions o human concep o us has been
p oposed by esea che s [25,29]. Wi hin ubiqui ous compu ing,
compu a ional us means au oma ion o decisions in he
p esence o unknown, uncon ollable, and possibly ha m ul
agen s [29]. Compu a ional us alue has been calcula ed using
us o ’s expe ience, ecommenda ions, in e ac ions, knowledge,
measu emen s, dis ance, and densi y o e en s [13,25,28,30,31].
Se ice le el ag eemen s, con ac ual ag eemen s, epu a ion
based on he b and’s name, us mani es o, us nego ia ion,
exchanging and e alua ing c eden ials, and ecommenda ions
made by a us au ho i y (TA) a e also widely used in
comme cial eSe ices [32,33].
The a o emen ioned us models ha e no iceable weaknesses
in ubiqui ous en i onmen . Recommenda ions a e un eliable
because hey a e based on unsecu e opinions. I is di icul o
o ce e e yone o accep ce i ica es o common TA, and many
i ual o ganiza ions do no ha e connec ion o i . A common
on ology ha is equi ed o success ul nego ia ion and
calcula ion o us a ibu es seldom exis s. T us mani es o
assumes ha he DS blindly us s ha se ice p o ide s will
deli e hei p omises. Fu he mo e, he eliabili y o epu a ions
is di icul o measu e, and c eden ials a e di icul o e alua e
[25].
P i acy Models and Fo mula
Many p i acy models de eloped by esea che s a e use ul in
ubiqui ous en i onmen . Lede e e al p oposed a model o
si ua ional aces [34]. The model p oposed by Hong e al uses
con ol and eedback [10]. The model sugges ed by F iedwald
e al included ac o s, en i onmen , ac i i y, in o ma ion low,
con ol le el, and enabling echnology [35]. Adams and Sasse
look a p i acy as p e e ences and cons ain s, and use a
compu e -unde s andable language o exp essing hem [36].
Jiang and Landay used an in o ma ion space model [37], and
Kapadia e al applied i ual walls o p i acy managemen
[38]. Diaz e al p oposed en opy as measu e o p i acy le el
[39].
P i acy managemen model p oposed by Lede e e al combined
Adams’s pe cep ual model and Lessing’s socie al p i acy
models [40,41]. In he model by Lede e e al, a p e e ed
p i acy le el depends on legisla ion, ma ke ea u es, no ms,
echnology used, na u e o pe sonal in o ma ion disclosed,
con ex ual ea u es, in o ma ion sensi i i y, cha ac e is ics o
in o ma ion use , and expec ed cos -bene i a io. A limi a ion
o his model is ha i s a iables a e quali a i e and abs ac .
T us and P i acy Technologies and Solu ions
Nume ous us and p i acy echnologies ha e been p oposed
o ubiqui ous sys ems. In G ay’s solu ion, he us is based on
he belie o a pe son ha sys ems ha e implemen ed p ope
de-iden i ica ion s uc u es and sa egua ds. I also includes a
compliance checke and a us alue calcula o [42].
PoliCyMake , KeyNo e, Simple Public Key In as uc u e, and
P e y Good P i acy solu ions use c eden ials [43]. The T us -X
app oach by Be ino e al uses digi al c eden ials, which a e
i e a i ely disclosed and e i ied [32]. Bece a e al p oposed
in elligen agen s o e alua e which o he agen s can be us ed
[23]. Acco ding o he Skopik’s app oach, ule-based us
in e p e a ion akes in o accoun he subjec i e na u e o us
[44]. Joshi e al no ed ha i is possible o make secu i y and
p i acy decisions based on us a ibu es [45].
Compu a ional us is ei he based on di ec measu emen s,
obse ed (moni o ed) ea u es, o pas expe iences [46]. In
ubiqui ous en i onmen , success ul moni o ing equi es common
on ology and measu able indica o s [22]. The us manage
a chi ec u e p oposed by Salah e al collec s us aspec s o
calcula o ha compu es a us sco e. The a chi ec u e also
includes ecommenda ion manage , moni o se ices, con ex
p o ide , log se ice, and policy manage [47]. In he EnCoRe
a chi ec u e, he TA keeps ack o p omises, manages
dec yp ion keys, discloses hem, and e i ies sys ems p ope ies
[48]. The eby, he cus ome should us on he sys em’s eleased
willingness o ul ill he pe sonal policies o DS.
P i acy is o en p o ec ed by using p i acy enhancemen
solu ions such as da a il e ing and minimiza ion, anonymiza ion,
and adding noise o disclosed in o ma ion (eg, da a hashing,
cloaking, blu ing, and iden i y hiding) [41,49]. In me ada a
app oaches, p i acy policies can be injec ed o applica ion,
agged o he me ada a, o added o he da abase o an ac i e
agen [50]. Be ghe and Schun e ’s “p i acy injec o ” adds
p i acy ules o exis ing applica ions [11]. The EnCoRe
a chi ec u e uses he s icky policy pa adigm whe e he DS can
s ick machine- eadable ules o he da a be o e i is disclosed
[48]. Me ada a can include embedded (ac i e) code ha enables
sel -des uc ion (apop osis) in he case he en i onmen is no
us ed [51]. Apop osis can also be con ex - o si ua ion-awa e
(ie, p og ammed dea h) [52]. As pe Pallapa e al, ac i e p i acy
me ada a dynamically con ols he anspa ency o da a in a
con ex [53].
O he solu ions also exis o p i acy p o ec ion. Kapadia e al
c ea ed a i ual pe sonal space (a oom) o con ol in o ma ion
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.3h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
low h ough i s “walls” [38]. In he PICOS pla o m om Kahl
e al, a p i acy ad iso helps he DS o c ea e own policies [54].
In he Uni ed S a es, a lexible app oach ha uses p i acy and
secu i y labels is unde de elopmen . In his s anda dized
solu ion, PHI is segmen ed and secu i y and p i acy labels a e
bound o hose segmen s [55].
In pe asi e sys ems, p i acy equi emen s a e ypically
exp essed as policies ha a e con ex -dependen . Policies de ine
wha is pe mi ed o p ohibi ed, and which a e pe mi ed ac ions
[45]. F om he DS iewpoin , policy can be unde s ood as a
s a emen ( ules) abou how a ce ain sys em should beha e
[56]. Policies a e ypically published in he o m o c eden ials
o me ada a, and ules a e exp essed using policy language [33].
The success ul use o policies equi es policy ma ching,
misma ch no i ica ion, policy li ecycle managemen , isk
analysis, egula o y compliance checking, and possibili y o
model p i acy egula ions [48,57]. I is also necessa y ha he
DS can en o ce pe sonal polices [58]. Policies should also be
checked o on ological compa ibili y [59].
The inc easing use o he In e ne , pee - o-pee sys ems,
mul i-agen sys ems, and social ne wo ks has been main d i e s
o discussed p i acy and us models and solu ions.
Un o una ely, mos o hem a e ocused on one ea u e (eg,
enc yp ion o con ex ). Ubiqui ous heal h equi es much wide
app oach. Like B yce e al, we also s a e ha pe asi e sys ems
equi e an a chi ec u e ha combines dynamic p i acy policies,
a p io i us alida ion, p i acy managemen , and a pos e io i
measu emen (ie, eedback) wha sys ems a e doing [2].
Regula o y compliance is also needed.
In his pape , we p opose a no el p i acy managemen
a chi ec u e o ubiqui ous heal h. As ubiqui ous heal h is a new
concep wi hou widely accep ed p inciples and p i acy and
us models, i is necessa y o selec on which p inciples and
models he a chi ec u e is based. THEWS p inciples, as
p e iously p esen ed, ha e been selec ed by he au ho s on he
basis o he a chi ec u e, ha is, he a chi ec u e should be
complian wi h hem. The solu ion should ake in o accoun
ea u es o ubiqui ous heal h and enable he DS o dynamically
manage he p i acy by de ining sys em-speci ic p i acy policies.
The a chi ec u e should mimic he way humans use us
in o ma ion in c ea ion o pe sonal policies. The a chi ec u e
should also o e p o ec ion agains many known p i acy h ea s
exis ing in ubiqui ous en i onmen .
Me hods
F om sys em heo y and sys ems enginee ing pe spec i es,
ubiqui ous heal h is a me asys em ha is cha ac e ized by i s
s uc u e, i s unc ion/beha io , and how i s in e ela ed
componen s a e composed in an o de ed way. Ins ead o c ea ing
a i icial scena ios o making quan i a i e p i acy isk/ h ea
analysis, a mo e sys em-o ien ed sequen ial me hod ha
combines me hodologies used in sys ems enginee ing,
equi emen analysis, and sys em design is used (Figu e 1).
The me hod used in his s udy includes he ollowing s eps:
de ini ion o basic equi emen s; selec ion o alues, p i acy
and us models, and iews; iden i ica ion o conce ns;
de ini ion o unc ional equi emen s; selec ion o se ices;
de eloping p i acy and us o mula; and designing he
a chi ec u e. Finally, i is checked how he a chi ec u e mee s
pu poses and equi emen s o which i has been in ended.
On he backg ound o p ocessing o heal h in o ma ion s ay
e hical alues and codes, p inciples, and common ules.
Selec ion o hese ea u es has also s ong impac on he
a chi ec u e and i s se ices. Fo some en i onmen s (eg, heal h
ca e), widely accep ed codes and ules al eady exis ; howe e ,
his is no he case in ubiqui ous heal h. The e o e, he i s s ep
is o selec p i acy and us models and app oaches ha a e in
line wi h p inciples and wi hou no iceable weaknesses. This is
achie ed by ca e ully analyzing exis ing esea ch published in
jou nals, con e ence p oceedings, and s anda ds documen s.
Simila ly, iden i ica ion o conce ns and de ini ion o unc ional
equi emen s a e also done. Finally, he a chi ec u e combines
selec ed se ices in such a way ha p inciples and equi emen s
a e ul illed.
In his pape , p i acy and us needs a e examined om he
DS’s iewpoin . O he iews a e no discussed. To educe he
complexi y, only componen s ha a e ele an o he p i acy
managemen needs o he DS a e included in he a chi ec u e.
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.4h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
Figu e 1. Me hod o he de elopmen o he THEWS a chi ec u e.
Resul s
Gene al O e iew
Ruo salainen e al ha e no ed ha p i acy ules in ubiqui ous
heal h a e based on us [1]. The e o e, p i acy and us models
selec ed should ake in o conside a ion ea u es o ubiqui ous
heal h, us and p i acy aspec s o sys ems o e ing heal h
se ices, egula o y equi emen s, and he DS’s p i acy needs.
The asymme ic ela ionship be ween sys ems p o iding heal h
se ices and he DS should also be conside ed (ie, he DS
seldom has he powe o o ce a sys em o pu pe sonal ules
in o e ec ). Fu he mo e, in p ac ice, he DS has no ools o
make pe sonal obse a ions o sys ems’ in e nal secu i y and
p i acy ea u es and policies [51,60].
P inciples, Models, and Views
In spi e ha p i acy is widely accep ed as human igh ( alue),
di e en p i acy models do exis in eal li e. Regula o y and
sel - egula o y models a e widely used [15]. P i acy can also
be conside ed as pe sonal p ope y [20]. Regula o y model is
insu icien in ubiqui ous en i onmen s [13], and sel - egula ion
made by business communi y gi es sys ems as s onge pa ne
much eedom o se ules [15]. Because in ubiqui ous heal h
he DS has he igh o se pe sonal ules o egula e and con ol
his o he heal h in o ma ion, sel - egula ion model ha uses
p i acy as he DS’s pe sonal p ope y has been selec ed o he
a chi ec u e.
Sui abili y o widely used p i acy p o ec ion and managemen
app oaches in he con ex o ubiqui ous heal h is shown in Table
1. Based on Table 1 and he ac ha pe asi e sys ems equi e
dynamic and con ex -awa e p i acy managemen [46], he
o emos p i acy app oach o ubiqui ous heal h is p i acy
managemen ha uses con ex - and con en -awa e policies and
suppo s anspa ency and egula o y compliance.
T us wo hy ubiqui ous heal h equi es ha used us model
enables he DS o wo k ou he le el o us wo hiness o
sys ems. Cha ac e is ics and weaknesses o widely used us
models in ega d o ea u es o ubiqui ous heal h a e shown in
Table 2. As a esul , us in ubiqui ous heal h canno be based
on he belie o epu a ion, and he DS usually does no ha e a
igh o e i y ecommended us . C eden ials ypically assume
ha Hobson choice and p i acy labels ha e inapp op ia e
g anula i y. Al hough some esea che s assume ha he
p o ec ion powe o laws is su icien and ce i ica ion o e s
accep able le el o us [12], he egula ions and ce i ica es
a e ound o be insu icien in ubiqui ous heal h.
Compu a ional us ha is based on sys ems’ measu able o
obse ed p ope ies can o e easonable in o ma ion o he DS
in designing pe sonal p i acy policies [25]. The limi a ion ha
he in o ma ion con en o a single us alue is oo low o
policy o mula ion [61] can be o e come by using addi ional
sys em-speci ic a ibu es. The e o e, compu a ional
o ganiza ional us wi h a ibu es is selec ed as he us model
o ubiqui ous heal h.
F om he DS iewpoin , he a chi ec u e should mimic humans’
ways o design policies, suppo mo e a ional choices han
in ui ion, and gi e eedback o he DS. Lou ie e’s s a ed
cus ome choice me hod ul ills hese equi emen s by including
awa eness, lea ning, e alua ion and compa ison, p e e ence
o mula ion, and choice and pos -choice [62]; hence, i is
selec ed o he me hod ha he DS uses in he o mula ion o
p i acy policies.
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.5h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
Table 1. Sui abili y o common p i acy p o ec ion and managemen app oaches o ubiqui ous heal h.
Sui abili yApp oach
Secu i y canno o e easonable le el o p i acy in ubiqui ous heal h. Access
con ol alone is insu icien . The DS is no amilia and canno con ol au ho iza-
ion ules used inside a sys em
P i acy p o ec ion using secu i y se ices (eg, au hen ica ion, au ho-
iza ion, and access con ol)
Heal h ca e and heal h se ices equi e he knowledge o he DS’s iden i yP i acy con ol by hiding he DS’s iden i y
Delega ion equi es knowledge o whom he DS delega es access igh s. Sys ems
speci ically do no publish his kind o in o ma ion o he DS
Delega ion app oach
Rules deployed in a label migh be inadequa e and in con lic wi h he DS policy
ha may o could no be speci ied in labels
P i acy labels
Suppo s dynamic policies, bu equi es compu e -unde s andable policy lan-
guage. Common on ology, on ology ha moniza ion (ma ching, mapping, e c.),
o easoning is needed
P i acy managemen using con ex - and con en -awa e policies
All sys ems do no accep injec ed o ac i e codeMe ada a app oach
Heal h se ices equi e la ge amoun o PHI o co ec and e ec i e se ices,
as incomple e PHI can lead o w ong decisions o p e en he use o se ices
Da a il e ing and adding noise o da a
Table 2. Cha ac e is ics and weaknesses o common us models.
Cha ac e is ics and weaknesses in ubiqui ous heal hModel
Cha ac e is ics: Based on belie , a i ude, o o he s’opinions ( ecommenda ions)Disposi ional us and ecom-
mended us
Weakness: Recommenda ions a e un eliable and based on unsecu e opinions. I is di icul o e en impossible o
check he eliabili y o o he s’ ecommenda ions
Cha ac e is ics: Based on belie o a i ude ha o ganiza ion has implemen ed su icien sa egua dsBlind us
Weakness: Does no gua an ee us wo hiness
Cha ac e is ics: Based on assump ion ha an o ganiza ion has implemen ed equi ed egula o y se icesP ede ined us
Weakness: S a ic model. Unsui able o dynamic en i onmen s.
Cha ac e is ics: Based on o ganiza ional o pe sonal labelsT us label
Weakness: Inapp op ia e g anula i y and insu icien conside a ion o dynamic con ex ual condi ions
Cha ac e is ics: Based on assu ance o se ice p o ide T us mani es o
Weakness: Based on belie o a i ude. The DS should blindly us
Cha ac e is ics: Based on subjec i e opinions o o he sRepu a ion
Weakness: The eliabili y o epu a ions is di icul o measu e
Cha ac e is ics: Based on sys em’s measu ed o obse ed ea u esCompu a ional us
Weakness: A simple us alue o ank migh o e insu icien in o ma ion o he DS in designing pe sonal policies
Cha ac e is ics: Based on isk o h ea assessmen Risk- and h ea -based models
Weakness: Di icul o e en impossible o measu e pe sonal p i acy isks
Cha ac e is ics: Based on c eden ials issued by au ho i ies. I is a ge ed o c ea e us be ween o ganiza ionsT us managemen using c eden-
ials
Weakness: C eden ials a e s a ic. Di icul o e alua e and equi e a ne wo k o us ed au ho i ies. I is di icul o
o ce e e yone and i ual sys ems o accep c eden ials o a TA
Iden i ica ion o Conce ns
Typical s akeholde s in ubiqui ous heal h a e he DS, heal h
se ice p o ide s, o he o ganiza ions, and seconda y use s.
Di e en s akeholde s ha e di e en conce ns [1]. This pape
is ocused o he DS conce ns. The main conce ns o he DS a e
as ollows: (1) how us wo hy he sys em is, (2) why is lack
o awa eness and anspa ency in da a collec ion and p ocessing,
(3) who is using he da a inside a sys em, (4) how o gua an ee
ha da a is p ocessed law ully, and (5) acco ding o he DS’s
policies, how o p e en pos - elease o da a and con ol
unnecessa y seconda y use.
Func ional Requi emen s
De i ed om p e iously men ioned assump ions and selec ions
and he p oposals made by o he esea che s, he a chi ec u e
should iden i y he ollowing unc ional equi emen s. The
a chi ec u e should o e ools o he DS o de ine pu poses o
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.6h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
da a collec ion, exp ess compu e -unde s andable ules ega ding
he sensi i i y o da a elemen s, design p o ec ion needed, ule
how long da a is s o ed, and which da a is disclosed and o
wha pu poses [14,48].
The a chi ec u e should suppo dynamic con en -, con ex -,
and pu pose-awa e p i acy managemen . I should also o e o
he DS sys em-speci ic compu a ional us in o ma ion wi h
a ibu es ha desc ibe sys ems’ ea u es, in as uc u es,
policies, and ela ions in ad ance. Humans’ way o design
policies, o suppo mo e a ional choices han in ui ion, and o
gi e eedback should need o be mimicked. The a chi ec u e
mus be compliance wi h Lou ie e’s s a ed cus ome choice
me hod. I should suppo si ua ions whe e he DS discloses
PHI and whe e da a collec ion o disclosu e is made
au onomously by a sys em. The a chi ec u e also enables he
DS o be awa e o da a-p ocessing e en s, and o se policies
egula e he seconda y use and euse o PHI.
T us and P i acy Se ices
Se ices o he a chi ec u e should ul ill abo e-men ioned
equi emen s, and ake in o accoun expec ed conce ns. T us
and p i acy se ices selec ed o he THEWS a chi ec u e a e
shown in Table 3.
Table 3. T us s and p i acy se ices o he THEWS a chi ec u e.
Se iceConce n/Func ion
T us calcula ion se iceSys em’s us wo hiness
Con ex se ice
Iden i ica ion se ice
T us in e p e e se ice
Decision suppo se iceThe DS’s in o ma ion au onomy
Policy-binding se ice
Moni o ing, us calcula ion, and no i ica ion se icesAwa eness and anspa ency
Moni o ing and no i ica ion se icesThe use o PHI inside he sys em
Moni o ing and no i ica ion se icesDoes he sys em use PHI acco ding o he DS’s policies
Policy-binding se iceChoice and seconda y use and pos - elease o PHI
Me ada a (eg, s icky policy o ac i e code o apop osis)
Decision suppo se iceDesigning p i acy policies and compa ison and p e e ence o mula ion
Policy managemen se icePolicy o mula ion and pos -choice and new policy c ea ion
Policy assis an se ice
On ology se ice
T us calcula ion se iceSys em’s ea u es and ela ions
Moni o ing se iceFeedback and ala m o con lic no ice
T us in e p e e and policy assis ance se icesLea ning
P i acy and T us Fo mula
The THEWS p inciples and unc ional equi emen s de e mine
ha he DS can use us in o ma ion in he o mula ion o
p i acy policies [1]. The ollowing o mula has been de eloped
o illus a e how us in o ma ion, p i acy a iables, and p i acy
policy a e ela ed:
P i acy_policy= (TI, IS, SE, PU)
In his o mula, TI e e s o us _in o ma ion o e ed by he
a chi ec u e o he DS. IS, SE, and PU a e p i acy a iables
p oposed by Lede e [40]. IS e e s o he sensi i i y o he da a,
SE desc ibes he si ua ion whe e in o ma ion is used, and PU
de ines he pu pose o da a collec ion o use.
To a oid he d awback o a single calcula ed us alue and o
enable a ibu e-based c ea ion o pe sonal policies [61], he
ollowing us in o ma ion o mula was de eloped:
T us _in o ma ion=T us _ alue+T us _ ea u e_ ec o
T us _ ea u e_ ec o gi es he sys em- and en i onmen -speci ic
in o ma ion o he DS abou sys ems’ egula o y compliance
and hei willingness o ollow he DS’s policies and suppo
openness. Sligh ly modi ied us a ibu es o iginally p oposed
by Hussin e al ha e been selec ed o us alue calcula ion
[24]:
T us _ alue=(E, T, P, PO, P e, T an, Ab)
whe e E ep esen s domain speci ic en i onmen al ac o s such
as legal equi emen s and sys em’s con ex ual ea u es. T
ep esen s he ype o se ice p o ide ’s o ganiza ion (eg, public
heal h ca e p o ide , p i a e heal h se ice p o ide , In e ne
se ice p o ide ). P (p ope ies) consis s o sys ems a chi ec u al
and echnological aspec s and PO is sys em’s p i acy policy.
P edic abili y (P e), anspa ency (T an), and abili y (Ab) a e
di e en pa ame e s ha can be calcula ed om he sys em’s
pas his o y o by di ec measu emen s. Fo
T us _ ea u e_ ec o , he ollowing o mula was de eloped:
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.7h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
T us _ ea u e_ ec o =(DGD, DRB, SPO, DSP, ASP, CD, ATV,
AUT, RP, PBL, DSA)
whe e DGD and DRB desc ibe he le el o sys em’s egula o y
compliance. The DGD is he deg ee o da a p ocessing made
by he sys em in compliance wi h in e na ional p i acy
p o ec ion di ec i es. The DRB is he deg ee o da a p ocessing
pe o med by he sys em complian wi h heal h ca e-speci ic
laws and ules. SPO and RP a e pa ame e s ha a e ela ed o
openness. SPO in o ms i he sys em has made i s p i acy
policies openly a ailable, and RP ells he s a us i he sys em
has published i s ela ionships. DSP, ASP, ATV, and AUT a e
willingness pa ame e s. DSP desc ibes he deg ee by which he
sys em ollows i s own p i acy policies. ASP in o ms ha he
sys em ei he enables o ejec s he DS o injec pe sonal policies
o PHI collec ed o p ocessed by he sys em. The ATV exp esses
whe he he sys em accep s ex e nal moni o ing o e en s ela ed
o he p ocessing o PHI, and AUT ells whe he he sys em
enables ex e nal access o i s audi ails. The PBL and CD a e
us wo hiness pa ame e s. CD in o ms whe he he sys em has
been ce i ied, and PBL in o ms abou he posi ion o he sys em
on he blacklis . The DSA is an op ional a ibu e ha can be
de ined by he DS. Fo DGD and DRB, a linea scale (0...1) is
used, whe eas all o he s a ibu es ha e only bina y alues. In
case o no o insu icien da a, he a ibu e alue is ze o.
Using p oposed T us _in o ma ion, he DS can p edic sys em’s
willingness o abili y o p ocess PHI legally and ollow ules
se by he DS. The T us _in o ma ion in o ms he DS abou
how much i can us on a sys em, how sys em’s policy and
echnical a chi ec u e look like, and o wha ex en sys em’s
policy is complian wi h domain-speci ic egula ions and laws.
I needed, he DS can use a ibu es o ma k a sys em un us ed
(eg, in he case i will no publish i s policies no would accep
moni o ing). Mos a ibu es can be calcula ed om in o ma ion
he sys em has, o should ha e, published; howe e , some
a ibu es migh equi e di ec obse a ions. A ibu es such as
DSP can be calcula ed om he sys em’s pas his o y.
The THEWS A chi ec u e
A laye ed amewo k model ha desc ibes us and p i acy
se ices o he THEWS a chi ec u e is shown in Figu e 2. The
op laye o he model consis s o common se ices ha a e
o e ed o all s akeholde s. The middle laye includes p i acy
and us se ices needed. Ubiqui ous heal h, s akeholde s, o he
use s, and PHI a e loca ed in he lowes laye (ie, ne wo k laye ).
As i is di icul o e en impossible o he DS o e alua e he
us wo hiness o sys ems, an independen agen , he us
calcula o (TC), is used o his ask. The ole o TC is no o
make us decisions. Simila o HL7 P i acy, Access and
Secu i y Se ices a chi ec u e, he TC should be unde s ood as
an in o ma ion poin ha sends us in o ma ion o he DS [55].
The TC calcula es T us _in o ma ion (ie, T us _ alue and ela ed
T us _ ea u e_ ec o ) by using he in o ma ion ha sys em has
published, and a ailable con ex ual da a, sys em’s measu ed o
moni o ed ea u es, and sys em’s pas his o y. I also de ec s
malicious o ake sys ems by using in o ma ion ob ained om
con ex and moni o ing se ices. Two assis ance se ices a e
o e ed o he DS: (1) us in e p e e and (2) policy assis ance
se ice. The DS can use he us in e p e a ion o unde s and
he meaning o ecei ed T us _in o ma ion.
The con ex se ice collec s sys ems’con ex ual da a, in e p e s
i , and makes i a ailable o TC and DS, using on ologies. The
DS deploys policy managemen , policy-binding, policy
assis ance, and decision suppo se ices in policy o mula ion.
The moni o ing se ice o e s eedback, educes isk, and
ecognizes policy con lic s. I eco ds and assesses how a sys em
in eal li e p ocesses PHI. I ecognizes policy con lic s and
ala ms he TC and he DS o possible malicious o illegal use
o PHI. The no i ica ion se ice wo ks as communica ion and
anspa ency ool be ween he DS, sys ems and se ices. Using
his se ice, he DS exp esses pe sonal policies o sys ems ha
in u n publish hei policies and ela ions.
An a chi ec u al model desc ibing he in e connec ion o he
THEWS se ices is shown in Figu e 3. In he a chi ec u e, he
policy o mula ion is a decision-making p ocess, whe e he DS
chooses p i acy ules, p i acy managemen se ices, and he
amoun o PHI he o she wan s o ade in acco ding o expec ed
se ice bene i s. The selec ed ules and se ices depend on
p i acy needs, T us _in o ma ion, and he pu pose o da a
eques . Typical p i acy managemen se ices ha can be
ac i a ed be o e da a disclosu e a e enc yp ion, anonymiza ion,
and da a il e ing. The DS may also injec policies and/o ac i e
code o he me ada a.
The THEWS a chi ec u e no only ul ils he THEWS
equi emen s bu also o e s p o ec ion agains many o he
known p i acy h ea s exis ing in pe asi e sys ems as shown
in Table 4.
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.8h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X
Figu e 2. The amewo k model o he THEWS a chi ec u e.
Figu e 3. The in e connec ion o p i acy and us se ices in he THEWS a chi ec u e.
JMIR Mheal h Uheal h 2013 | ol. 1 | iss. 2 | e23 | p.9h p://mheal h.jmi .o g/2013/2/e23/ (page numbe no o ci a ion pu poses)
Ruo salainen e alJMIR MHEALTH AND UHEALTH
XSL
•
FO
Rende X