View source for Data Model to Enhance the Security and Privacy of Healthcare Data

This is a review of an article by Asija,R.,and Nallusamy,R., who proposed a model to enrich the healthcare data privacy and security.<ref name ="Asija"> Asija, R., Nallusamy, R. Data Model to Enhance the Security and Privacy of Healthcare Data. 2014 IEEE Global Humanitarian Technology Conference - South Asia Satellite (GHTC-SAS), Trivandrum, 2014, 237-244.  DOI: 10.1109/GHTC-SAS.2014.6967590.Retrived from: http://ieeexplore.ieee.org.ezproxyhost.library.tmc.edu/stamp/stamp.jsp?tp=&arnumber=6967590 </ref>
  
=Introduction=
Data and security need to evolve with new technologies and databases as the healthcare is progressing in the direction of establishing new platforms to share and exchange the patient data across various systems in different countries.
Extensible Markup Language [http://www.w3.org/XML/ XML] a defacto standard XML is enhanced with a sophisticated access control mechanism that allows not only to securely browse healthcare XML documents but also to securely update each document element. Several technologies can be used to achieve XML data security. These technologies include XML Digital Signature for integrity and signing solutions, XML encryption for confidentiality, XML Key Management (XKMS) for public key registration, location and validation, [http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language Security Assertion Markup Language (SAML)] for conveying authentication, authorization and attribute assertions, XML Access Control Markup Language (XACML) for defining access control rules, and Platform for Privacy Preference (P3P) for defining privacy policies and preferences. High usage areas include securing web services (WS-Security) and Digital Rights Management (eXtensible Rights Markup Language).
Healthcare data interchange between systems is possible with XML.
Patient demographics along with sensitive data like personal details, allergies, blood type and surgery history can be protected with the use of new XML technologies like [http://www.w3.org/TR/xmlschema11-1/ XML Schema] and XML Stylesheet Language For Transformation (XSLT). 
* XML Schema - An XML schema describes the structure of an XML document. The XML schema is also known as XML Schema Definition (XSD). 
XML schemas are written in XML, support data types and namespace, therefore are more rich and powerful than DTDs (Document Type Definition). Use: Exchange of data securely in a way receiver understands 
* XML Stylesheet Language For Transformation (XSLT)-is a specification for transforming XML to other formats or simply to a different XML document. Use: To create a presentation layer for patient health records.
These methods will facilitate the data from any sources to be interoperable with flexibility and compliant with Clinical Practice Guidelines (CPGs).<ref name ="Asija"></ref>
=Data Security=
Access control models like Discretionary Access Control (DAC),Mandatory Access Control(MAC), and Role-Based Access Control (RBAC) are well established but lack the productivity enhancing properties. To overcome the complexities surrounding productivity of the cloud based computing, XML based security technologies have evolved based on basic XML technologies.<ref name ="Asija"></ref>

===XML based security technologies===
* XML Digital Signature: emulates paper based signature so, it is a digital “fingerprint” signature. It signs either part /complete of a document.
* XML Encryption: Selective encryption of the parts of data maintains security.
* XML Key Management Specification (XKMS): The World Wide Web Consortium W3C definition is a set of “protocols for distributing and registering public keys, suitable for use in conjunction with the standard for XML Signatures and companion standard for XML encryption”. It has comprises of two parts: the XML Key Information Service Specification (X-KISS) and the XML Key Registration Service Specification (X-KRSS).
* Security Assertion Markup Language (SAML): defines an XML vocabulary for sharing security assertions enabling “Single-Sign On” which provides a means to communicate an authentication assertion from the original login site to other sites, to tailor user access needs. SAML uses XML-based messages with the help public key cryptography to sign and encrypt the messages.
* Extensible Access Control Markup Language (XACML): XACML is an open standard XML-based language.
All of these technologies too have issues in performance in cloud based services.<ref name ="Asija"></ref>

=Related work= 
Few proposed models based on XML security were 
*Damiani et al.: The authorization model, an approach to define data access control in XML documents. Subjects (users) and objects (path expressions) along with the use of authorization priorities with propagation and overriding was an important aspect of this model. 
*Bertino et al.: The document distribution approach, an extension of the Cryptolope based approach. This approach basically consists of encrypting different encryption keys and selectively distributing these keys to users according to the access control policies.
*Kuper et al.: this approach had generalized notion of XML security views to arbitrary DTDs and to conditional constraints expressed in a very expressive XPath fragment as ‘true’ or ‘false’.
*Landberg et al.: In this “inheritance” simulated model, if a node representing user/data does not specify SL (security level), then it’s SL is inherited from its nearest ancestor that specifies SL which is compared to family tree with parents and children. Another rule here is that if SL is equal for all child nodes of a parent node, then this SL applies to the parent node. So, if all child nodes of node Patient Record are having same security level, then this SL applies to parent node that is Patient Record.<ref name ="Asija"></ref>

=Proposed Model=
All the proposed models had few drawbacks in and were not sufficiently scalable for the cloud computing and mobile services advanced technologies. Asija,R., and Nallasamy, R., proposed a that each node of data and users in XML schema were assigned different security levels (SL) and linked according to their level of accessibility pertaining to the specialty or domain. For example, a Cardiologist with a SL=2 will have access to all data with a data SL=2.<ref name ="Asija"></ref>

=Advantages of the proposed model=
In the proposed model, security levels are defined within the XML schema and the permissions for access/ update/ delete are given at run-time using a mapping algorithm which will enhance the security and privacy of health data.
* Granular security level assigned according to the type of data and users.
* Strengthen interoperability of data between healthcare organisations.
* Can be coupled with encryption using mapping algorithm to build up complex security
* Applicable to any operation - Read, Write (Add / Delete, Update).
* Flexible and portable. 
This model can be applied by just defining the security levels inside the XML schema without changing the hard-code ensuring full security and can be incorporated universally.<ref name ="Asija"></ref>
=Conclusion= 
The proposed model by Asija and Nallusamy succeeded in fully exploiting the benefits of XML Schema and with convincing improvised access with ensured privacy and security of health care data at different granular levels within or across users in diverse clinical information systems using Intranet/ Internet at any given time.<ref name ="Asija"></ref>

=Comments= 
The proposed models on privacy and security with widespread exchange of data across hospitals should be validated and evaluated for its appropriate accessibility to the intended users to avoid any data breaches.
=References=
<references/>
[[Category: Reviews]]
[[Category: HI5313 SP15]]
[[Category: Security]]