A HIPAA-compliant architecture for securing clinical images

Area of Science:

• Health Informatics
• Medical Imaging
• Cybersecurity

Background:

• The Health Insurance Portability and Accountability Act (HIPAA) Security Standards require robust protection of health information.
• Current Picture Archiving and Communication Systems (PACS) lack integrated methods for synthesizing audit data from multiple log sources.
• Unauthorized access and disclosure of sensitive health data remain significant security concerns.

Purpose of the Study:

• To design and implement a HIPAA-compliant architecture for auditing clinical imaging workflows.
• To develop a functional HIPAA-compliant auditing system (H-CAS) as a foundational component.
• To evaluate the efficacy of H-CAS in detecting and documenting authorized and unauthorized user access within a PACS environment.

Main Methods:

• Designed a novel HIPAA-compliant architecture for tracking and auditing image workflows in clinical imaging systems.
• Developed and implemented the HIPAA-compliant auditing system (H-CAS) within a PACS simulator.
• Created evaluation scenarios involving diverse user types performing legal and illegal data access within the PACS simulator.

Main Results:

• H-CAS successfully identified and documented unauthorized access scenarios within the PACS simulator.
• The system accurately logged normal operational activities, providing a comprehensive audit trail.
• Identified integration and implementation challenges during the development and testing phases.

Conclusions:

• The developed H-CAS provides a viable solution for HIPAA-compliant auditing of PACS.
• Effective user access control and audit trails are crucial for safeguarding protected health information.
• Further refinement is needed to address identified implementation pitfalls for broader clinical adoption.