Securing a web-based teleradiology platform according to German law and "best practices"

Area of Science:

• Medical Informatics
• Teleradiology Systems
• Health Data Security

Background:

• Teleradiology systems like the Medical Data and Picture Exchange (MDPE) platform facilitate digital medical imaging data exchange.
• Web service architecture for MDPE presents significant security and confidentiality challenges.
• Compliance with German health telematics laws is crucial for medical data exchange platforms.

Purpose of the Study:

• To adapt a generic data security concept for the MDPE platform.
• To ensure the security and confidentiality of data and communication within the MDPE system.
• To meet the specific demands of German laws and authorities regarding health data.

Main Methods:

• Implementation of strict logical and physical separation of diagnostic and identity data.
• Adoption of all-encompassing pseudonymization throughout the MDPE system.
• Dynamic data merging within a web browser using JavaScriptlets, avoiding cross-site scripting.
• Utilization of encrypted temporary IDs for secure communication and data merging.

Main Results:

• Achieved secure exchange of digital medical imaging data via the MDPE teleradiology system.
• Ensured data confidentiality through comprehensive pseudonymization and separation of data types.
• Successfully merged data from separate sources within a web browser using secure JavaScriptlets.
• Complied with German data protection regulations for health telematics.

Conclusions:

• The adapted security concept effectively addresses the challenges of data security and confidentiality in the MDPE web service.
• MDPE provides a secure and compliant solution for teleradiology data exchange, prioritizing patient privacy.
• The dynamic data merging approach using JavaScriptlets offers a secure alternative to potentially vulnerable techniques.