A HIPAA-compliant key management scheme with revocation of authorization

Area of Science:

• Health Informatics
• Information Security
• Healthcare Management

Background:

• Patient control over electronic protected health information (ePHI) is a critical concern within the Health Insurance and Accountability Act (HIPAA).
• Existing systems often lack flexibility in managing third-party access to sensitive health data.
• Ensuring patient privacy while facilitating necessary healthcare access presents a significant challenge.

Purpose of the Study:

• To propose a new key management scheme that enhances patient control over ePHI access.
• To enable dynamic authorization and revocation of access for multiple healthcare institutions.
• To develop a time- and cost-efficient solution that avoids re-encryption of ePHI.

Main Methods:

• A novel key management scheme is designed to manage patient authorizations for ePHI.
• The scheme allows patients to grant access to multiple healthcare institutes within specific timeframes.
• It supports real-time revocation and addition of authorized entities without re-encrypting data.

Main Results:

• The proposed scheme provides patients with granular control over their ePHI.
• Authorization and revocation processes are efficient, requiring no re-encryption of health records.
• The system is designed to be time- and cost-effective for healthcare providers and patients.
• Consideration for consent exceptions is integrated into the scheme.

Conclusions:

• The developed key management scheme significantly improves patient control over ePHI access.
• It offers a flexible, efficient, and cost-effective solution for managing healthcare data access under HIPAA.
• The scheme supports dynamic authorization management and addresses consent exceptions, enhancing overall data security and patient privacy.