Policy Management Standards Enabling Trustworthy pHealth

Area of Science:

• Health Informatics
• Information Security
• Healthcare Technology

Background:

• Massive deployment of information and communication technologies (ICT) in healthcare necessitates robust privacy and security measures.
• Existing paradigms focus on privilege management and access control, with standards from NIST, ISO, and HL7 playing key roles.
• Classic role-based access control (RBAC) requires evolution to meet new demands for secure health information exchange.

Purpose of the Study:

• To present HL7 security specifications as an intermediate solution for comprehensive privilege management and access control.
• To highlight the role of HL7 security labeling in enabling context-sensitive communication and cooperation.
• To discuss the foundation for explicit, ontology-based, formal, and machine-processable security policies in healthcare.

Main Methods:

• Review and presentation of HL7 security specifications, particularly the labeling standard.
• Discussion of foundations in role-based access control (RBAC).
• Exploration of metadata utilization for information, actors, and processes to support context-aware access.

Main Results:

• The HL7 labeling specification is successfully balloted, providing a framework for segmented health information security and privacy.
• This specification enables context-sensitive communication and cooperation among diverse stakeholders and processes.
• It facilitates a scalable approach towards more comprehensive privilege management and access control.

Conclusions:

• HL7 security labeling offers a scalable intermediate solution for enhancing privacy and security in healthcare ICT.
• The approach supports secure, context-aware information sharing based on metadata.
• It paves the way for advanced, machine-processable security policies in healthcare.