| Creators: |
Stark, Benjamin and Gewald, Heiko and Heinrich, Lautenbacher and Ulrich, Haase and Siegmar, Ruff |
| Title: |
Misuse of ‘Break-the-Glass’ Policies in Hospitals: Detecting Unauthorized Access to Sensitive Patient Health Data |
| Item Type: |
Article or issue of a publication series |
| Projects: |
IDI |
| Journal or Series Title: |
International Journal of Information Security and Privacy |
| Page Range: |
pp. 100-122 |
| Date: |
2018 |
| Divisions: |
Informationsmanagement |
| Abstract (ENG): |
This article describes how the information about an individual’s personal health is among ones most sensitive and important intangible belongings. When health information is misused, serious nonrevertible damage can be caused, e.g. through making intimidating details public or leaking it to employers, insurances etc. Therefore, health information needs to be treated with the highest degree of confidentiality. In practice it proves difficult to achieve this goal. In a hospital setting medical staff across departments often needs to access patient data without directly obvious reasons, which makes it difficult to distinguish legitimate from illegitimate access. This article provides a mechanism to classify transactions at a large university medical center into plausible and questionable data access
using a real-life data set of more than 60,000 transactions. The classification mechanism works with minimal data requirements and unsupervised data sets. The results were evaluated through manual cross-checks internally and by a group of external experts. Consequently, the hospital’s data protection officer is now able to focus on analyzing questionable transactions instead of checking random samples. |
| Forthcoming: |
No |
| Language: |
English |
| Citation: |
Stark, Benjamin and Gewald, Heiko and Heinrich, Lautenbacher and Ulrich, Haase and Siegmar, Ruff
(2018)
Misuse of ‘Break-the-Glass’ Policies in Hospitals: Detecting Unauthorized Access to Sensitive Patient Health Data.
International Journal of Information Security and Privacy, 12 (3).
pp. 100-122.
ISSN 1930-1650
|
