In our continuing series on information security, Jesse Erdmann, CISSP, looks at what the future might bring. There are a few trends that will influence changes in the security model around granting access to data. Currently, developing standards around Health Information Exchanges (HIEs) and Nationwide Health Information Network (NHIN) are already establishing rules for granting access with regards to the context of the request as well as individual patient preference. Later, as data in general as well as in healthcare more and more becomes structured in graph form rather than the traditional document model, security models will have to be modified to account for this change.

Contextual roles, by our definition, are a combination of traditional Role Based Access Controls and information conveying a relationship between the user and the subject of a query. In current NHIN standards this means that the user must be clearly authenticated as a user and supplying enough information to establish the user is positively identifying a specific patient. From a patient perspective this means that access to medical information should only be presented to MY doctor, or billing information can only be supplied to MY CURRENT insurance provider. As systems develop and more standardized transactions are available they will be able to be combined to provide validation of the appropriate context for sharing information. For instance, as ANSI x12 278 notification messaging becomes more prevalent, perhaps an institution that just admitted a patient for hospitalization can provide a digitally signed 278 notification acknowledgement from the currently recognized insurance provider to a patient’s primary care physician as third party proof that the person is currently in the care of the requesting organization.

Patient preference will also increasingly become a factor in sharing information. Options for how to represent and enforce patient preference with regards to sharing their private information are proliferating at an alarming rate despite the fact that they are limited to a binary choice. Currently, there are options in Electronic Health Record (EHR) systems to specify that an individual patient record is confidential or belongs to a figure in the public eye. HIPAA specifies a national standard for accessing patient data. Minnesota is leading the nation in this area with a law defining a Record Locator Service that must provide an opt-out and it won’t be long before other states follow their lead with their own variations. Finally, NHIN is defining a XACML standard document to indicate whether a patient assents to sharing information between organizations. Eventually, one would hope, these options will more or less coalesce into one or two options that provide the patient a little more flexibility than yea or nay and there will be a standard way of communicating these choices between organizations.

Finally, there is a coming shift in the way data stored and that will require changes to security models. Currently, access is granted to documents or directories as a whole. What happens if the document is no longer the primary format for storing data? What happens when documents primarily intended for one audience includes information they should be proscribed from viewing? The Department of Defense has created a write up, read down policy to bridge the gap between security clearance levels. Using write up, read down people with a lower level clearance can write information to more highly cleared system, but not read from them while those with a higher level clearance can read from systems at a lower clearance level, but not write to them. Unfortunately, in health care there isn’t a clearly defined hierarchy of privacy restrictions. Nor does this system address all of its own requirements with regard to “need to know” or context to put it in terms used in this article. Something more sophisticated will be required.

The time of documents being the primary model for storing information is winding down. Semantic Web, Web 3.0, or whatever you choose to call it, is breaking into the mainstream of computing. Microsoft’s Bing, Google and Yahoo!’s Search Monkey are all bringing these technologies to the public. The Mayo Clinic, the Cleveland Clinic, Kaiser Permanente, the Pharmaceuticals industry and the National Institute of Health are all working with semantic technologies to varying degrees and in various aspects. Semantic Technology, briefly, is a way of describing data in a common format so that it is “machineable” or able to be processed by computers. Concepts are often defined using description logic so that an inference engine can be used to infer new information based on things like transitive properties, etc. One of the seminal examples is that if you define a relationship such that if a is a child of b, and be is a brother of c, then c is the uncle of a, and assert that Alfred is the child of Bart and Bart is the brother of Claude, an inference engine will provide the new information that Claude is the uncle of Alfred. There are ontologies and taxonomies providing these sorts of relational definitions for gene encoding, proteins, drugs and drug interactions, the list goes on and on. If interested, we suggest reading about BioRDF or the National Cancer Institute’s BioPortal as an entry point to the volume of information available. Most of the effort has been focused on medical research and sharing research results, but the Mayo Clinic and others are working on clinical data representations and bridging the gap between the research and the clinical worlds.

Many expect the technologies to be used simply to act as metadata describing documents as a smart index. However, it also seems likely that data from various providers would be lumped together in one large graph. So, as an organization pulls in documents from other organizations about patients they also see, rather than keeping the documents separately and manually review them every time, or more than likely not at all, why not pool the contained information into a single source and use tools to generate relevant documents as requested? Documents such as an ASTM CCR or an HL7 CCD could easily be generated from these graphs as needed. However, how do you know which bits of information are okay to share with a physician versus what is okay to share with an insurance company or a researcher or other authenticated users? Semantic technologies could provide an answer here as well.

Just as the structures modeling the data are described, these technologies can be used to define what is accessible by specific roles and any contextual information required before granting access. Using this information, a tailored document can be generated as appropriate for a particular user by selecting accessible information and formatting it as the requested document type. For example, an emergency responder might just need a list of prescriptions, a primary care physician might need to see test results from a recent specialist visit and an insurance company should only see the date a particular test was administered and not the results. This is a very early description of what a system might look like. A lot of research on how this might look and hurdles like how does the open world nature of semantic technologies versus the traditional closed world view of data impact its use in a security system remain to be addressed.

As always in information technology, things are moving quickly. Today’s cutting edge technology is tomorrow’s legacy app. What seems the most appropriate direction today becomes tomorrow’s abandoned movement. However, it is vitally important for health IT leaders to be aware of what might be coming down the road, and to be prepared to deal with them when they get here.