PCASSO: a design for secure communication of personal health information via the internet.
PCASSO: a design for secure communication of personal health information via the internet.
复制标题
PCASSO：一种通过互联网安全传输个人健康信息的设计。
DOI：
10.1016/s1386-5056(98)00088-4
复制
发表时间：
1999
影响因子：
4.9
通讯作者：
Masys,DR
中科院分区：
文献类型：
--
作者：
Baker,DB;Masys,DR
互联网为个人可识别的健康信息的通信带来了希望和危险。由于旨在促进可访问性和互操作性而不是安全性的技术特征，Internet寻址约定和传输协议很容易受到恶意人员和程序的破坏。此外，大多数常用的个人计算机（PC）操作系统目前缺乏基于硬件的系统软件保护和进程隔离，这对于确保可信应用程序的完整性至关重要。为电子商务设计的安全办法是用已知的安全弱点换取有限的财务赔偿责任，但这种办法不足以处理个人健康数据，因为无意泄露造成的个人损害可能严重得多。为了克服这些障碍，我们正在开发和评估一种基于互联网的通信系统，称为PCASSO（以患者为中心的在线安全系统访问），该系统将最先进的安全技术应用于健康信息。PCASSO包括基于角色的访问控制、多级安全性、强大的设备和用户身份验证、特定于会话的加密和审计跟踪。与基于互联网的电子商务解决方案不同，PCASSO端到端地保护数据：在服务器中;在数据存储库中;在网络中;在客户端上。PCASSO旨在使患者和医疗服务提供者能够通过互联网访问个人健康记录。
The Internet holds both promise and peril for the communications of person-identifiable health information. Because of technical features designed to promote accessibility and interoperability rather than security, Internet addressing conventions and transport protocols are vulnerable to compromise by malicious persons and programs. In addition, most commonly used personal computer (PC) operating systems currently lack the hardware-based system software protection and process isolation that are essential for ensuring the integrity of trusted applications. Security approaches designed for electronic commerce, that trade known security weaknesses for limited financial liability, are not sufficient for personal health data, where the personal damage caused by unintentional disclosure may be far more serious. To overcome these obstacles, we are developing and evaluating an Internet-based communications system called PCASSO (Patient-centered access to secure systems online) that applies state of the art security to health information. PCASSO includes role-based access control, multi-level security, strong device and user authentication, session-specific encryption and audit trails. Unlike Internet-based electronic commerce ‘solutions,’ PCASSO secures data end-to-end: in the server; in the data repository; across the network; and on the client. PCASSO is designed to give patients as well as providers access to personal health records via the Internet.