Collaborative Research: EAGER: MedAn: A Framework for Investigating Live Medical Data against Privacy Laws

这项研究项目旨在开发一个框架，以评估和改善收集和使用个人健康数据的移动健康应用程序(APP)的隐私和安全性。这些通常在智能手机和智能设备上使用的应用程序，有可能极大地改善获得医疗保健的机会。然而，人们对他们收集和生成的敏感用户数据的隐私和保护感到担忧。该研究项目认识到需要一种以用户为中心的方法，确保遵守隐私法规，提高法律文件和应用程序描述的清晰度，并在应用程序设计过程中纳入隐私和安全措施。其目标是在使用健康应用程序的同时为用户提供对个人数据的更多控制，并建立一个框架来指导应用程序开发人员创建安全透明的应用程序。该项目的新颖性包括(I)开发了(I)模型，以弥合处理个人医疗数据的监管要求和技术规范之间的差距，以及(Ii)为移动健康应用程序提供以隐私为重点的分析框架，为用户提供细粒度的透明度和对其个人数据的控制。该项目的更广泛的意义和重要性在于，在处理敏感个人数据的健康应用程序日益普遍的使用中，保护用户的隐私和安全。通过解决合规性问题，提高法律文件的清晰度，并加强应用程序设计流程，这项研究确保用户可以控制他们的数据并做出明智的决定。最终，它促进了人们对健康应用程序的信任，鼓励负责任的开发，并促进了数字医疗领域隐私保护的进步。本研究的技术方法涉及开发能够跨体裁推断和推理的自然语言处理模型，将法律语言的语义与软件设计和开发的技术规范联系起来。这些模型有助于识别隐私漏洞，研究从中得出隐私约束并开发具有三个关键属性的正式隐私模型：完备性、最小性和一致性。最后，研究分析了移动健康应用程序，以检查是否符合政策模型。为了确保在整个数据生命周期中执行此分析，使用高级语言模型和特定于领域的语义相似性模型的组合。这些模型有助于框架从隐私法的角度分析移动健康应用程序，并通过为用户提供对其个人数据的细粒度控制和透明度来增强用户的能力。这项研究的预期进展包括非专家和工程师更好地理解法律语言，增强对移动应用程序的隐私重点分析，使用户能够清楚地了解数据收集、必要性，以及能够更多地控制他们的实时个人数据。总体而言，它促进了用户在使用健康应用程序时的安全和隐私。一个项目网站将由石溪大学计算机科学系主持，并由首席调查员定期维护和更新。该网站将提供对公开发布的数据、研究论文、会议和演讲材料以及软件产品的访问。这项研究的软件产品还将在开发存储库(如GitHub或BitBucket)上公开提供。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This research project aims to develop a framework to assess and improve the privacy and security of mobile health applications (apps) that collect and use personal health data. These apps, commonly used on smartphones and smart devices, have the potential to greatly improve access to healthcare. However, there are concerns about the privacy and protection of the sensitive user data they collect and generate. The research project recognizes the need for a user-centered approach that ensures compliance with privacy regulations, enhances clarity in legal documents and app descriptions, and incorporates privacy and security measures during the app design process. The goal is to provide users with more control over their personal data while using health apps and to establish a framework that guides app developers in creating safe and transparent applications. The project's novelties include the development of (i) models to bridge the gap between regulatory requirements and technical specifications for handling personal medical data, and (ii) a framework for privacy-focused analysis of mobile health apps that provides users with fine-grained transparency and control over their personal data. The project's broader significance and importance lie in safeguarding user privacy and security in the increasingly prevalent use of health apps, which handle sensitive personal data. By addressing regulatory compliance, improving clarity in legal documents, and enhancing app design processes, this research ensures that users have control over their data and can make informed decisions. Ultimately, it promotes trust in health apps, encourages responsible development, and contributes to the advancement of privacy protection in the digital healthcare landscape.The technical approach of this research involves developing natural language processing models capable of cross-genre entailment and inference, connecting the semantics of legal language to technical specifications in software design and development. These models help in identifying privacy vulnerabilities, from which the research derives privacy constraints and develops a formal privacy model with three key properties: completeness, minimality, and consistency. Finally, the research analyzes mobile health apps to check for conformity with the policy model. To ensure this analysis is performed for the entire data life cycle, a combination of advanced language models and domain-specific models of semantic similarity is used. These models help the framework to analyze mobile health apps in terms of privacy laws and empower users by providing them fine-grained control and transparency over their personal data. The expected advances due to this research include better comprehension of legal language by non-specialists and engineers, enhanced privacy-focused analysis of mobile apps, and enable users with clear information about data collections, necessity, and the ability to gain more control over their real-time personal data. Overall, it promotes user safety and privacy in the use of health applications. A project website will be hosted by the Department of Computer Science at Stony Brook University and regularly maintained and updated by the principal investigator. This website will provide access to publicly releasable data, research papers, conference and lecture material, and software products. The software products of this research will also be publicly available on development repositories (e.g., GitHub or Bitbucket).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.