CT-T: MedVault - Ensuring Security and Privacy for Electronic Medical Records

以电子格式存储病历信息，并在不同的保健组织之间共享这些信息，有可能极大地提高保健系统的质量和效率。与此同时，由于电子病历信息极其敏感，电子病历的扩散和共享带来了严重风险。这个项目的目标是开发新的技术来存储、维护和控制敏感数据，允许合法用户之间的开放共享，同时保护数据免受未经授权的使用和泄露。该项目的研究包括两个部分：(1)称为跨层身份和访问管理(IAM)的信息保护新方法，以及(2)关于卫生系统需求和可用性问题的研究。跨层IAM研究调查了一种体系结构和机制，其中访问控制和其他与安全相关的功能在医疗保健环境中存在的复杂软件堆栈的不同信息访问层之间紧密协调；包括安全存储、逻辑数据访问和应用层，最后是用户访问系统所使用的终端设备中的应用表示层。在第二个项目组成部分中，正在对卫生系统进行研究，以确定和定义具有代表性的卫生保健组织内的角色、准入要求和常见用例情景。该项目将产生一些更广泛的影响。保健组织将通过亚特兰大儿童保健组织的参与以及与该部门其他组织的接触，积极参与。还将开发涵盖医疗保健IT系统安全的新课程，并向现有信息安全和医疗系统研究生课程的学生提供这些课程。

Storage of medical record information in electronic format and the sharing of this information among different health care organizations have the potential to produce enormous improvements in health care systems' quality and efficiency. At the same time, the proliferation and sharing of electronic medical records present serious risks, due to the extremely sensitive nature of the information. The goal of this project is to develop new techniques for the storage, maintenance, and control of sensitive data that permit open sharing among legitimate users while protecting the data against unauthorized use and disclosure.The research in this project has two components: (1) a new approach to information protection referred to as cross-layer identity and access management (IAM), and (2) research on health system needs and usability issues. Cross-layer IAM research investigates an architecture and mechanisms in which access control and other security-related functions are tightly coordinated between different information access layers of the complex software stack that is present in health care environments; including secure storage, logical data access, and application layers, and finally the application presentation layer in the end devices employed by users to access the system. In the second project component, health systems are being studied to identify and define roles, access requirements, and common use-case scenarios within a representative health care organization. The project will have a number of broader impacts. Healthcare organizations will be actively engaged, through the participation of Children's Healthcare of Atlanta, and through outreach to other organizations in this sector. New courses that cover security for healthcare IT systems will also be developed and offered to students in existing graduate programs in information security and health systems.