This chapter reviews the common health data security and privacy challenges to provide an overview of the context—the concerns and the types of cybersecurity threats that healthcare institutions face. Also highlighted are the latest scientific work related to two primary solutions for protecting health data used for individual care, namely, access control and cryptography and two additional solutions for protecting data used for secondary purposes, namely, data de-identification and privacy-preserving distributed data mining (PPDDM). We exemplify implementation of these solutions using three real-life use cases in healthcare and pivot our discussion on how healthcare institutions can develop cybersecurity policy and prepare themselves for complying with relevant security and privacy regulations like Europe’s General Data Protection Regulation (GDPR) and the Healthcare Insurance Portability and the Accountability Act (HIPAA) in the United States.@en

Cloud computing has many benefits relevant to the healthcare industry. Although the adoption of cloud services for healthcare systems is increasing, employment of cloud services raises many security and privacy concerns for patients and healthcare providers. We still lack a clear set of requirements consented by the different stakeholders; here in particular IT and healthcare professionals. In this study, we examine whether user perspectives on requirements for e-health on the cloud are consistent with best practice guidelines and regulatory requirements. This work contributes to the requirements engineering phase for a secure e-health cloud framework developed in a European project (ASCLEPIOS, https://www.asclepios-project.eu/). We used qualitative analysis, based on in-depth interviews, to describe and characterize clinicians' perspectives on the requirements of cloud services for healthcare data security and privacy. We examined whether these user perspectives were in harmony with the regulatory framework of the General Data Protection Regulation (GDPR), and best practice guidelines of a relevant standard, ISO 18308:2011. Ten clinicians were identified and interviewed at six healthcare organizations in Norway, the Netherlands and Germany. While user perspectives were largely consistent with both GDPR and ISO, some concerning differences in access control were noted between large and small healthcare institutions.

@en

For cross-sectoral sharing of health data, cloud services provide benefits regarding the availability of relevant information in critical situations. Nevertheless, storing electronic health records in the cloud may impact patient's privacy, since the cloud service provider might lack trustworthiness. Client-side cryptography mitigates the privacy risk by encrypting data in the user's computational environment before transmitting them to the cloud. However, client-side cryptography raises performance concerns. This paper investigates Web Assembly and JavaScript solutions that enable client-side cryptography in web applications and compares their performance against server-side cryptography. We contextualize the study within two healthcare web applications: a prototype for patient record sharing during acute stroke care and an application for sharing data in sleep medicine treatment. Our results show that JavaScript and Web Assembly libraries add more time to encryption and decryption than server-side cryptography. However, due to the concurrency introduced by simultaneous users, the performance of server-side cryptography is worse than client-side, taking longer times to attend to the demand and requiring a larger infrastructure to be effective. Moreover, the JavaScript library asmCrypto and Web Assembly approaches perform better than other libraries and are feasible candidates for application development.@en

Digital technologies, such as Big Data analytics, artificial intelligence, cloud and high-performance computing are presenting new opportunities to transform healthcare systems, increase connectivity of hospitals and other providers, and therefore potentially and significantly improve patient care. However, such networked computing infrastructures also raise significant cybersecurity risks, especially in the healthcare domain, where protecting sensitive personal information is of paramount importance. Project ASCLEPIOS aims at strengthening the trust of users in cloud-based healthcare services by utilizing trusted execution environment and several modern cryptographic approaches such as attribute based encryption, searchable encryption, functional encryption to build a cloud-based e-health framework that protects users’ privacy, prevents both internal and external attacks, verifies the integrity of medical devices before application, and runs privacy-preserving data analytics on encrypted data. The project investigates modern encryption techniques and their combination in order to provide increased security of e-health applications that are then presented towards end-users utilizing a cloud-based platform. Although some topics such as security and privacy are already investigated through block-chain related technologies, it has been decided that the selected approaches would be more suitable for these particular challenges. In order to prototype its security services, ASCLEPIOS develops and deploys three large-scale healthcare demonstrators, provided by three leading hospitals from Europe. These demonstrators are rooted in the practice-based problems and applications provided by the project’s healthcare partners. The Amsterdam University Centers, University of Amsterdam, plans to improve stroke hyper-acute care through secure information sharing on a cloud computing platform to improve patient management. Additionally, they are also building prediction models to enable earlier discharge of patients from hospitals with lower risk factors. Charité Berlin plans to improve inpatient and outpatient sleep medication by remotely controlling the quality of the collected data and transferring it on-line for further analysis. Finally, the Norwegian Centre for e-health Research, University Hospital of North Norway is developing a system for privacy-preserving monitoring and benchmarking of antibiotics prescription of general practitioners. The common characteristics of these three scenarios are the increased demand for high levels of security in data transfer, storage and privacy preserving analytics on cloud infrastructures. In order deploy, operate and further develop these applications to increase their security with the ASCLEPIOS framework, a cloud computing testbed is being setup. The testbed uses state-of-the-art technologies for cloud application deployment and run-time orchestration in order to ensure the optimized deployment and execution of the demonstrator applications. As the data sources do not require the local execution (albeit in one case data may remain on the data source) of processing, there is no need for fog or edge computing, but the testbed is based on private OpenStack cloud computing infrastructures and utilizes the MiCADO framework which is compatible with different containers such as Docker and Kubernetes. The project started only recently, and currently it is in the early stages of systems design and specification. This presentation will provide a short introduction to the ASCLEPIOS project and its demonstrators and will present early results of the currently ongoing requirements specification and platform design processes.@en