Over 80% of US physicians will have smartphones by 2012, making technology and mobile devices increasingly integrated into medical workflows. As healthcare moves to mobile devices, research is needed to address privacy and security concerns, including how to isolate sensitive health data, control privacy of app usage, remotely wipe personal data from lost devices, and ensure data security when physicians use smartphones for treatment. Clear policies are also needed to determine ownership of health data collected from medical devices to inform technology development and assessments of different ownership models.

1. Patient-centered Devices
“Better than four in five U.S. physicians will have smartphones by 2012, up
from about 64 percent today, says a new report from Manhattan
Research. (A year ago, the number was about 54 percent.) This is part
of a larger trend of the Internet becoming the No. 1 professional
resource among doctors, the New York-based research firm says in its
latest publication, "Physicians in 2012: The Outlook for On Demand,
Mobile, and Social Digital Media." With this shift, technology is
becoming more integrated into the physician workflow. "By 2012, all
physicians will walk around with a stethoscope and a smart mobile
device, and there will be very few professional activities that
physicians won't be doing on their handhelds. Physicians will be going
online first for the majority of their professional needs, and will be
regularly pulling online resources into patient consultations,"
Manhattan Research's senior director of research, Monique Levy, says
in a company statement.”
Security and Privacy in Healthcare Page 1

2. Patient-centered Devices
• We are interested in soliciting research into the following
questions:
‣ What user experiences will be needed to help consumers understand and
not mistake one privacy context with another?
‣ What methods can be used to isolate sensitive health information on the
device from other less sensitive data?
‣ Does the presence of an app on the UI disclose a health condition (e.g.,
myMoodManager)? How can that disclosure be controlled by the user?
‣ If the device is lost, what methods can one use to wipe personal health data
from it remotely? If one recovers the device, how can she be assured her
data was not compromised?
‣ If a physician uses his smartphone for treatment, how can the consumer be
assured the phone itself, the applications and the data are not compromised?
‣ How can UI design help consumers understand trust decisions made on a
mobile device?
Security and Privacy in Healthcare Page 2

3. Patient-centered Devices
The nature of personal and mobile healthcare devices and
the systems they extend into diverge from traditional
security in that they must provide verifiable high assurance,
integrity and privacy of patient data and services. Moreover,
the compromise or failure in these settings presents hyper-
critical consequences that transcend inconvenience to
fatality. Key areas that will enable the next generation of
dependable medical devices and advanced healthcare
services include; verifiable availability and security of hardware
and software, context-driven system behavior, data provenance,
tele-medicine, privacy-preserving data-sharing, policy-based
sharing, identity management, information and existential
leakage, and pervasive device security.
Security and Privacy in Healthcare Page 3

4. Patient-centered Devices
For this infrastructure to be successful, information ownership:
clear policies need to be developed that determine who owns the
information collected via different medical and medically-related
devices (within a home, hospital and mobile). Technology needs to
be developed that supports different ownership models, and
assessments of the impact of different ownership models need to
be performed to inform policy decisions. Usable implementations
of different data ownership models are sought, taking into account
patients, hospital staff, research needs, and other various interests.
Effectiveness and patient acceptance of devices may depend on
transparency and extent of patient control of the information
flowing from devices. Research is needed to understand how to
align health care consumer actions with respect to data sharing and
health care consumer beliefs (mental models) about those actions.
Security and Privacy in Healthcare Page 4