The document discusses the challenges and opportunities in healthcare access control technologies, emphasizing the need for innovation to empower patients and enhance privacy. It highlights a misalignment between patients' expectations of data ownership and the realities of current access control practices. The speaker calls for a reevaluation of existing technologies and a deeper understanding of the healthcare ecosystem to better meet the needs of patients and providers.

1. New Access Models for Healthcare Tyrone Grandison, PhD Program Manager, Core Healthcare Services, IBM Services Research Keynote – June 9 th , 2010. 15th ACM Symposium on Access Control Models and Technologies (SACMAT) 2010. Pittsburgh, USA.

2. Disclaimer The opinions expressed in this talk are strictly my own and are not attributable to any corporation, organization or body that I am associated with.

3. Why Am I Here? To provoke and promote thought. To spur discussion and debate. To share Observations about the global healthcare community Experiences with healthcare clients Implications of healthcare research

4. Topics To Be Covered Why is this now an interesting research area? Economic Investment The Prime Directive Patient Empowerment and Buy-In What does the convergence of these factors mean? The good, the bad and the expected. The World As It Is Today The Healthcare Operating Environment Current Access Control Technology Bridging the Divide Call To Action

5. Worldwide Health IT Investment North America US ARRA – $20.4B Canada –$3.1B CDN (InfoWay) Asia China – $4.2B Singapore – $1.1B SIN Europe UK – ₤20.4B Middle East Saudi Arabia – $14B Worldwide EMR – $10B in 2010  $30B in 2019 * EMR Adoption US – 10% AUS – 25% UK – 59% CAN – 14% NZ – 52% Additional Opportunities Clinical Decision Intelligence: $75M (2010), $3.1B (2019) Health Analytics: Health analytics: $2.3B, $3.29B (2014) Cloud Computing for HCLS: $1.04B (2010), $6.2B (2014) Source: IBM Global Technology Outlook (Feb 2010) Impact: Healthcare-specific research is on rise

6. Prime Directive Adapted from Star Trek The most prominent guiding principle of the United Federation of Planets Stipulates that there can be no interference with the internal development of pre-warp civilizations consistent with the concept of Westphalian sovereignty - the concept of nation-state sovereignty based on two principles: territoriality and the exclusion of external actors from domestic authority structures. Useful Notion when building Industry-focused Security Technology * Entertainment: Do not interrupt the cash flow Finance: Do not disturb the ticker Healthcare: Nothing interferes with the delivery of care Impact: Security controls in Healthcare IT systems are routinely circumvented Grandison, T., Davis, J. "The Impact of Industry Constraints on Model-Driven Data Disclosure Controls" . The Proceedings of the 1st International Workshop on Model-Based Trustworthy Health Information Systems (MOTHIS). Nashville, Tennessee. Sept 2007. * Source:

7. Patient Empowerment and Buy-In Privacy! Privacy! Privacy! Sweeping concept meaning many things – control over one’s body or data, freedom of thought, solitude in one’s home, protection from searches and interrogations * “Privacy is a value so complex, so entangled in competing and contradictory dimensions, so engorged with various and distinct meanings that I sometimes despair whether it can be addressed at all” + “a deep concern over the preservation of privacy under the new pressures from surveillance technology” - Impact: Privacy is complex, interesting, of some concern. “ The panic about privacy has all the fingerpointing and paranoia of a good old American scare, but it’s missing one vital ingredient: a genuinely alarmed public. Americans care about privacy mainly in the abstract.” ^ “ Most people, when other interests are at stake, do not care enough about privacy to value it” # Despite all this, it is globally assumed that every citizen has a “reasonable expectation of privacy” (United Nations Universal Declaration of Human Rights of 1948, The European Convention of Human Rights of 1950) * Solove, D. “Understanding Privacy" . Harvard University Press. 2009. + Prost, R. C. “Three Concepts of Privacy” , 89 Georgetown Law Journal 2087,2087 (2001). - Westin, A. “Privacy and Freedom” . New York: Atheneum. 1967. ^ Franzen, J. “How to be Alone” . Picador. 2003. # Gotlieb, C. C. “Privacy: A Concept Whose Time Has Come and Gone” . Computers, Surveillance and Privacy , 156. 1996 Sources:

8. Patient Empowerment and Buy-In & Technology Privacy-enhancing technologies (PET) and research is vibrant Definition normally assumed: “Privacy is the right of individuals to determine for themselves when, how and to what extent information about them is communicated to others” (Alan Westin) Technology Protection Levels: Data, Application, Network. Highlight: Technical Privacy Controls build upon Security Controls are grounded in Access Control mechanisms. Observation: Lots of work, research, products in access control field. Question: How has PET impacted Healthcare? Has it led to Patient Empowerment? Has it been effective in getting patient buy-in? Impact: Access Control technology currently ineffective for Patient empowerment and Buy-In.

9. Patient Empowerment and Buy-In & Healthcare Trends Top Five Issues in Investigated Cases Closed with Corrective Action, by Calendar Year Observation 1: For the most part, Privacy Incidents seem to be on an upward trajectory. Observation 2: (Technical) Access Control issues have consistently been the top 3 issues. Health Information Privacy Resolutions Source: US Department of Health and Human Services http://www.hhs.gov/ocr/privacy/hipaa/enforcement/data/index.html

10. What does this all mean? Whole nations see the need for innovation and investment in Healthcare IT and Research, in order to: 1) reduce medical errors, 2) lower costs, and 3) improve patient care. There is an assumption that the systems will be secure and privacy-preserving There is an expectation that the next set of delivered systems will yield all these results (and not necessarily be a first step in a much longer process) The Prime Directive of Healthcare creates a criteria for the sustained use or irrelevance of healthcare IT This includes access control technology used in the health industry. Patient Empowerment (and Buy-in) is currently not being achieved by the contemporary set of access control technologies. Positives An amazing opportunity when the right factors converge to create an opportunity like no other – the power to influence a receptive industry in a relatively short timeline and positively impact the lives of billions of people. Concerns Super-hyped expectations, under-delivery, mis-focus, under-utilization, faulty assumptions may render health security/privacy a fad and negatively impact research in the field in years to come. Security Researchers need to step it up and to Proceed with Caution.

11. Where Not To Go Phases: Technology trigger – Something generates significant interest in the technology. Peak of inflated expectations – Over-enthusiasm and unrealistic expectations arise from a “frenzy of publicity”. Some successful stories arise, but there are typically more failures. Trough of disillusionment – Failure to meet expectations leads to technology losing its fashionable status and is abandoned by the press. Slope of enlightenment – Some businesses continue to use the technology and experiment to understand how it can be used effectively. Plateau of productivity – Benefits become widely demonstrated and accepted either broadly or within a niche. Gartner’s Hype Cycle The natural trajectory of similar phenomena – stuck in phase 3 of the Hype Cycle. The goal is to help research avoid this at all costs.

12. How to Proceed? Back to Basics A clear and neutral evaluation of the healthcare ecosystem A precise articulation of the access control requirements needed and expected. A brutally honest evaluation (and gap analysis) of existing technologies. This talk will not present all these concerns in detail. Remember: PROVOKE and PROMOTE THOUGHT Here, I provide clarity on how we got here and present a set of initial gaps.

13. The Healthcare Operating Environment Business What current tactical market needs offer the best yield? What strategies should I employ to maximize my desired outcomes? How best do I execute pipeline management on both service delivery and technology development? Legal What are legislative requirements I have to meet? How do the requirements impact my offerings (both in terms of process and technology development)? Are there additional compliance costs? Social What are the requirements emerging from the technology users and service consumers? How will all sets of end-users effectively interact or use the offering? What are the users’ expectations? Technology What technical innovations solve the current problem (set)? How to improve on the current technology suite? Build, retrofit, acquire, research or a mix? This Operating Environment is not specific to only the Healthcare market. It applies to other industries too As researchers, Technology and Social are the most immediate areas of contribution.

14. Healthcare Technology Cycle (Of Olde) Relevant Observations: Patients and Doctors are technology consumers, yet nowhere are their requirements acquired or interactions with the technology noted. Funding and Re-investment model is skewed towards the interests of the technology producers. Change to Modern Cycle: Hobbyist is a larger, more generic group. Has an idea on how to use technology to “improve healthcare” and develops a prototype Hobbyist Research Development Healthcare Company Patient Further refines Productizes Commercializes Sells to Resells to Sells to

15. So, What’s The Big Problem? And Why Do I Care Again? Problem: The marketplace is filled with expectations (both from businesses and patients). Both may have objective functions that are not always in sync. This creates a harmonious system of conflicts, that are often resolved through public relations. This dichotomy highlights a very important point: Your beliefs or expectations on or about a particular aspect of the healthcare system may not always be a function of what is real. This is one of the more prominent reasons why Researchers should care – to bridge the gap between reality and the matrix. The Real World The Matrix

16. Access Control Beliefs in Healthcare (Patients): Their healthcare data is their own and that actions are only performed that are to their benefit, i.e. they assume they retain data ownership rights . (Patients): Healthcare providers and payers use their data responsibly and safely in order to delivery the best care, i.e. they assume that they have great data stewards . (Patients): They have strong legal protections in place to safeguard their information. (Patients): Their data is always protected. (Patients): They ultimately have a say in the use of their data. (Patients): They have the right and ability to see what is happening with data. (Patients): Assume that mature security technology exists to address a majority of their concerns. (Practitioners): Security technology will seamlessly integrate their way of doing things. (Payers): Security and Privacy controls are counter to their objective function. (Practitioners, Payers): Access Control solutions negatively impact service delivery. Sources: California Healthcare Foundation. "Consumers and Health Information Technology: A National Survey" . April 2010. Ponemon Institute. "Americans' Opinions about Healthcare Privacy" , January 2010. Deloitte Center for Health Solutions. “Global 2010 Survey of Health Care Consumers”, 2010. Ponemon Institute. “Electronic Health Information at Risk” , October 2009. Ackerman, L. "A Consumer Perspective on Healthcare Privacy" . 2006.

17. Access Control in Healthcare Realities All access control technologies are specified from the perspective of the entity that stores the data. They assume that once the data is in one’s possession, then you are the data owner. Succinctly: data stewardship equals data ownership . Access control policy is written by the security admin, whose allegiance is to the interests of the firm he/she works for. Technologies that enforce compliance legislation compliance cannot be assumed to offer strong legal protections for a patient. Security exceptions represent a high proportion of data accesses (varies by region and function, but reported over 50% in most cases). Patient Choice is not a fundamental facet of current access control systems. Workflow Access Control systems few and still in the research phase. Patient Accountability and Transparency controls are still in the plan phase for healthcare. Sources: Grandison, T., Bhatti, R. "HIPAA Compliance and Patient Privacy Protection" . To appear in the Proc. of the 13th World Congress on Medical and Health Informatics (MEDINFO). September 12-15, 2010. Cape Town, South Africa. Rostad L., Edsberg, O. “A study of access control requirements for healthcare systems based on audit trails from access logs” . In Proc. of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference (ACSAC), Miami Beach, Florida, USA, December 2006. Russello, G., Dong, C., Dulay, N. “A Workflow-Based Access Control Framework for e-Health Application” , International Conference on Advanced Information Networking and Applications Workshops, 2008. Computer Science and Telecommunications Board. “For the Record: Protecting Electronic Health Information” . National Academies Press. 1997.

18. The Initial Hard Access Control Questions Re-enforcing the separation between church and state (i.e. steward and owner) For RBAC systems, Is it as simple as added an extra construct ???? If so, what is the impact on the standard operation of a RBAC system? How does one deal with the mindset change necessary to provide consistent use of this idea? How does one specify the owner’s data handling desires/preferences and combine them into a larger policy for the data steward that can be consistently, reliably and efficiently enforced? Handling the evolution of exceptions Are current proposals sufficient? If so, should they be standardized? (at least for healthcare) Modeling Choice Is it just re-thinking a matter of rethinking notification? ……………………

19. Insert Solution Here

20. CONCLUSION It is a great time to do Healthcare security and privacy research It is important work with grave consequences and amazing benefit. There is currently significant investment in Health IT There are interesting Industry constraints that make this work research-worthy. There is a more aware public whose cooperation must be had to extract value from these health IT systems. The expectations are tremendous and we must deliver or face possible stagnation in future. BLTS  and the influence of technology producers has led to: A misalignment of perception and practice, i.e. the creation of a matrix The creation of technology with assumptions that were taken as the natural order of things, but which do not serve the technology end-users. Most dominant, engrained and subtle of these assumptions is the equality of data stewardship and data ownership . Access Control research must also provide more focused support for exception life cycle management, choice, workflow integration and patient accountability and transparency for Healthcare. The good news is that there is initial in some of these areas. The bad news is that the public and funders expect harden technology (not research code) in the next wave of health IT.

21. CALL TO ACTION Hopefully, you are now (somewhat) convinced that the current state of Access Control practices in Healthcare needs improvement. If not, evaluate it for yourself. Engage hospitals, medical research centers, etc. Listen to them and get their requirements. Don’t try to fit your exotic solution to whatever problem they state. Find the genuine solution. Learn how they work. Understand their motivations. Learn how they interact and use technology systems. Uncover their assumptions. Wash, Rinse and Repeat for patients. Question! Question! Question! Question your models. Question your assumptions. Question your motivations. Understand how everything fits into the BLTS considerations Deliver Understand their expectations Manage their expectations Never under-deliver.

22. You take the Blue Pill , The story Ends. You wake up in your bed and believe whatever you to believe. You take the Red Pill , You stay in Wonderland and I show You how deep the rabbit hole goes. I'm only offering you the TRUTH Nothing more