Secure Patient-Centric EHR with a Keeper

Abstract

Different types of health information systems have been previously proposed, and most of these are designed to handle information in specific locations within health care institutions, such as hospitals, labs, etc. However, in such health information systems, patients do not have control of their health information. When a patient’s health information, including name, disease, treatment, etc., is disclosed, patients will receive their health information after filing a notification of the disclosure. Also, when an authorized health specialist uses patients’ data, it is difficult for patients to know why and how their health information will be used. However, more and more patients want to control their health care information, and as a result, we propose a new patient-centric EHR. We define a patient-centric EHR system in order to enable patients to control the flow of their health information. We analyzed the security requirements for the patient-centric EHR through attack scenarios and proposed a new secure protocol with a keeper that can be used in patient-centric EHR, in which every entity must be granted permission to access the EHR of the patients. We showed that it is hard to attack the proposed patient-centric EHRs through collusion attack between authorized entities.