PbDinEHR: A Novel Privacy by Design Developed Framework Using Distributed Data Storage and Sharing for Secure and Scalable Electronic Health Records Management

Privacy in Electronic Health Records (EHR) has become a significant concern in today's rapidly changing world, particularly for personal and sensitive user data. The sheer volume and sensitive nature of patient records require healthcare providers to exercise an intense quantity of caution during EHR implementation. In recent years, various healthcare providers have been hit by ransomware and distributed denial of service attacks, halting many emergency services during COVID-19. Personal data breaches are becoming more common day by day, and privacy concerns are often raised when sharing data across a network, mainly due to transparency and security issues. To tackle this problem, various researchers have proposed privacy-preserving solutions for EHR. However, most solutions do not extensively use Privacy by Design (PbD) mechanisms, distributed data storage and sharing when designing their frameworks, which is the emphasis of this study. To design a framework for Privacy by Design in Electronic Health Records (PbDinEHR) that can preserve the privacy of patients during data collection, storage, access and sharing, we have analysed the fundamental principles of privacy by design and privacy design strategies, and the compatibility of our proposed healthcare principles with Privacy Impact Assessment (PIA), Australian Privacy Principles (APPs) and General Data Protection Regulation (GDPR). To demonstrate the proposed framework, ‘PbDinEHR', we have implemented a Patient Record Management System (PRMS) to create interfaces for patients and healthcare providers. In addition, to provide transparency and security for sharing patients' medical files with various healthcare providers, we have implemented a distributed file system and two permission blockchain networks using the InterPlanetary File System (IPFS) and Ethereum blockchain. This allows us to expand the proposed privacy by design mechanisms in the future to enable healthcare providers, patients, imaging labs and others to share patient-centric data in a transparent manner. The developed framework has been tested and evaluated to ensure user performance, effectiveness, and security. The complete solution is expected to provide progressive resistance in the face of continuous data breaches in the patient information domain.

Introducing Ethics by Design in Engineering Education: Designing COVID-19 Tracing Apps

Including ethical concepts and considerations in engineering education has attracted significant interest in recent years, mainly due to the impact of some AI applications in different areas of our life. The use of case studies in teaching ethics is a well-known and useful approach. The debate related with a given case study helps students think about the implications, motivations and foreseeable impact of the technologies. This fact is in contrast with the common easy-thinking that technologies are neutral and that an engineer should not bother about ethics and does not have any responsibility at all. While many basic technologies may be considered neutral, more developed and complex systems are not so neutral;they have a motivation and some foreseeable impact and consequences. Thence, the main message is that engineers have a responsibility when developing these systems. This paper presents a case study used in a course for Ph.D. students in a Technical University to introduce the concept of ethics by design and to stress the idea of responsible conduct in engineering. The case under study is the design and development of tracing applications for fighting against the Covid-19 pandemic in 2020. The analysis of the case requires to understand the basic technologies proposed, the different alternatives considered at that time, the basic facts related with the contagion chain and the main factors to be addressed, the consideration of the balance between public health rights and individual privacy rights, and the social aspects related with the acceptability by citizens. © 2022 SEFI 2022 - 50th Annual Conference of the European Society for Engineering Education, Proceedings. All rights reserved.

On the privacy of mental health apps: An empirical investigation and its implications for app development.

An increasing number of mental health services are now offered through mobile health (mHealth) systems, such as in mobile applications (apps). Although there is an unprecedented growth in the adoption of mental health services, partly due to the COVID-19 pandemic, concerns about data privacy risks due to security breaches are also increasing. Whilst some studies have analyzed mHealth apps from different angles, including security, there is relatively little evidence for data privacy issues that may exist in mHealth apps used for mental health services, whose recipients can be particularly vulnerable. This paper reports an empirical study aimed at systematically identifying and understanding data privacy incorporated in mental health apps. We analyzed 27 top-ranked mental health apps from Google Play Store. Our methodology enabled us to perform an in-depth privacy analysis of the apps, covering static and dynamic analysis, data sharing behaviour, server-side tests, privacy impact assessment requests, and privacy policy evaluation. Furthermore, we mapped the findings to the LINDDUN threat taxonomy, describing how threats manifest on the studied apps. The findings reveal important data privacy issues such as unnecessary permissions, insecure cryptography implementations, and leaks of personal data and credentials in logs and web requests. There is also a high risk of user profiling as the apps' development do not provide foolproof mechanisms against linkability, detectability and identifiability. Data sharing among 3rd-parties and advertisers in the current apps' ecosystem aggravates this situation. Based on the empirical findings of this study, we provide recommendations to be considered by different stakeholders of mHealth apps in general and apps developers in particular. We conclude that while developers ought to be more knowledgeable in considering and addressing privacy issues, users and health professionals can also play a role by demanding privacy-friendly apps. Supplementary Information: The online version contains supplementary material available at 10.1007/s10664-022-10236-0.

CampusTracer: A Privacy-Aware Contact Tracing Protocol for Campus Environments

Contact tracing has become a major weapon against fighting the spread of diseases like SARS-CoV-2. Unfortunately, the ability to inform potentially infected people always comes with a downside to privacy, as contacts traced could also be misused in other contexts. In this paper, we present CampusTracer, a novel contact tracing system specialized for university campus environments. Based on an in-depth analysis of existing contact tracing approaches and university-specific requirements, we elaborate a Privacy-by-Design solution to contact tracing that caters for most real-world requirements while preserving the privacy of its users in a best-possible way. © 2022 IEEE.

Bridging the Health Disparity of African Americans through Conversational Agents

African Americans have faced health disparities in terms of access to health care and treatment of illnesses. The novel coronavirus disease 2019 pandemic exacerbates those disparities caused by limited access to medical care and healthy lifestyles, vulnerability to misleading information, and mistrust of the medical profession, all of which disproportionately affect the African American population in terms of infection and mortality. Conversational agents (CAs) are a technological intervention with the potential to narrow the disparities because they make health care more accessible, are effective in disseminating health information among a population with low health literacy, and can increase users' trust in health information. However, designing CAs for this population presents challenges with regard to embodying the African American culture into CAs and addressing privacy and security concerns. This commentary discusses some advantages and challenges of using CAs to help African Americans protect themselves against coronavirus disease 2019, and calls for more research in this area. © 2020 ACM.

Digitally Sustainable Information Systems in Axiomatic Design

Nowadays, information systems are evolving towards increasingly interconnected, smart, and self-adaptive models. This transformation has led to the representation of the systems themselves in terms of natural ecosystems. Similar to the natural environment, the virtual world can be threatened by specific forms of pollution, such as illegitimate access to the system, unwanted changes to data, and loss of information, which affect the only resource it possesses, i.e., data. In order to provide proactive protection of data integrity and confidentiality, in this paper we consider the well-known principles of privacy by design and privacy by default in the design phase of system development. To this end, we propose an approach based on axiomatic design, which allows us to implement these two principles through an appropriate reinterpretation of the information axiom, in terms of privacy impact assessment. We illustrate our approach by a case study, which implements the process of managing patients in home care. However, the proposed method can be applied to processing systems that provide services. The main result achieved is to select the most digitally sustainable design solution, i.e., the one that best prevents the threats mentioned above.