[Security services: an overview of the French legislation on cryptography]. / Les services de sécurité des informations: le point sur la réglementation française en cryptologie.

This paper deals with the main security services of data protection: integrity, authentication, nonrepudiation and confidentiality. It describes the different tools which may be used to achieve these security objectives: encryption, digital signature, access controls, integrity control, audit and certification. The French legislation concerning encryption has been recently updated in order to simplify the use of encryption techniques for personal data security. This legislation describes different authorization or reporting procedures according to the type of the request (application, equipment, import or export of encryption techniques) and the security level required.

[Security of healthcare data networks used for epidemiological studies]. / La sécurité des réseaux d'informations médicales: application aux études épidémiologiques.

Record linkage, for compiling sameperson records from various source files, can improve the feasibility of epidemiological research using populationbased studies. The question is comply with the European legislation on data privacy and data security. For example, a computerized record hash coding and linkage procedure is described to link medical information within the framework of epidemiological followup. Before their extraction, files are rendered anonymous using a oneway hash coding based on the standard hash algorithm (SHA) function. Once rendered anonymous using the software ANONYMAT, the linkage of patient information can be accomplished by means of a mixture model, taking into account several identification variables. An application of this anonymous record linkage procedure was carried out in order to link medical files on cancer, from 3 hospitals of the French RhôneAlpes region. This application stresses how the use of the ANONYMAT software allows compliance with the legislation on data confidentiality without entailing problems on data availability.

Anonymous statistical methods versus cryptographic methods in epidemiology.

Sensitive data are most often indirectly identifiable and so need to be rendered anonymous in order to ensure privacy. Statistical methods to provide anonymity require data perturbation and so generate data processing difficulties. Encryption methods, while preserving confidentiality, do not require data modification.

Anonymous statistical methods versus cryptographic methods in epidemiology.

Sensitive data are most often indirectly identifiable and so need to be rendered anonymous in order to ensure privacy. Statistical methods to provide anonymity require data perturbation and so generate data processing difficulties. Encryption methods, while preserving confidentiality, do not require data modification.

High cost factors for leukaemia and lymphoma patients: a new analysis of costs within these diagnosis related groups.

STUDY OBJECTIVE: To determine high cost factors to help managers and clinicians to analyse the reasons of adverse costs and provide indications for financial negotiation. DESIGN: To locate high cost or long stay patients, the analysis was designed on the basis of a mixture of Weibull distributions. In this new model, the proportion of high cost patients was expressed according to the multinomial logistic regression, permitting the determination of high cost factors. SETTING: The 1993 French reference database, constituted in the framework of the national study of DRG costs, conducted by the French Ministry of Health. The database of discharge abstracts recorded in 1993 in the Dijon public teaching hospital. PARTICIPANTS: The analyses were based on 1352 abstracts from the French reference database and 368 from the Dijon database concerning patients, aged 18 and over, suffering from leukaemia and lymphoma. MAIN RESULTS: High cost and long stay factors were the same: number of stays, death, transfer, acute leukaemia, neutropenia, septicaemia, high dose aplastic chemotherapy, central venous catheterisation, parenteral nutrition, protected or laminar airflow room, blood transfusion, and intravenous antibiotherapy. CONCLUSIONS: Taking into account high cost predictive factors, as shown in the case of leukaemia and lymphoma patients, would help to reduce the adverse effects of a prospective payment system.

Modeling of high-cost patient distribution within renal failure diagnosis related group.

Modeling by mixed-distribution was proposed in order to analyze heterogeneity of costs and length of stays within Diagnosis Related Groups (DRGs). A mixed-distribution model based on Weibull distributions was applied to 791 discharge abstracts of French DRG no. 450 (Health Care Financing Administration 3 DRG no. 316 "Renal failure") from a national database. Three subgroups of cost and length of stay were identified. Except for age, clinical criteria significantly linked with the long-stay subgroup were the same as those associated with the high-cost subgroup: acute renal failure, intensive care, infectious complications, and vascular investigations. The identification of factors associated with high costs, based on the proposed model, will allow physicians to understand more accurately how their choice of specific procedures influences hospital costs.

Can a database be anonymous?

Sensitive data are most often indirectly identifiable and so need to be rendered anonymous in order to ensure privacy. Statistical methods to provide anonymity require data perturbation and so generate data processing difficulties. Encryption methods, while preserving confidentiality, do not require data modification.

Application of the medical data warehousing architecture EPIDWARE to epidemiological follow-up: data extraction and transformation.

In this paper, we present an application of EPIDWARE, medical data warehousing architecture, to our epidemiological follow-up project. The aim of this project is to extract and regroup information from various information systems for epidemiological studies. We give a description of the requirements of the epidemiological follow-up project such as anonymity of medical data information and data file linkage procedure. We introduce the concept of Data Warehousing Architecture. The particularities of data extraction and transformation are presented and discussed.

Automatic record hash coding and linkage for epidemiological follow-up data confidentiality.

A protocol is proposed to allow linkage of anonymous medical information within the framework of epidemiological follow-up studies. The protocol is composed of two steps; the first concerns the irreversible transformation of identification data, using a one-way hash function which is used after spelling processing. To avoid dictionary attacks, two large random files of keys, called pads, are introduced. The second step consists in the linkage of files rendered anonymous. The weight given to each linkage field is estimated by a mixture model, the likelihood of which being maximized with the Expectation and Maximization (EM) algorithm. The performance of this method has been assessed by comparing record linkage, based on exclusive use of the automatic procedure, with a manual linkage, obtained by the Burgundy Registry of Digestive Cancers. The result of the linkage of a file of 2,847 cancers with a file of 388,614 hospitalization stays in the Dijon university hospital showed a sensitivity of 97% and a specificity of 93%.

How to ensure data security of an epidemiological follow-up: quality assessment of an anonymous record linkage procedure.

A computerised record hash coding and linkage procedure is proposed to allow the chaining of medical information within the framework of epidemiological follow-up. Before their extraction, files are rendered anonymous using a one-way hash coding based on the standard hash algorithm (SHA) function, in order to respect the legislation on data privacy and security. To avoid dictionary attacks. two keys have been added to SHA coding. Once rendered anonymous, the linkage of patient information can be accomplished by means of a statistical model, taking into account several identification variables. Quality assessment of this anonymous record linkage procedure shows a specificity of 100% and a sensitivity of 95%.

Telemedicine: responsibilities and contractual framework.

The rapid growth of telemedicine has created a need for a definition of the responsibilities of the doctors involved. These responsibilities must be analyzed according the tort of negligence as a function of the level of competence of each doctor, their unequal access to the relevant information and their command of the telemedicine system. This analysis leads on to a study of the legal value of the electronic records kept and the ways in which the doctors are remunerated.

A marker-free system for the analysis of movement disabilities.

A major step toward improving the treatments of disabled persons may be achieved by using motion analysis equipment. We are developing such a system. It allows the analysis of plane human motion (e.g. gait) without using the tracking of markers. The system is composed of one fixed camera which acquires an image sequence of a human in motion. Then the treatment is divided into two steps: first, a large number of pixels belonging to the boundaries of the human body are extracted at each acquisition time. Secondly, a two-dimensional model of the human body, based on tapered superquadrics, is successively matched with the sets of pixels previously extracted; a specific fuzzy clustering process is used for this purpose. Moreover, an optical flow procedure gives a prediction of the model location at each acquisition time from its location at the previous time. Finally we present some results of this process applied to a leg in motion.

Security aspects of medical file regrouping for the epidemiological follow-up.

To carry out epidemiological studies at a regional level, one may need to link information collected by medical doctors working either in hospitals or in private offices or laboratories. The first problem is to respect the European legislation on nominal data processing, which does not allow the linkage of nominal files. As a consequence, we have developed an anonymous record linkage procedure, which ensures an irreversible transformation of identity and allows the linkage of rendered anonymous files. The second problem is to ensure data security during the transmission and we discuss the advantages of different methods of communication such as the norms X400 and Internet protocols.

[Modelling of length of stay and costs in 2 homogeneous groups of hematological and pneumological patients: clinical characterization of patients with long-stay and high costs]. / Modélisation de la distribution des durées de séjour et des coûts dans deux groupes homogènes de malades d'hématologie et de pneumologie: caractérisation clinique des patients de longue durée et de coût élevé.

After the implementation of the Medicare Prospective Payment System (PPS) in the USA, many European countries like France have introduced DRGs to curb hospital overspending. However, there has been some reluctance from hospital actors, especially because of the heterogeneous nature of DRG's. To analyse this situation, we propose a method based on distribution modelization of length of stays and costs within DRGs. For each DRG, the model is based on a mixture of Poisson and Weibull distributions identified as subgroups. The subgroups are characterized by their means and their proportions which are estimated by maximization of data likelihood. For a particular DRG, the proportion of long stay or high-cost patients can be explained by the introduction of clinical variables in the model. First the model was applied to the DRG "leukemia and lymphoma" (HCFA V.3), using 133 discharge abstract files from the Dijon public teaching hospital which were classified into this DRG in 1993. Among the studies parameters only acute leukemia, neutropenia < 500 PNN/mm3, high dose aplastic chemotherapy, central venous catheterization, parenteral nutrition, use of protected or laminar air flow room, septicemia, large spectrum intravenous antibiotherapy, and blood transfusion had a significant influence on the distribution of the patients in the long stay or costly subgroup. Second, for DRG "chronic bronchopneumopathies" (n = 220) the significant parameters were mechanical ventilation, antibiotherapy, post hospitalization medicalized care.

Basic rules for the security of frozen section diagnosis through image transmission between anatomo-pathologists.

Telemedicine can provide an alternative solution to the lack of medical resources in areas where the population is no longer dense enough to justify the temporary or permanent presence of certain specialists such as anatomo-pathologists. In the long run certain pre-operational frozen section examinations cannot be carried out without putting the quality of healthcare at stake. The telematic transmission of macro and microscopic images of lesions, under the supervision of a surgeon, to an anatomo-pathologist consultant located off premises allows for the maintenance of equitable care of acceptable quality.

A computerized record hash coding and linkage procedure to warrant epidemiological follow-up data security.

A computerized record hash coding and linkage procedure is proposed to allow the chaining of medical information within the framework of epidemiological follow-up. Before their extraction, files are rendered anonymous using a one-way hash coding based on the SHA function, in order to respect the legislation on data privacy and security. To avoid dictionary attacks, two keys have been added to SHA coding. Once rendered anonymous, the linkage of patient information can be accomplished by the means of a statistical model, taking into account several identification variables.

Irreversible encryption method by generation of polynomials.

Patient follow up, within the framework of epidemiological studies, poses the problem of linking nominal files. An encryption method of identity is proposed to allow the linkage of medical information on the same patient while respecting the confidentiality of medical data. In contrast with most encryption algorithms, the proposed method is mathematically irreversible in response to the requirement of the French National Commission of Computerized Information Security which demands that the cryptosystem must not be decipherable even by the legitimate recipient. In order to prevent deciphering by frequency analysis, the proposed method introduces polynomial operations so that neither indication concerning the length of the string nor a possible repetition of characters can be obtained by code disclosure. The security of the system is reinforced by the use of two keys, the first one to be defined by the producers of information and the second one by the recipient so that nobody can decrypt the enciphered text.

[Computerized medical record: deontology and legislation]. / Dossier médical informatisé: déontologie et législation.

Computerization of medical records is making headway for patients' follow-up, scientific research, and health expenses control, but it must not alter the guarantees provided to the patients by the medical code of ethics and the law of January 6, 1978. This law, modified on July 1, 1994, requires to register all computerized records of personal data and establishes rights to protect privacy against computer misdemeanor. All medical practitioners using computerized medical records must be aware that the infringement of this law may provoke suing in professional, civil or criminal court.

Extraction and anonymity protocol of medical file.

To carry out the epidemiological study of patients suffering from a given cancer, the Department of Medical Informatics (DIM) has to link information coming from different hospitals and medical laboratories in the Burgundy region. Demands from the French department for computerized information security (Commission Nationale de l'Informatique et des Libertés: CNIL), in regard to abiding by the law of January 6, 1978, completed by the law of July 1st, 1994 on nominal data processing in the framework of medical research have to be taken into account. Notably, the CNIL advised to render anonymous patient identities before the extraction of each establishment file. This paper describes a recently implemented protocol, registered with the French department for computerized information security (Service Central de la Sécurité des Systèmes d'information : SCSSI) whose purpose is to render anonymous medical files in view of their extraction. Once rendered anonymous, these files will be exportable so as to be merged with other files and used in a framework of epidemiological studies. Therefore, this protocol uses the Standard Hash Algorithm (SHA) which allows the replacement of identities by their imprints while ensuring a minimal collision rate in order to allow a correct linkage of the different information concerning the same patient. A first evaluation of the extraction and anonymity software with regard to the purpose of an epidemiological survey is described here. In this paper, we also show how it would be possible to implement this system by means of the Internet communication network.