1

Confidentiality, Privacy, and Security

William A. Yasnoff, MD, PhD

Oregon Health Division

2

Overview

Definitions Fair Information Practices Policies and Procedures Legislation Authentication Encryption Firewalls WWW security

3

Definitions

PRIVACY: The right of individuals to hold information about themselves in secret, free from the knowledge of others.

4

Definitions (continued)

CONFIDENTIALITY: The assurance that information about identifiable persons, the release of which would constitute an invasion of privacy for any individual, will not be disclosed without consent except as allowed by law.

5

Definitions (continued)

SECURITY: The mechanisms by which confidentiality policies are implemented in computer systems, including provisions for:

–Access control

– Integrity

–Availability

6

Definitions (continued)

IDENTIFIABLE INFORMATION: Any information, including but not limited to demographic information, which will identify or may reasonably lead to the identification of one or more specific individuals.

7

Definitions (continued)

CONFIDENTIAL DATABASE: Any collection or grouping of information about individuals maintained by the Division in electronic form which is not comprised solely of public records subject to release on request, and the release of which could represent a breach of confidentiality. . . .

8

Definitions (continued)

. . . Such information includes, but is not limited to demographic information, medical or testing histories, clinical information, employment or financial status, the results of special studies, participation in or exclusion from specific programs, sources of . . .

9

Definitions (continued)

. . . information, or new collections of information derived from the linkage of one or more previously existing confidential databases.

10

Fair Information Practices

Relevance Integrity Written Purpose Need-to-Know Access Correction Consent

11

1. Relevance

All information collected should be necessary and relevant to public health or required by law.– individuals entitled to privacy– benefits of information should outweigh

privacy concerns– collection not overly burdensome, intrusive,

or coercive

12

2. Integrity

The integrity of information should be protected.– prevent loss, interception, misuse– maintain accurate, complete, timely data– no unauthorized alteration or destruction

13

3. Written Purpose

All information collected should be consistent with written public health purposes and/or required by law. – databases must have written purpose(s)– usage restricted to stated purpose(s)– linkage of databases considered a new

database

14

4. Need-to-Know Access

All confidential information should be accessible only on a need-to-know basis, both internally and externally.– confidentiality agreements for all personnel– access terminated when duties change– no redisclosure– external release for research requires IRB

approval

15

5. Correction

Individuals should have access to information about themselves and the ability to correct this information to the extent allowed by law.– maintain public list of all databases» name of database

» description of information included

» information sources (non-confidential)

– disputed data must be marked

16

6. Consent

Information must be collected with the consent of the individual except as required by law.– informed consent» purpose of information collection

» data protections in place

» consequences of withholding information

– no consent if waived by law

17

Confidentiality Policies

Fair Information Practices Data Release Restrictions Personnel Agreements

18

Data Release Restrictions

Release without review is restricted

Denominator > 50 [population data]

Denominator > 10 [cohort data]

19

Personnel Issues

All personnel to sign confidentiality agreements periodically

Special provisions for data system administrators

20

Confidentiality Provisions

Definition of confidential information Need-to-know access only No redisclosure If questions, ask supervisor Breach will result in disciplinary action Confidentiality must be maintained

indefinitely

21

Data System Administrators

Information used only as needed for administration of computer system

Access granted to others only in accordance with established policies and procedures

Disciplinary action for violations may be termination on first offense

22

Legislation

Health Insurance Portability and Accountability Act (HIPAA) [1996]– privacy standards by August 1997– security standards by February 1998– universal health identifier

Fair Health Information Practices (bill introduced in 105th Congress)

23

Security

Authentication Encryption Firewalls WWW

24

Authentication

Who are you talking to? Methods– what the user knows (password)– what the user has (smartcard)– what the user is (biometrics)

25

Passwords

Longer is better Never use dictionary words word1;word2 is good working model Never write or store passwords On network, passwords often travel in the

clear

26

End-to-End Authentication Cryptography based Challenge-response– response generated with encryption– challenge varies to defeat interception

Time synchronized– password depends on time of day– user-carried device generates password– good for system administrators

27

Kerberos User asks “key server” for access to target

system Key server creates message, encrypts with

user key, sends User decrypts message, then encrypts with

“access key” of target system Key server sends “session key” to user

and target system (both encrypted)

28

Kerberos

Key server must be secure Allows mediation by third party of access

among multiple systems Potential model for electronic medical

record exchange Developed at MIT

29

Cryptography

Convert plaintext into message readable only with “key”

DES = data encryption standard– 64 bit message– 56 bit key– uses repeated substitution, transposition– breakable in reasonable time with large

computer system (31 hrs @ $100K, 20 minutes @ $10 MM)

30

Cryptography

Triple-DES– apply DES three times– three different keys (168 bits total)– now used for automated teller transactions

31

Public Key Cryptography

Public Key– in phone directory

Private Key– known only to recipient

Message encrypted with either key can be decrypted with the other– sender encrypts with one key, receiver

decrypts with the other key

32

RSA Cryptography

Public key is product p x q Private key is factors p, q Security derived from difficulty in

computing factors p, q if pq is large Larger key size provides more security

33

Firewalls

Separate, dedicated computer system Filters packets based on source and/or

destination Mount disks read only Eliminate all unnecessary commands and

services Minimum number of user accounts

34

Firewalls as Proxy Servers

Firewall connects to outside system, not your system

By acting as your “proxy”, your system is protected from the outside system

Can be used for– telnet (session)– ftp (file transfer)

35

Intrusion Detection Look for unusual access patterns or activity Types of evaluation– statistical– rule-based

Example: lock account after 3 failed login attempts

Assume all systems are subject to attempted unauthorized use

36

WWW Security

server scripts (Java) can execute programs on your machine!

Types of WWW security– SSL = secure sockets layer» secure “pipe” between two machines

» transparent to application

– S-HTTP = secure HTTP» secure “envelopes” for messages

» built into browsers

37

Security Pearls

Back up key files Use encryption on sensitive data Use good passwords Network security requires expertise– authentication– encryption– firewalls