A data protection scheme for a remote vital signs monitoring healthcare service

• Published in: Medical informatics and the internet in medicine 2000, Vol.25 (3), p.207-224
• Main Author: Lambrinoudakis, D. Gritzalis, C.
• Format: Article
• Language: English
• Subjects: Biological and medical sciences; Computer Security; Computerized management (medical records, files, hospital management); Computerized, statistical medical data processing and models in biomedicine; Data Protection Healthcare Information Systems Security Patient Home Monitoring Cramm Risk Analysis Risk Management Security Measures; Home Care Services - organization & administration; Medical sciences; Public health. Hygiene; Public health. Hygiene-occupational medicine; Risk Management - organization & administration; Teaching. Deontology. Ethics. Legislation; Telemetry - methods
• ISSN: 1463-9238; 1464-5238
• DOI: 10.1080/146392300750019208

Personal and medical data processed by Healthcare Information Systems must be protected against unauthorized access, modification and withholding. Security measures should be selected to provide the required level of protection in a cost-efficient manner. This is only feasible if specific characteristics of the information system are examined on a basis of a risk analysis methodology. This paper presents the results of a risk analysis, based on the CRAMM methodology, for a healthcare organization offering a patient home-monitoring service through the transmission of vital signs, focusing on the identified security needs and the proposed countermeasures. The architectural and functional models of this service were utilized for identifying and valuating the system assets, the associated threats and vulnerabilities, as well as for assessing the impact on the patients and on the service provider, should the security of any of these assets is affected. A set of adequate organizational, administrative and technical countermeasures is described for the remote vital signs monitoring service, thus providing the healthcare organization with a data protection framework that can be utilized for the development of its own security plan.