Jump to content

Masking (Electronic Health Record): Difference between revisions

Add links
From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
KolbertBot (talk | contribs)
Bots
1,166,042 edits
Citation bot (talk | contribs)
Bots
4,957,472 edits
m Alter: doi, template type, url. Add: isbn, pmc, pmid, pages, volume, journal, website, issue, author pars. 1-9. Removed accessdate with no specified URL. Removed parameters. Formatted dashes. | You can use this bot yourself. Report bugs here. | User-activated.
Line 1: Line 1:
{{Orphan|date=May 2013}}
{{Orphan|date=May 2013}}


In [[Electronic health records|Electronic Health Records]] (EHR’s) '''data masking''', or [[controlled access]],<ref>{{cite journal |url= http://www.nature.com/gim/journal/v10/n7/pdf/gim200876a.pdf |title= Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider |accessdate= 2013-04-14|last= |first= |year= 2013 |doi= 10.1097/gim.0b013e31817a8aaa |volume=10 |journal=Genetics in Medicine |pages=495–499}}</ref> is the process of concealing patient health data from certain [[healthcare]] providers. Patients have the right to request the masking of their personal information, making it inaccessible to any [[physician]], or a particular physician, unless a specific reason is provided.<ref>{{cite web |url= http://ihcrp.georgetown.edu/pdfs/prittse-consent.pdf |title= The Implementation of e-Consent in Three Countries: Canada, England and the Netherlands |accessdate= 2013-04-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Data masking is also performed by healthcare agencies to restrict the amount of information that can be accessed by external bodies such as [[researchers]], [[health insurance]] agencies and unauthorised individuals. It is a method used to protect patients’ sensitive information so that [[privacy]] and [[confidentiality]] are less of a concern. Techniques used to alter information within a patient’s [[Electronic health record|EHR]] include data [[encryption]], [[obfuscation]], [[Cryptographic hash function|hashing]], exclusion and perturbation.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
In [[Electronic health records|Electronic Health Records]] (EHR’s) '''data masking''', or [[controlled access]],<ref>{{cite journal |url= http://www.nature.com/gim/journal/v10/n7/pdf/gim200876a.pdf |title= Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider |accessdate= 2013-04-14|year= 2013 |doi= 10.1097/gim.0b013e31817a8aaa |volume=10 |issue= 7 |journal=Genetics in Medicine |pages=495–499|last1= McGuire |first1= Amy L. |last2= Fisher |first2= Rebecca |last3= Cusenza |first3= Paul |last4= Hudson |first4= Kathy |last5= Rothstein |first5= Mark A. |last6= McGraw |first6= Deven |last7= Matteson |first7= Stephen |last8= Glaser |first8= John |last9= Henley |first9= Douglas E. }}</ref> is the process of concealing patient health data from certain [[healthcare]] providers. Patients have the right to request the masking of their personal information, making it inaccessible to any [[physician]], or a particular physician, unless a specific reason is provided.<ref>{{cite web |url= http://ihcrp.georgetown.edu/pdfs/prittse-consent.pdf |title= The Implementation of e-Consent in Three Countries: Canada, England and the Netherlands |accessdate= 2013-04-14|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> Data masking is also performed by healthcare agencies to restrict the amount of information that can be accessed by external bodies such as [[researchers]], [[health insurance]] agencies and unauthorised individuals. It is a method used to protect patients’ sensitive information so that [[privacy]] and [[confidentiality]] are less of a concern. Techniques used to alter information within a patient’s [[Electronic health record|EHR]] include data [[encryption]], [[obfuscation]], [[Cryptographic hash function|hashing]], exclusion and perturbation.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref>


==Confidentiality==
==Confidentiality==
The increased access that transpires from introducing EHR's is seen as a large concern to some [[Electronic health record|patients]].<ref>{{cite web |url= http://jamia.bmjjournals.com/content/11/6/505.short |title= Patient Experiences and Attitudes about Access to a Patient Electronic Health Care Record and Linked Web Messaging |accessdate= 2013-05-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Masking information is a technique that contributes to establishing the [[confidentiality]] of EHR's, as a large amount of sensitive information is contained within these records. History of health outcomes such as drug/alcohol abuse, [[sexually transmitted infections]] or [[abortion]] during pregnancy are known to lead to social [[discrimination]] and cause social harm to the patient, hence the importance of protecting the content within EHR's.<ref>{{cite web |url= http://171.67.114.118/content/3/2/139.short |title= Authorisation and access control for electronic health record systems |accessdate= 2013-06-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Masking limits the access that internal and external individuals can have to a particular record, increasing the protection of its contents. When patients apply for masking of their EHR, [[health services]] must meet their needs and alter the system accordingly so that unauthorised individuals can't gain access.<ref>{{cite journal |url= http://www.nature.com/gim/journal/v10/n7/abs/gim200876a.html |title= Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider |accessdate= 2013-06-01|last= |first= |year= 2013 |work= |publisher= |doi= 10.1097/GIM.0b013e31817a8aaa|quote= |volume=10 |journal=Genetics in Medicine |pages=495–499}}</ref>
The increased access that transpires from introducing EHR's is seen as a large concern to some [[Electronic health record|patients]].<ref>{{cite web |url= http://jamia.bmjjournals.com/content/11/6/505.short |title= Patient Experiences and Attitudes about Access to a Patient Electronic Health Care Record and Linked Web Messaging |accessdate= 2013-05-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> Masking information is a technique that contributes to establishing the [[confidentiality]] of EHR's, as a large amount of sensitive information is contained within these records. History of health outcomes such as drug/alcohol abuse, [[sexually transmitted infections]] or [[abortion]] during pregnancy are known to lead to social [[discrimination]] and cause social harm to the patient, hence the importance of protecting the content within EHR's.<ref>{{cite web |url= http://171.67.114.118/content/3/2/139.short |title= Authorisation and access control for electronic health record systems |accessdate= 2013-06-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> Masking limits the access that internal and external individuals can have to a particular record, increasing the protection of its contents. When patients apply for masking of their EHR, [[health services]] must meet their needs and alter the system accordingly so that unauthorised individuals can't gain access.<ref>{{cite journal |url= http://www.nature.com/gim/journal/v10/n7/abs/gim200876a.html |title= Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider |accessdate= 2013-06-01|year= 2013 |doi= 10.1097/GIM.0b013e31817a8aaa|quote= |volume=10 |issue= 7 |journal=Genetics in Medicine |pages=495–499|last1= McGuire |first1= Amy L. |last2= Fisher |first2= Rebecca |last3= Cusenza |first3= Paul |last4= Hudson |first4= Kathy |last5= Rothstein |first5= Mark A. |last6= McGraw |first6= Deven |last7= Matteson |first7= Stephen |last8= Glaser |first8= John |last9= Henley |first9= Douglas E. }}</ref>


===Patient Masking Requests===
===Patient Masking Requests===
:To increase security of their EHR's, patients can elect to mask their information by signing a form provided by the [[health service]]. It is necessary that health services with EHR [[software]] notify and educate their patients of data masking capabilities and the advantages and disadvantages of the process. In submitting a request, patients are given the control to specify the [[physicians]] and [[health service]] staff members are provided with [[consent]] and the right to access their record.<ref>{{cite web |url= http://www.stalbertgazette.com/article/20130130/SAG0803/301309997/-1/sag0803/privacy-watchdog-wants-more-awareness-on-health-record-accessibility |title= Privacy watchdog wants more awareness on health record accessibility|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> [[Health services]] must abide by patient masking requests under the Health Records Act and implement [[data masking]] techniques within the EHR technology, otherwise major consequences can result.<ref>{{cite web |url= http://www.health.vic.gov.au/healthrecords/ |title= Victorian Health Records Act|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> In addition, audit trails can be implemented by health services to track and identify which individuals have accessed a patients EHR over a certain time period.<ref>{{cite web |url= http://square.umin.ac.jp/DMIESemi/y2004/20040705_4.pdf |title= Authorisation and access control for electronic health record systems |accessdate= 2013-06-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
:To increase security of their EHR's, patients can elect to mask their information by signing a form provided by the [[health service]]. It is necessary that health services with EHR [[software]] notify and educate their patients of data masking capabilities and the advantages and disadvantages of the process. In submitting a request, patients are given the control to specify the [[physicians]] and [[health service]] staff members are provided with [[consent]] and the right to access their record.<ref>{{cite web |url= http://www.stalbertgazette.com/article/20130130/SAG0803/301309997/-1/sag0803/privacy-watchdog-wants-more-awareness-on-health-record-accessibility |title= Privacy watchdog wants more awareness on health record accessibility|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> [[Health services]] must abide by patient masking requests under the Health Records Act and implement [[data masking]] techniques within the EHR technology, otherwise major consequences can result.<ref>{{cite web |url= http://www.health.vic.gov.au/healthrecords/ |title= Victorian Health Records Act|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> In addition, audit trails can be implemented by health services to track and identify which individuals have accessed a patients EHR over a certain time period.<ref>{{cite web |url= http://square.umin.ac.jp/DMIESemi/y2004/20040705_4.pdf |title= Authorisation and access control for electronic health record systems |accessdate= 2013-06-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref>


==Unmasking==
==Unmasking==
In [[patient care]] authorised user's have the ability to override masking and access restrictions under emergency circumstances. If a patient is in a critical health state and treatment is urgently required, [[physicians]] are provided with the right to access all required information within the [[Electronic health record|EHR]]. This mechanism is known as "breaking the glass". Any unmasking of a patient's EHR is [[audited]] and a sufficient reason for access is generally required.<ref>{{cite web |url=http://www.cpsa.ab.ca/Libraries/Information_for_physicians/Section_5_Framework_-_1_1_FINAL.pdf |title= Alberta Electronic Health Record Regulation Section 5 Framework|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
In [[patient care]] authorised user's have the ability to override masking and access restrictions under emergency circumstances. If a patient is in a critical health state and treatment is urgently required, [[physicians]] are provided with the right to access all required information within the [[Electronic health record|EHR]]. This mechanism is known as "breaking the glass". Any unmasking of a patient's EHR is [[audited]] and a sufficient reason for access is generally required.<ref>{{cite web |url=http://www.cpsa.ab.ca/Libraries/Information_for_physicians/Section_5_Framework_-_1_1_FINAL.pdf |title= Alberta Electronic Health Record Regulation Section 5 Framework|accessdate= 2013-06-01|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref>


== EHR Data Masking Techniques ==
== EHR Data Masking Techniques ==
Masking refers to sets of alterations and changes made to protect information within the confines of [[Electronic health records]]. Not only is masking performed at a patients request, it is a common method used to assist in the conduction of clinical and [[epidemiological research]]. It reduces [[confidentiality]] and [[privacy]] concerns associated with supplying information to external bodies. In general, direct identifiers are removed from the dataset, replaced with random values, changed using the hashing function, or restored with a unique key.<ref>{{cite web |url= https://link.springer.com/article/10.1186%2Fgm239#page-1 |title= Methods for the De-identification of Electronic Health Records |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Mechanisms as such are expanded on under the following headings:
Masking refers to sets of alterations and changes made to protect information within the confines of [[Electronic health records]]. Not only is masking performed at a patients request, it is a common method used to assist in the conduction of clinical and [[epidemiological research]]. It reduces [[confidentiality]] and [[privacy]] concerns associated with supplying information to external bodies. In general, direct identifiers are removed from the dataset, replaced with random values, changed using the hashing function, or restored with a unique key.<ref>{{cite journal |title= Methods for the De-identification of Electronic Health Records |year= 2013 |journal= Genome Medicine|volume= 3|issue= 4|pages= 25|doi= 10.1186/gm239|pmid= 21542889|pmc= 3129641|quote= |last1 = El Emam|first1 = Khaled}}</ref> Mechanisms as such are expanded on under the following headings:


=== Encryption ===
=== Encryption ===
:Encryption is often the most complex form of [[data masking]], although it is a relatively safe and secure method. It involves inserting a [[Electronic health record|password]] or [[Electronic health record|key]] to grant an individual access to view certain data. Only permitted users are provided with a password and therefore have the capacity to recover [[sensitive information]] included within an EHR. When the system requests [[data masking]] of an EHR, access is extremely difficult and time-consuming for [[Hacker (computer security)|hackers]] or unauthorized users, as they do not possess the unique code that will [[decrypt]] the data.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
:Encryption is often the most complex form of [[data masking]], although it is a relatively safe and secure method. It involves inserting a [[Electronic health record|password]] or [[Electronic health record|key]] to grant an individual access to view certain data. Only permitted users are provided with a password and therefore have the capacity to recover [[sensitive information]] included within an EHR. When the system requests [[data masking]] of an EHR, access is extremely difficult and time-consuming for [[Hacker (computer security)|hackers]] or unauthorized users, as they do not possess the unique code that will [[decrypt]] the data.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref>


=== Data Obfuscation ===
=== Data Obfuscation ===
:Data [[obfuscation]] limits the sharing of highly sensitive health information within an [[Electronic health record]] by scrambling particular data elements to prevent unauthorized access. The technique doesn’t physically mark data; it alters data to avoid detection from external network systems. Data obfuscation is commonly used as it increases anonymity and preserves relationships within a dataset that would often be destroyed in more rigorous forms of masking.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Use of methods as such is most evident in interrelated numeric data such as addresses or dates. For example, in research [[epidemiologists]] may be interested in accessing highly specific location data to correlate patterns of diseases within particular neighborhoods and cities. However, finding clusters of poor health outcomes don’t require knowledge of actual patient addresses, it simply requires relationships between patient addresses. As a result data extraction for the study may translate addresses into another metric that preserves locations without revealing the actual physical location.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
:Data [[obfuscation]] limits the sharing of highly sensitive health information within an [[Electronic health record]] by scrambling particular data elements to prevent unauthorized access. The technique doesn’t physically mark data; it alters data to avoid detection from external network systems. Data obfuscation is commonly used as it increases anonymity and preserves relationships within a dataset that would often be destroyed in more rigorous forms of masking.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref> Use of methods as such is most evident in interrelated numeric data such as addresses or dates. For example, in research [[epidemiologists]] may be interested in accessing highly specific location data to correlate patterns of diseases within particular neighborhoods and cities. However, finding clusters of poor health outcomes don’t require knowledge of actual patient addresses, it simply requires relationships between patient addresses. As a result data extraction for the study may translate addresses into another metric that preserves locations without revealing the actual physical location.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref>


=== Data Perturbation ===
=== Data Perturbation ===
:In [[data perturbation]] alterations are made to either input databases or the query results returned.<ref>{{cite book |url= https://books.google.com/books?id=zuwhiBzAoqcC&pg=PA203&lpg=PA203&dq=data+perturbation+ehr&source=bl&ots=GpN7VowAkC&sig=qpxUhH0SSUi8sKvsa_7bvr_rt3k&hl=en&sa=X&ei=76-aUdHnM8bxkAXPy4DIAg&ved=0CFcQ6AEwBw#v=onepage&q=data%20perturbation%20ehr&f=false |title= Information Discovery on Electronic Health Records |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> Data perturbation involves preserving aggregate trends in the original data while removing and modifying the actual data.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> For example, clinical data can be swapped between EHR's, preserving the existing values in a field but eliminating the specific mapping between fields of a record. Random “noise” can also be added the data, maintaining the statistical properties of a field while randomly altering exact values within a particular EHR. Data [[data perturbation|perturbation]] has been hailed as one of the most effective data protection techniques, whilst being relatively simple to implement.<ref>{{cite web |url= http://www.techopedia.com/definition/25013/data-perturbation |title= Data Perturbation |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
:In [[data perturbation]] alterations are made to either input databases or the query results returned.<ref>{{cite book |url= https://books.google.com/?id=zuwhiBzAoqcC&pg=PA203&lpg=PA203&dq=data+perturbation+ehr#v=onepage&q=data%20perturbation%20ehr&f=false |title= Information Discovery on Electronic Health Records |accessdate= 2013-05-14|year= 2013 |format= |work= |publisher= |doi= |quote= |isbn= 9781420090413 |last1= Hristidis |first1= Vagelis }}</ref> Data perturbation involves preserving aggregate trends in the original data while removing and modifying the actual data.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref> For example, clinical data can be swapped between EHR's, preserving the existing values in a field but eliminating the specific mapping between fields of a record. Random “noise” can also be added the data, maintaining the statistical properties of a field while randomly altering exact values within a particular EHR. Data [[data perturbation|perturbation]] has been hailed as one of the most effective data protection techniques, whilst being relatively simple to implement.<ref>{{cite web |url= http://www.techopedia.com/definition/25013/data-perturbation |title= Data Perturbation |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref>


=== Data Exclusion ===
=== Data Exclusion ===
:Data exclusion involves the removal of specific data elements to restrict them from being accessed. The process involves often removing an [[Electronic health record|EHR]] entirely from the system (at patients request) or removing specific sections of a patients record. This method of masking provides the highest level of [[confidentiality]], however [[continuity of care]] can be significantly affected in some cases.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> In addition, data exclusion from EHR’s is most commonly applied for when external researchers are investigating the nature of patient health outcomes. To protect individual [[patient privacy|privacy]], patient identifiers and demographics such as name, date of birth and address, are removed from the copied EHR's, whilst researchers evaluate clinical information such as diagnoses and performed procedures. The process ensures that patients’ sensitive information remains anonymous whilst gains in research can still be made.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref>
:Data exclusion involves the removal of specific data elements to restrict them from being accessed. The process involves often removing an [[Electronic health record|EHR]] entirely from the system (at patients request) or removing specific sections of a patients record. This method of masking provides the highest level of [[confidentiality]], however [[continuity of care]] can be significantly affected in some cases.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref> In addition, data exclusion from EHR’s is most commonly applied for when external researchers are investigating the nature of patient health outcomes. To protect individual [[patient privacy|privacy]], patient identifiers and demographics such as name, date of birth and address, are removed from the copied EHR's, whilst researchers evaluate clinical information such as diagnoses and performed procedures. The process ensures that patients’ sensitive information remains anonymous whilst gains in research can still be made.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref>


=== Data Hashing ===
=== Data Hashing ===
:Data hashing involves blocking and de-identifying certain characters within strings of information so that personal information is no longer recognizable to its original form.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> This method ensures masked information is no longer visually identifiable to unauthorized users.<ref>{{cite web |url= http://ajph.aphapublications.org/doi/full/10.2105/AJPH.2006.090902 |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |work= |publisher= |doi= |quote= }}</ref> The fact that data hashing alters the data itself means it is only appropriate when applied to data that is not required again in the future. For instance, if a study was conducted to investigate the [[prevalence]] of Type 2 Diabetes in Victoria, Australia, researchers would only require [[demographic]] information regarding to the state of residence. To protect patient [[privacy]] and [[confidentiality]], more specific indicators such as house number, address, suburb and post code would be masked. For example:
:Data hashing involves blocking and de-identifying certain characters within strings of information so that personal information is no longer recognizable to its original form.<ref>{{cite web |url= http://www.ehrinstitute.org/articles.lib/items/CFR-42-Preserving-EH |title= CFR 42: Preserving EHR Privacy with Data Masking Techniques |accessdate= 2013-05-14|last= |first= |year= 2013 |format= |website= |publisher= |doi= |quote= }}</ref> This method ensures masked information is no longer visually identifiable to unauthorized users.<ref>{{cite journal |title= Patient Confidentiality in the Research Use of Clinical Medical Databases |year= 2013 |journal= American Journal of Public Health|volume= 97|issue= 4|pages= 654–658|doi= 10.2105/AJPH.2006.090902|pmid= 17329644|pmc= 1829362|quote= |last1 = Krishna|first1 = Rajeev|last2= Kelleher|first2= Kelly|last3= Stahlberg|first3= Eric}}</ref> The fact that data hashing alters the data itself means it is only appropriate when applied to data that is not required again in the future. For instance, if a study was conducted to investigate the [[prevalence]] of Type 2 Diabetes in Victoria, Australia, researchers would only require [[demographic]] information regarding to the state of residence. To protect patient [[privacy]] and [[confidentiality]], more specific indicators such as house number, address, suburb and post code would be masked. For example:
:No. XXX XXXXX Street, XX XXXX, Victoria, Australia, Post code 31XX.
:No. XXX XXXXX Street, XX XXXX, Victoria, Australia, Post code 31XX.


Revision as of 17:01, 31 December 2018

In Electronic Health Records (EHR’s) data masking, or controlled access,[1] is the process of concealing patient health data from certain healthcare providers. Patients have the right to request the masking of their personal information, making it inaccessible to any physician, or a particular physician, unless a specific reason is provided.[2] Data masking is also performed by healthcare agencies to restrict the amount of information that can be accessed by external bodies such as researchers, health insurance agencies and unauthorised individuals. It is a method used to protect patients’ sensitive information so that privacy and confidentiality are less of a concern. Techniques used to alter information within a patient’s EHR include data encryption, obfuscation, hashing, exclusion and perturbation.[3]

Confidentiality

The increased access that transpires from introducing EHR's is seen as a large concern to some patients.[4] Masking information is a technique that contributes to establishing the confidentiality of EHR's, as a large amount of sensitive information is contained within these records. History of health outcomes such as drug/alcohol abuse, sexually transmitted infections or abortion during pregnancy are known to lead to social discrimination and cause social harm to the patient, hence the importance of protecting the content within EHR's.[5] Masking limits the access that internal and external individuals can have to a particular record, increasing the protection of its contents. When patients apply for masking of their EHR, health services must meet their needs and alter the system accordingly so that unauthorised individuals can't gain access.[6]

Patient Masking Requests

To increase security of their EHR's, patients can elect to mask their information by signing a form provided by the health service. It is necessary that health services with EHR software notify and educate their patients of data masking capabilities and the advantages and disadvantages of the process. In submitting a request, patients are given the control to specify the physicians and health service staff members are provided with consent and the right to access their record.[7] Health services must abide by patient masking requests under the Health Records Act and implement data masking techniques within the EHR technology, otherwise major consequences can result.[8] In addition, audit trails can be implemented by health services to track and identify which individuals have accessed a patients EHR over a certain time period.[9]

Unmasking

In patient care authorised user's have the ability to override masking and access restrictions under emergency circumstances. If a patient is in a critical health state and treatment is urgently required, physicians are provided with the right to access all required information within the EHR. This mechanism is known as "breaking the glass". Any unmasking of a patient's EHR is audited and a sufficient reason for access is generally required.[10]

EHR Data Masking Techniques

Masking refers to sets of alterations and changes made to protect information within the confines of Electronic health records. Not only is masking performed at a patients request, it is a common method used to assist in the conduction of clinical and epidemiological research. It reduces confidentiality and privacy concerns associated with supplying information to external bodies. In general, direct identifiers are removed from the dataset, replaced with random values, changed using the hashing function, or restored with a unique key.[11] Mechanisms as such are expanded on under the following headings:

Encryption

Encryption is often the most complex form of data masking, although it is a relatively safe and secure method. It involves inserting a password or key to grant an individual access to view certain data. Only permitted users are provided with a password and therefore have the capacity to recover sensitive information included within an EHR. When the system requests data masking of an EHR, access is extremely difficult and time-consuming for hackers or unauthorized users, as they do not possess the unique code that will decrypt the data.[12]

Data Obfuscation

Data obfuscation limits the sharing of highly sensitive health information within an Electronic health record by scrambling particular data elements to prevent unauthorized access. The technique doesn’t physically mark data; it alters data to avoid detection from external network systems. Data obfuscation is commonly used as it increases anonymity and preserves relationships within a dataset that would often be destroyed in more rigorous forms of masking.[13] Use of methods as such is most evident in interrelated numeric data such as addresses or dates. For example, in research epidemiologists may be interested in accessing highly specific location data to correlate patterns of diseases within particular neighborhoods and cities. However, finding clusters of poor health outcomes don’t require knowledge of actual patient addresses, it simply requires relationships between patient addresses. As a result data extraction for the study may translate addresses into another metric that preserves locations without revealing the actual physical location.[14]

Data Perturbation

In data perturbation alterations are made to either input databases or the query results returned.[15] Data perturbation involves preserving aggregate trends in the original data while removing and modifying the actual data.[16] For example, clinical data can be swapped between EHR's, preserving the existing values in a field but eliminating the specific mapping between fields of a record. Random “noise” can also be added the data, maintaining the statistical properties of a field while randomly altering exact values within a particular EHR. Data perturbation has been hailed as one of the most effective data protection techniques, whilst being relatively simple to implement.[17]

Data Exclusion

Data exclusion involves the removal of specific data elements to restrict them from being accessed. The process involves often removing an EHR entirely from the system (at patients request) or removing specific sections of a patients record. This method of masking provides the highest level of confidentiality, however continuity of care can be significantly affected in some cases.[18] In addition, data exclusion from EHR’s is most commonly applied for when external researchers are investigating the nature of patient health outcomes. To protect individual privacy, patient identifiers and demographics such as name, date of birth and address, are removed from the copied EHR's, whilst researchers evaluate clinical information such as diagnoses and performed procedures. The process ensures that patients’ sensitive information remains anonymous whilst gains in research can still be made.[19]

Data Hashing

Data hashing involves blocking and de-identifying certain characters within strings of information so that personal information is no longer recognizable to its original form.[20] This method ensures masked information is no longer visually identifiable to unauthorized users.[21] The fact that data hashing alters the data itself means it is only appropriate when applied to data that is not required again in the future. For instance, if a study was conducted to investigate the prevalence of Type 2 Diabetes in Victoria, Australia, researchers would only require demographic information regarding to the state of residence. To protect patient privacy and confidentiality, more specific indicators such as house number, address, suburb and post code would be masked. For example:
No. XXX XXXXX Street, XX XXXX, Victoria, Australia, Post code 31XX.

Reference List

  1. ^ McGuire, Amy L.; Fisher, Rebecca; Cusenza, Paul; Hudson, Kathy; Rothstein, Mark A.; McGraw, Deven; Matteson, Stephen; Glaser, John; Henley, Douglas E. (2013). "Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider" (PDF). Genetics in Medicine. 10 (7): 495–499. doi:10.1097/gim.0b013e31817a8aaa. Retrieved 2013-04-14.
  2. ^ "The Implementation of e-Consent in Three Countries: Canada, England and the Netherlands" (PDF). 2013. Retrieved 2013-04-14.
  3. ^ "CFR 42: Preserving EHR Privacy with Data Masking Techniques". 2013. Retrieved 2013-05-01.
  4. ^ "Patient Experiences and Attitudes about Access to a Patient Electronic Health Care Record and Linked Web Messaging". 2013. Retrieved 2013-05-01.
  5. ^ "Authorisation and access control for electronic health record systems". 2013. Retrieved 2013-06-01.
  6. ^ McGuire, Amy L.; Fisher, Rebecca; Cusenza, Paul; Hudson, Kathy; Rothstein, Mark A.; McGraw, Deven; Matteson, Stephen; Glaser, John; Henley, Douglas E. (2013). "Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider". Genetics in Medicine. 10 (7): 495–499. doi:10.1097/GIM.0b013e31817a8aaa. Retrieved 2013-06-01.
  7. ^ "Privacy watchdog wants more awareness on health record accessibility". 2013. Retrieved 2013-06-01.
  8. ^ "Victorian Health Records Act". 2013. Retrieved 2013-06-01.
  9. ^ "Authorisation and access control for electronic health record systems" (PDF). 2013. Retrieved 2013-06-01.
  10. ^ "Alberta Electronic Health Record Regulation Section 5 Framework" (PDF). 2013. Retrieved 2013-06-01.
  11. ^ El Emam, Khaled (2013). "Methods for the De-identification of Electronic Health Records". Genome Medicine. 3 (4): 25. doi:10.1186/gm239. PMC 3129641. PMID 21542889.{{cite journal}}: CS1 maint: unflagged free DOI (link)
  12. ^ "CFR 42: Preserving EHR Privacy with Data Masking Techniques". 2013. Retrieved 2013-05-14.
  13. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
  14. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
  15. ^ Hristidis, Vagelis (2013). Information Discovery on Electronic Health Records. ISBN 9781420090413. Retrieved 2013-05-14.
  16. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
  17. ^ "Data Perturbation". 2013. Retrieved 2013-05-14.
  18. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
  19. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
  20. ^ "CFR 42: Preserving EHR Privacy with Data Masking Techniques". 2013. Retrieved 2013-05-14.
  21. ^ Krishna, Rajeev; Kelleher, Kelly; Stahlberg, Eric (2013). "Patient Confidentiality in the Research Use of Clinical Medical Databases". American Journal of Public Health. 97 (4): 654–658. doi:10.2105/AJPH.2006.090902. PMC 1829362. PMID 17329644.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Masking_(Electronic_Health_Record)&oldid=876174305"