Software security patent to help improve health IT privacy

Jul 08, 2010

A computer security invention patented* a decade ago at the National Institute of Standards and Technology is now poised to help safeguard patient privacy in hospitals.

The invention -- an algorithm that can be built into a larger piece of software -- is designed to control access to information systems, and it has attracted the attention of a company that is putting it to use in the health care field. John Barkley, the algorithm's creator, says the idea could solve one of the pervasive issues in the country's .

"We think this software will provide dramatically improved security and privacy to patients," says Barkley, now retired from NIST's Software and Systems Division and now consulting with Virtual Global, which is commercializing the product. "It solves the problem of overly broad access to patient information, which is widespread."

Barkley's efforts stretch back to the 1980s, when the computer tools available for protecting were poor. Generally, access to information was available to anyone whose name was on a specific list of authorized users, but a large organization might have thousands of restricted files, each with its own access list—making security management awkward. Help came with the creation of Role-Based Access Control (RBAC), in which a person's job function, not name, was the key to accessing a particular file. However, even RBAC could allow large numbers of people to have unlimited access to information—a particular problem in health care, where it is crucial but difficult to guarantee patient privacy.

"We didn't invent RBAC, but we wanted to systematize it and standardize it," says Richard Kuhn of NIST's Computer Security Division and Barkley's former supervisor. "While we were working on this, John [Barkley] came up with a way to control access by using RBAC within the context of a lengthy, multistep task, and I suggested he patent it."

In essence, the patent covers a method of ensuring that access to information is available to those who need it, but only when necessary. For example, at a hospital, the patient admission procedure involves a number of steps, and in each step someone needs access to the patient's medical records for a specific purpose, like registering the patient or verifying their insurance information.

"Once you've been admitted to the hospital, the admissions staff doesn't necessarily need access to your records anymore. But in many hospitals, those staff members nonetheless continue to have access to every record on file," Barkley explains. "Using the we patented, those staffers would only be able to access your record during admission processing. After that, they would find your information unavailable—though the doctor who was treating you would still have access to it."

NIST released a Small Business Innovation Research solicitation in an effort to find a company to develop a product from the patent in 2008, which happened to be when Virtual Global, Inc., was searching for a way to protect electronic records for its clients. The company purchased the rights to it shortly thereafter and integrated the invention into its "HealthCapsule" cloud platform. Virtual Global is now using HealthCapsule to create a pilot security system for LIFE Pittsburgh, a long-term care facility.

Explore further: Thanksgiving travel woes? There's an app for that

More information: * J. Barkley. "Workflow Management Employing Role-Based Access Control," U.S. Patent No. 6,088,679. July 11, 2000. Available at www.itl.nist.gov/div897/staff/barkley/6088679.pdf

add to favorites email to friend print save as pdf

Related Stories

Patient privacy assured by electronic censor

Jul 24, 2008

Newly developed software will help to allay patients' fears about who has access to their confidential data. Research published today in the open access journal BMC Medical Informatics and Decision Making describes a comp ...

File-sharing software potential threat to health privacy

Mar 01, 2010

The personal health and financial information stored in thousands of North American home computers may be vulnerable to theft through file-sharing software, according to a research study published online today in the Journal of ...

Patient privacy focus of Amgen suit

Jan 09, 2008

Two former employees with the California biotech company Amgen Inc. allege the company persuaded sales people to access patient records to boost sales.

Recommended for you

Thanksgiving travel woes? There's an app for that

19 hours ago

Traveling by plane, train or automobile can be a headache. Mixing in Thanksgiving can make it a throbbing migraine. Technology provides some pain relief in the form of apps to let you know which roads are ...

Singapore moves to regulate taxi booking apps

Nov 21, 2014

Singapore on Friday announced new rules for mobile taxi booking apps, including US-based Uber, in the latest move by governments around the world to regulate the increasingly popular services.

Protecting personal data in the cloud

Nov 20, 2014

IBM today announced it has patented the design for a data privacy engine that can more efficiently and affordably help businesses protect personal data as it is transferred between countries, including across private clouds.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.