Special Topics in Security and Privacy of Medical Information

Instructor: Sujata Garera

Office: Online

Office hours: By appointment

Email: sgarera@cs.jhu.edu

Course Timing: TueThurs 11am-12:15pm

Course Room: Please enter here

This course will cover topics in security and privacy of medical information. The course will discuss existing practices as well as recent research. Topics will include security and access control with respect to medical records (EPR, PHR), securing communication standards (HL7, DICOM), recent attacks on patient monitoring systems, security architectures for portable patient records, break the glass systems, privacy, anonymity and medical identity theft. Lectures will be based on recent research papers both in the security and medical community. Lectures will follow an online teaching format and will be delivered via Adobe Connect. The instructor will also be available for online office hours and discussions outside of class room hours.

Prerequisites:

Students are expected to enter this class with basic knowledge in computers, networking and should be comfortable with programming. There will be an optional Java programming component in the class group project. Students must be comfortable with using and learning Java.

Technical requirements

AdobeConnect: Students will be required to use Adobe Connect, a web-based conferencing system, to participate in real time class room lectures and office hours. Adobe Connect is available via JHU IT out here. Please make sure you follow the instructions on the page (see System Requirements, connection test) to test whether your browser supports the connect plugin.
Microphone Headset:Students will require microphone headsets in order to voice their opinions in a class room or during office hours.

Text Books

There are no text books for this course. Lecture materials will be based of research papers which will be posted online.

Lecture Slides:

Lecture slides can be found here

Grading Policy:

Assignments : 30%
Project : 30%
Participation : 40%
-- Discussion sessions
-- General Participation

Assignments:

Assignments are due at the beginning of class via email on the stated due date. Late submissions will not be accepted. No collaboration is allowed on assignments unless stated otherwise.

Assignment 1 is available here. It is due on 2/18/2010. The paper associated with this assignment can be found here.

Assignment 2 is available here. It is due on 3/9/2010.

Assignment 3 is available here. It is due on 4/27/2010.

Class Project:

Project description can be found here. Students may collaborate on the class project in groups of two to three students (project teams can be formed by the students choice). The code for the project may be downloaded from this link here. (Note that this version corresponds to version 10938 in the openmrs SVN repository).

Class participation:

Class participation in online class discussions is important for a sucessful online class experience and will provide students with a broader perspective of the topics being discussed. Class participation forms a significant part of the grade and is graded on the quality of discussion sessions and debates as well general participation in class.

Discussions:

Discussion sessions will be lead students. There will be approximately 6-7 such sessions during the semester. These discussion leads will be assigned by the instructor. During the discussion session the leads should identify 1-2 papers which are related to the unit assigned to that session and propose them to the instructor atleast a week in advance. The instructor may also assign papers to the discussion team. These papers will be posted on the website and the class is responsible for reading them before the session. The discussion leads will present the papers and related/prior work during part of the class and lead an active discussion pertaining to these papers. Creativity during these sessions is encouraged. Discussion notes should also be kept and sent to the instructor afterwords. Discussion sessions will be evaluated based on the following aspects:
--- Creativity in managing the discussion session
--- Quality of presentation
--- Participation of discussion leads
--- Effort in raising important and relevent discussion questions related to topic
--- Effective use of class time
--- Participation by class
--- Quality of notes maintained

Academic Integerity:

Academic Integrity and Ethical behavior are required in this course, as it is in all courses at Johns Hopkins University. Academic integrity code for the Department of Computer Science can be found here.

Syllabus and Readings:

These topics may be subject to change as the course proceeds

Unit 1: Medical Records and Access Control

Medical records, EPR and PHR systems, types of access control, audit based access control, access control logic
Suggested Reading:
-- Access Control Requirements for Processing Electronic Health Records by Bandar Alhaqbani and Colin Fidge, available here
-- Audit Based Access Control for Electronic Health Records by M.A.C Dekker and S. Etalle, available here
-- An Audit logic for Accountability by Cederquist et al., available here

Unit 2: Medical device security

Patient monitoring systems, design of devices, security issues, hacking devices, cloaking devices
Suggested Reading:
-- Security and Privacy for Implantable Medical Devices by Halperin et al. available here
-- Protecting Global Medical Telemetry Infrastructure by Defend et al. available here
-- Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero Power Defenses by Halperin et al. available here
-- Absence Makes the Heart grow Fonder: New Directions for Implantable Medical Device Security by Denning et al. available here

Unit 3: Communication standards and Medical Image Security

HL7, DICOM, security practices, PACS, Digital envelopes, watermarking images, grid networks
Suggested Reading:
-- Dicom security Chapter 11 from DICOM book available here
-- Trusted Headers for Medical Images available here
-- Medical Image Security in a HIPAA mandated PACS environment available here
-- Reversible Region of Non Interest Watermarking for Authentication of DICOM images available here
-- Using grid technologies to face medical image analysis challenges available here
-- Encrypted storage of medical data on grid available here

Unit 4: Portable Patient Record Systems and Remote Monitoring Systems

Need for such systems, remote monitoring systems, emergency access, break the glass systems, medical records on smart phone
Suggested Reading:
-- Encryption characteristics of two USB based personal health record devices available here
-- A wearable personal healthcare and emergency aid system available here
-- A wearable multi-parameter medical monitoring and alert system available here
-- Securing Medical Records on Smart Phones available here
-- Biometric methods for securing communications in body sensor networks here

Unit 5: Privacy and Anonymity for medical data

HIPPA, privacy threats, privacy breach, anonymizing records, Scrub and datafly systems, Hipocratic databases
Suggested Reading:
-- Replacing Personally-Identifying Information in Medical Records,the Scrub System available here
-- Guaranteeing Anonymity when Sharing Medical Data, the Datafly System available here
-- Hippocratic databases available here

Unit 6: Medical Identity Theft

Theft of medical information, incidents and implications, good practices, prevention techniques.
Suggested Reading:

Schedule (some are tentative)
Date Lecture Slides Comments
1/26 Lecture 1 Course outline, project, security requirements in EPR systems
1/28 Lecture 2 Access control systems
2/2 Lecture 3 Audit based access control systems
2/4 Lecture 3 part B Audit based access control systems
2/9 Class canceled due to snow jhu emergency notice
2/11 Class canceled due to snow jhu emergency notice
2/16 Access control Discussion (lead by John) Cassandra
Cassandra (wrt health)
Slides
2/18 Lecture 4 Medical device security
Assignment 1 due via email
2/23 Lecture 4 part B Medical device security
Project Part 1 due via email
2/25 Lecture 5 Medical device security
3/1 IMD Discussion (lead by Ryan) Proximity-based Access control for IMDs here
Slides
3/9 Lecture 6 Assignment 2 due, DICOM and DICOM security
3/10 Lecture 7 DE and Watermarking
3/16, 3/18 Spring Break No class
3/23 Lecture 8 Medical networks and grids
3/25 Discussion (Lead by John) Project Part 2 Due, MANTIS grid available here
Slides
3/30 Project Part 2 Presentation
4/1 Lecture 9 USB PHR , PHR on Smart phones
4/6 Lecture 10 AMON, WAITER
4/8 Lecture 11 BSNs
4/20 Discussion (lead by Ryan) MEDISN here
Slides
4/22 Lecture 12 HIPAA, Scrub, Datafly
4/27 Lecture 13 Assignment 3 due, Hippocratic databases
4/29 Discussion (lead by Ryan and John) Project part 3 due, Limited Disclosure in Hippocratic Databases available here
5/4 Final project presentation