| 8:30 a.m.–9:00 a.m. |
Tuesday |
Continental Breakfast
Harbor Foyer
|
| 9:00 a.m.–9:15 a.m. |
Tuesday |
Program Co-Chairs: Avi Rubin, Johns Hopkins University, and Eugene Vasserman, Kansas State University
|
| 9:15 a.m.–9:45 a.m. |
Tuesday |
Ross Koppel, Ph.D. FACMI, Sociology Department and School of Medicine, Senior Fellow, LDI, Wharton, University of Pennsylvania Professor Koppel is a leading scholar of healthcare IT, and of the interactions of people, computers and workplaces. His articles in JAMA, JAMIA, Annals of Internal Medicine, NEJM, Health Affairs, etc. are considered seminal works. Professor Koppel is on the faculty of the Sociology Department and of the Medical School at the University of Pennsylvania. Koppel is also a Senior Fellow of the Leonard Davis Institute at Penn’s Wharton School. In addition, Koppel is a co-investigator of Penn’s National Science Foundation Project on Safe Cyber Communication and Smart Alerts. At Harvard, Dr. Koppel is co-PI on the FDA-funded study of prescribing errors related to patient data displays. Also at Harvard, he is the Internal Evaluator of their project to create new HIT architecture. His work combines ethnographic research, extensive statistical analysis, surveys, and usability studies. Professor Koppel is a leading scholar of healthcare IT, and of the interactions of people, computers and workplaces. His articles in JAMA, JAMIA, Annals of Internal Medicine, NEJM, Health Affairs, etc. are considered seminal works. Professor Koppel is on the faculty of the Sociology Department and of the Medical School at the University of Pennsylvania. Koppel is also a Senior Fellow of the Leonard Davis Institute at Penn’s Wharton School. In addition, Koppel is a co-investigator of Penn’s National Science Foundation Project on Safe Cyber Communication and Smart Alerts. At Harvard, Dr. Koppel is co-PI on the FDA-funded study of prescribing errors related to patient data displays. Also at Harvard, he is the Internal Evaluator of their project to create new HIT architecture. His work combines ethnographic research, extensive statistical analysis, surveys, and usability studies. Working with colleagues at Dartmouth and USC, he also studies workarounds to cybersecurity.
|
| 9:45 a.m.–10:30 a.m. |
Tuesday |
Moderator: Avi Rubin, Johns Hopkins University
Panelists: Ross Koppel, University of Pennsylvania; David Kotz, Dartmouth College; Carl Gunter, University of Illinois at Urbana–Champaign
|
| 10:30 a.m.–11:00 a.m. |
Tuesday |
Break with Refreshments
Harbor Foyer
|
|
| 11:00 a.m.–12:30 p.m. |
Tuesday |
Shuang Wang and Xiaoqian Jiang, University of California, San Diego; Noman Mohammed, McGill University; Rui Chen, Hong Kong Baptist University; Lucila Ohno-Machado, University of California, San Diego We present a novel approach for disseminating genomic data while satisfying differential privacy. The proposed algorithm splits raw genome sequences into blocks, subdivides the blocks in a top-down fashion, and finally adds noise to counts to protect privacy. Preliminary experimental results suggest that the proposed algorithm can retain data utility that is higher than the baseline for a given privacy budget. The proposed algorithm can also be used to protect heterogeneous data, such as records consisting of both medical and genomic data. Further improvement is possible by refining the heuristic for splitting sequences and by introducing a scoring function in the data generalization process. We present a novel approach for disseminating genomic data while satisfying differential privacy. The proposed algorithm splits raw genome sequences into blocks, subdivides the blocks in a top-down fashion, and finally adds noise to counts to protect privacy. Preliminary experimental results suggest that the proposed algorithm can retain data utility that is higher than the baseline for a given privacy budget. The proposed algorithm can also be used to protect heterogeneous data, such as records consisting of both medical and genomic data. Further improvement is possible by refining the heuristic for splitting sequences and by introducing a scoring function in the data generalization process.
Sai R. Gouravajhala, Amir Rahmati, Peter Honeyman, and Kevin Fu, University of Michigan
Justin Wagner and Hector Corrada-Bravo, University of Maryland, College Park We examine adapting proposed privacy-preserving analysis and storage systems for human genome sequences to the realm of human microbiome sequencing. To begin, we discuss the methodology and statistics of interest in microbiome sequence-based analysis, referred to as metagenomics. Next, we investigate the capability of microbiome sequencing to uniquely identify an individual. Then, we detail the differences in metagenomic analysis and genome-wide association studies while reviewing a privacy-preserving genome-wide association study approach. We conclude with a discussion of a system for secure storage and disease risk computation using human genome sequences along with design considerations for extending the system to microbiome sequencing. We examine adapting proposed privacy-preserving analysis and storage systems for human genome sequences to the realm of human microbiome sequencing. To begin, we discuss the methodology and statistics of interest in microbiome sequence-based analysis, referred to as metagenomics. Next, we investigate the capability of microbiome sequencing to uniquely identify an individual. Then, we detail the differences in metagenomic analysis and genome-wide association studies while reviewing a privacy-preserving genome-wide association study approach. We conclude with a discussion of a system for secure storage and disease risk computation using human genome sequences along with design considerations for extending the system to microbiome sequencing.
Jim Blythe, University of Southern California; Ross Koppel, University of Pennsylvania; Vijay Kothari and Sean Smith, Dartmouth College Healthcare professionals have unique motivations, goals, perceptions, training, tensions, and behaviors, which guide workflow and often lead to unprecedented workarounds that weaken the efficacy of security policies and mechanisms. Identifying and understanding these factors that contribute to circumvention, as well as the acts of circumvention themselves, is key to designing, implementing, and maintaining security subsystems that achieve security goals in healthcare settings. To this end, we present our research on workarounds to computer security in healthcare settings without compromising the fundamental health goals. We argue and demonstrate that understanding workarounds to computer security, especially in medical settings, requires not only analyses of computer rules and processes, but also interviews and observations with users and security personnel. In addition, we discuss the value of shadowing clinicians and conducting focus groups with them to understand their motivations and tradeoffs for circumvention. Ethnographic investigation of workflow is paramount to achieving security objectives. Healthcare professionals have unique motivations, goals, perceptions, training, tensions, and behaviors, which guide workflow and often lead to unprecedented workarounds that weaken the efficacy of security policies and mechanisms. Identifying and understanding these factors that contribute to circumvention, as well as the acts of circumvention themselves, is key to designing, implementing, and maintaining security subsystems that achieve security goals in healthcare settings. To this end, we present our research on workarounds to computer security in healthcare settings without compromising the fundamental health goals. We argue and demonstrate that understanding workarounds to computer security, especially in medical settings, requires not only analyses of computer rules and processes, but also interviews and observations with users and security personnel. In addition, we discuss the value of shadowing clinicians and conducting focus groups with them to understand their motivations and tradeoffs for circumvention. Ethnographic investigation of workflow is paramount to achieving security objectives.
|
| 12:30 p.m.–2:00 p.m. |
Tuesday |
Lunch
Harbor GH
|
| 2:00 p.m.–3:30 p.m. |
Tuesday |
Xiaohui Liang and David Kotz, Dartmouth College Wearable health technology is becoming a hot commodity as it has the potential to help both patients and clinicians continuously monitor vital signs and symptoms. One popular type of wearable devices are worn on human wrist and are equipped with sensors to passively perform sensing tasks. Their constrained user interface, however, is ineffective to display the sensory data for users. We envision connecting a wrist-worn device to a display device, such as a television, so the user is able to view the sensory data. Such connections must be secure to prevent the sensory data from being eavesdropped by other devices, must be made only when the user intends, and must be easy even when a new display is encountered (such as in a medical clinic, or a hotel room). In this presentation, we will discuss the secure wearable/display connection problem by revisiting existing methods and hardware designs of wrist-worn devices and display devices. We then present possible solutions that leverage the built-in hardware components of wrist-worn devices to implement, secure, intentional, easy connections to ambient display devices. Wearable health technology is becoming a hot commodity as it has the potential to help both patients and clinicians continuously monitor vital signs and symptoms. One popular type of wearable devices are worn on human wrist and are equipped with sensors to passively perform sensing tasks. Their constrained user interface, however, is ineffective to display the sensory data for users. We envision connecting a wrist-worn device to a display device, such as a television, so the user is able to view the sensory data. Such connections must be secure to prevent the sensory data from being eavesdropped by other devices, must be made only when the user intends, and must be easy even when a new display is encountered (such as in a medical clinic, or a hotel room). In this presentation, we will discuss the secure wearable/display connection problem by revisiting existing methods and hardware designs of wrist-worn devices and display devices. We then present possible solutions that leverage the built-in hardware components of wrist-worn devices to implement, secure, intentional, easy connections to ambient display devices.
Michael Rushanan, Johns Hopkins University; Denis Foo Kune, Daniel E Holcomb, and Colleen M Swanson, University of Michigan The interpulse interval (IPI), or the time between heartbeats, is a prominent feature of Electrocardiograph (ECG) signals that can be reliably measured anywhere on the body. As such, IPI is a physiological value that has frequently been suggested for use in implantable medical device (IMD) and body area network (BAN) authentication protocols, such as the H2H protocol by Rostami et al. These protocols rely on extracting randomness from IPIs and the assumption that these values cannot be measured without physical contact. In this presentation, we prompt a discussion regarding the security assumptions of these protocols and what can go wrong when these assumptions are not met in practice. In particular, we argue that it is not clear whether the suggested extraction methods, or the way we obtain random bits from ECG signals, reliably produce uniform random bits in real-world settings. In addition, as part of a security analysis of the H2H protocol, we discuss preliminary experimentation to remotely observe ECG signals using known video processing techniques that track involuntary movements of the head and subtle color changes of skin over time. The interpulse interval (IPI), or the time between heartbeats, is a prominent feature of Electrocardiograph (ECG) signals that can be reliably measured anywhere on the body. As such, IPI is a physiological value that has frequently been suggested for use in implantable medical device (IMD) and body area network (BAN) authentication protocols, such as the H2H protocol by Rostami et al. These protocols rely on extracting randomness from IPIs and the assumption that these values cannot be measured without physical contact. In this presentation, we prompt a discussion regarding the security assumptions of these protocols and what can go wrong when these assumptions are not met in practice. In particular, we argue that it is not clear whether the suggested extraction methods, or the way we obtain random bits from ECG signals, reliably produce uniform random bits in real-world settings. In addition, as part of a security analysis of the H2H protocol, we discuss preliminary experimentation to remotely observe ECG signals using known video processing techniques that track involuntary movements of the head and subtle color changes of skin over time.
Tariq Yusuf, Tamara Bonaci, Tadayoshi Kohno, and Howard Jay Chizeck, University of Washington From military Unmanned Air Vehicles (UAVs) to home-made TETRIX® robots, teleoperated systems are playing an increasingly important role in our lives. Like robotics, teleoperated systems are more affordable and easier to acquire than ever before. In the medical field, we have seen applications of this technology in systems like da Vinci® where robots assist in medical procedures. Teleoperated surgical robots will in the future likely be used in more extreme scenarios such as battlefields, natural disasters, and human-caused catastrophes. But, with the rapidly increasing application of this technology raises the question; what if these robots are taken over and turned into weapons?
The goal of this presentation is to raise awareness to this emerging threat, and to initiate research and development of patient safe, information secure and privacy preserving teleoperated robotic surgery. Experts agree that complex systems are best secured when security mechanisms are incorporated into the system from the beginning. Here we have a rare opportunity to design a system and its appropriate security mechanism in parallel. Moreover, we anticipate that the majority of threats against telerobotic surgery will also be relevant to other teleoperated robotic and co-robotic systems.
We start the effort towards safe and secure teleoperated surgery by identifying possible attacks, and experimentally analyzing the scopes, impacts, and resources needed to mount them. We then discuss possible implications on teleoperated surgery. Finally, we provide some initial guidance to prevent these types of attacks from occurring in other applications of teleoperated robotics. From military Unmanned Air Vehicles (UAVs) to home-made TETRIX® robots, teleoperated systems are playing an increasingly important role in our lives. Like robotics, teleoperated systems are more affordable and easier to acquire than ever before. In the medical field, we have seen applications of this technology in systems like da Vinci® where robots assist in medical procedures. Teleoperated surgical robots will in the future likely be used in more extreme scenarios such as battlefields, natural disasters, and human-caused catastrophes. But, with the rapidly increasing application of this technology raises the question; what if these robots are taken over and turned into weapons?
The goal of this presentation is to raise awareness to this emerging threat, and to initiate research and development of patient safe, information secure and privacy preserving teleoperated robotic surgery. Experts agree that complex systems are best secured when security mechanisms are incorporated into the system from the beginning. Here we have a rare opportunity to design a system and its appropriate security mechanism in parallel. Moreover, we anticipate that the majority of threats against telerobotic surgery will also be relevant to other teleoperated robotic and co-robotic systems.
We start the effort towards safe and secure teleoperated surgery by identifying possible attacks, and experimentally analyzing the scopes, impacts, and resources needed to mount them. We then discuss possible implications on teleoperated surgery. Finally, we provide some initial guidance to prevent these types of attacks from occurring in other applications of teleoperated robotics.
Krishna K. Venkatasubramanian and Craig A. Shue, Worcester Polytechnic Institute A Body Sensor Actuator Network (BSAN) consists of a set of sensing and actuating devices deployed on a person (user) typically for health management purposes. Securing the information exchanged within a BSAN from unauthorized tampering is essential to ensure that such systems are safe, and thus do no harm, to the people using them. Current solutions for enabling information security in BSANs impose considerable overhead on the nodes. In order to make security viable in BSANs, one needs to move away from this one-size-fits-all solution and take a more adaptive approach where the level of security provided matches the level of threat present. In this regard, we present an adaptive information security scheme for BSANs that uses honeypots to measure the current threat context, by interacting with the adversaries trying to undermine user safety. The measurements made by the honeypot can then be used to determine the appropriate balance for the tradeoff between the level of security and associated overhead at any given time. This paper provides an overview of our approach and the associated research challenges in successfully implementing it. A Body Sensor Actuator Network (BSAN) consists of a set of sensing and actuating devices deployed on a person (user) typically for health management purposes. Securing the information exchanged within a BSAN from unauthorized tampering is essential to ensure that such systems are safe, and thus do no harm, to the people using them. Current solutions for enabling information security in BSANs impose considerable overhead on the nodes. In order to make security viable in BSANs, one needs to move away from this one-size-fits-all solution and take a more adaptive approach where the level of security provided matches the level of threat present. In this regard, we present an adaptive information security scheme for BSANs that uses honeypots to measure the current threat context, by interacting with the adversaries trying to undermine user safety. The measurements made by the honeypot can then be used to determine the appropriate balance for the tradeoff between the level of security and associated overhead at any given time. This paper provides an overview of our approach and the associated research challenges in successfully implementing it.
|
| 3:30 p.m.–4:00 p.m. |
Tuesday |
Break with Refreshments
Harbor Foyer
|
|
| 4:00 p.m.–5:00 p.m. |
Tuesday |
Yuzhe Tang and Ling Liu, Georgia Institute of Technology In emerging Health Information Exchange systems (or HIE), a search facility, such as record locator service, is critically important for data sharing across autonomous hospitals. An understudied problem for searching HIE is the privacy preservation—how to protect the patient’s private visit-history data in the search process and how to address innately different privacy and sensitivity for different patients and hospitals. For instance, knowing that a patient visited a specialty hospital (e.g. a women’s health center) may leak more privacy than knowing that the patient visited a general hospital. In this work we proposed a differentiated privacy preservation technique for searching in HIE, coined l-PPLS. Given hospitals with different specialties, l-PPLS attempts to cluster them in order to hide among other hospitals their specialties linked to a patient, so that an attacker can not infer the patient’s medical condition based on the specialties of the hospitals she visited. In emerging Health Information Exchange systems (or HIE), a search facility, such as record locator service, is critically important for data sharing across autonomous hospitals. An understudied problem for searching HIE is the privacy preservation—how to protect the patient’s private visit-history data in the search process and how to address innately different privacy and sensitivity for different patients and hospitals. For instance, knowing that a patient visited a specialty hospital (e.g. a women’s health center) may leak more privacy than knowing that the patient visited a general hospital. In this work we proposed a differentiated privacy preservation technique for searching in HIE, coined l-PPLS. Given hospitals with different specialties, l-PPLS attempts to cluster them in order to hide among other hospitals their specialties linked to a patient, so that an attacker can not infer the patient’s medical condition based on the specialties of the hospitals she visited.
Carl Gunter, University of Illinois; Mike Berry, HLN; Martin French, Concordia University Architecture and
protocol changes in the sharing of health records lead to a need for decision
support functions that enforce privacy preferences of patients. These needs can
be addressed with a collection of techniques called Decision Support for Data
Segmentation (DS2).
Segmentation of patient medical records was once a side
effect of paper media stored in separate locations. For instance, a patient
might have a paper record at their primary provider and another record at a
substance abuse treatment facility. There were two general types of sharing. In
first case the paper record was in a place where it could be accessed by
physicians at a provider facility, such as a hospital or clinic. This enabled
sharing among the physicians at the provider. In a second case, when there was
a need to share the records between two distinct providers (or other parties,
such as the patient’s insurer), a representative of the originating provider
would select relevant parts of the patient paper record and FAX them to the consuming
provider. This act was usually done with patient consent and a knowledge of the
goal for sharing the record, such as referral to a specialist or new primary
care provider. For instance, a patient could decide if the consuming provider
should receive substance abuse records from an originating provider. Architecture and
protocol changes in the sharing of health records lead to a need for decision
support functions that enforce privacy preferences of patients. These needs can
be addressed with a collection of techniques called Decision Support for Data
Segmentation (DS2).
Segmentation of patient medical records was once a side
effect of paper media stored in separate locations. For instance, a patient
might have a paper record at their primary provider and another record at a
substance abuse treatment facility. There were two general types of sharing. In
first case the paper record was in a place where it could be accessed by
physicians at a provider facility, such as a hospital or clinic. This enabled
sharing among the physicians at the provider. In a second case, when there was
a need to share the records between two distinct providers (or other parties,
such as the patient’s insurer), a representative of the originating provider
would select relevant parts of the patient paper record and FAX them to the consuming
provider. This act was usually done with patient consent and a knowledge of the
goal for sharing the record, such as referral to a specialist or new primary
care provider. For instance, a patient could decide if the consuming provider
should receive substance abuse records from an originating provider.
Denise Anthony, Dartmouth College; Celeste Campos-Castillo, University of Wisconsin—Milwaukee; Ahram Lee, Dartmouth College The proposed Accounting of Disclosure rule seeks to give patients/consumers clear rights to receive an accounting of the disclosures of their medical information. Similar to the rights regarding disclosures of credit information first given to consumers in the 1970 Fair Credit Reporting Act, the rights for an Accounting of Disclosure seeks to make disclosures of medical information more transparent. After the Department of Health and Human Services Accounting of Disclosure rule proposal of rulemaking in 2010 (Proposed Rule: HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act, 76 Fed. Reg. 31426-31449 (May 31, 2011; RIN 0991–AB62), over 400 public comments were received (Public Comment on Proposed Rule: HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act, (August 1, 2011), available at: http://www.regulations.gov/#!documentDetail;D=HHS-OCR-2011-0011-0001 ). While some comments supported the rule and advocated further rights and protections for consumers, many providers and representatives of provider organizations voiced significant criticisms and offered serious challenges to the proposed rule (e.g., Hall and Nissenbaum 2011). Additional hearings on the subject further identified provider concerns regarding the proposed rule. The proposed Accounting of Disclosure rule seeks to give patients/consumers clear rights to receive an accounting of the disclosures of their medical information. Similar to the rights regarding disclosures of credit information first given to consumers in the 1970 Fair Credit Reporting Act, the rights for an Accounting of Disclosure seeks to make disclosures of medical information more transparent. After the Department of Health and Human Services Accounting of Disclosure rule proposal of rulemaking in 2010 (Proposed Rule: HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act, 76 Fed. Reg. 31426-31449 (May 31, 2011; RIN 0991–AB62), over 400 public comments were received (Public Comment on Proposed Rule: HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act, (August 1, 2011), available at: http://www.regulations.gov/#!documentDetail;D=HHS-OCR-2011-0011-0001 ). While some comments supported the rule and advocated further rights and protections for consumers, many providers and representatives of provider organizations voiced significant criticisms and offered serious challenges to the proposed rule (e.g., Hall and Nissenbaum 2011). Additional hearings on the subject further identified provider concerns regarding the proposed rule.
|
| 5:00 p.m.–6:00 p.m. |
Tuesday |
|
|
