Enabling Robust Information Accountability in E-healthcare Systems

In the United States, the transition from traditional paper-based healthcare records to electronic healthcare record (EHR) systems is being promoted aggressively. While EHR systems offer a number of benefits, they will introduce new security and privacy concerns. A significant fraction of such threats, at least in part, arise due to actions of insiders of healthcare organizations, either accidentally or intentionally. We believe information accountability, which allows us to securely identify how a health record reached a certain consumer and who was involved in its sharing or transfer, is a key to discourage such threats. In this work, we propose a patient-centric scheme to establish robust information accountability in electronic healthcare record sharing systems. We also present a prototype implementation and show that it does not impose unacceptable performance overhead.