Information security in eHealth systems : specialist thesis - Marošević, Hristina (H. Marošević, Fakultet elektrotehnike i računarstva, 2022)
eHealth is an emerging field with the main objective to improve the healthcare locally, regionally, and worldwide using ICT (Information and Communication Technologies). As types and number of different eHealth systems is continuously growing, especially in developing countries, their integration and interoperability present even greater challenge on a day-to-day basis. This is addressed by the global initiative to improve the interoperability in healthcare informatics and the way computer systems in healthcare share information, IHE (Integrating the Healthcare Enterprise). Its vision is not only to provide seamless access to health information, but also secure. Security in eHealth, especially in integrated eHealth environments is very important i.e., eHealth is on the list of the top three sensitive industries regarding information created, processed, stored, and transmitted. Moreover, unauthorized access to health information or its misuse can present a different level of risk which in the worst-case scenario may be a patient’s life. The main goal of this thesis is to give insight in high-level definitions within the IHE ITI (Information Technology Infrastructure) technical framework, more specifically to explain the purpose and implementation of ATNA, BPPC and XUA security related profiles and to propose use cases. These profiles support different security controls for identification, authentication, authorization, confidentiality, integrity, non-repudiation, patient privacy and audit logging for standardized environments, not dependent on the eHealth system’s architecture, specific process and mechanisms used but demanding existence of interoperable policies and regular risk assessment.