7.2. Clinical Information Systems Security Policy
Medical records require policies that combine confidentiality and integrity, but in a very different way than for brokerage firms. Conflict of interest is not a critical problem. Patient confidentiality, authentication of both records and the personnel making entries in those records, and assurance that the records have not been changed erroneously are critical. Anderson [29] presents a model for such policies that illuminates the combination of confidentiality and integrity to protect patient privacy and record integrity.
Anderson defines three types of entities in the policy.
Definition 74.
A patient is the subject of medical records, or an agent for that person who can give consent for the person to be treated. Definition 75.
Personal health information is information about a patient's health or treatment enabling that patient to be identified.
In more common parlance, the "personal health information" is contained in a medical record. We will refer to "medical records" throughout, under the assumption that all personal health information is kept in the medical records.
Definition 76.
A clinician is a health-care professional who has access to personal health information while performing his or her job.
The policy also assumes that personal health information concerns one individual at a time. Strictly speaking, this is not true. For example, obstetrics/gynecology records contain information about both the father and the mother. In these cases, special rules come into play, and the policy does not cover them.
The policy is guided by principles similar to the certification and enforcement rules of the Clark-Wilson model. These principles are derived from the medical ethics of several medical societies, and from the experience and advice of practicing clinicians.
The first set of principles deals with access to the medical records themselves. It requires a list of those who can read the records, and a list of those who can append to the records. Auditors are given access to copies of the records, so the auditors cannot alter the original records in any way. Clinicians by whom the patient has consented to be treated can also read and append to the medical records. Because clinicians often work in medical groups, consent may apply to a set of clinicians. The notion of groups abstracts this set well. Thus:
Access Principle 1:
Each medical record has an access control list naming the individuals or groups who may read and append information to the record. The system must restrict access to those identified on the access control list.
Medical ethics require that only clinicians and the patient have access to the patient's medical record. Hence:
Access Principle 2:
One of the clinicians on the access control list (called the responsible clinician) must have the right to add other clinicians to the access control list.
Because the patient must consent to treatment, the patient has the right to know when his or her medical record is accessed or altered. Furthermore, if a clinician who is unfamiliar to the patient accesses the record, the patient should be notified of the leakage of information. This leads to another access principle:
Access Principle 3:
The responsible clinician must notify the patient of the names on the access control list whenever the patient's medical record is opened. Except for situations given in statutes, or in cases of emergency, the responsible clinician must obtain the patient's consent.
Erroneous information should be corrected, not deleted, to facilitate auditing of the records. Auditing also requires that all accesses be recorded, along with the date and time of each access and the name of each person accessing the record.
Access Principle 4:
The name of the clinician, the date, and the time of the access of a medical record must be recorded. Similar information must be kept for deletions.
The next set of principles concern record creation and information deletion. When a new medical record is created, the clinician creating the record should have access, as should the patient. Typically, the record is created as a result of a referral. The referring clinician needs access to obtain the results of the referral, and so is included on the new record's access control list.
Creation Principle:
A clinician may open a record, with the clinician and the patient on the access control list. If the record is opened as a result of a referral, the referring clinician may also be on the access control list.
How long the medical records are kept varies with the circumstances. Normally, medical records can be discarded after 8 years, but in some casesnotably cancer casesthe records are kept longer.
Deletion Principle:
Clinical information cannot be deleted from a medical record until the appropriate time has passed.
Containment protects information, so a control must ensure that data copied from one record to another is not available to a new, wider audience. Thus, information from a record can be given only to those on the record's access control list.
Confinement Principle:
Information from one medical record may be appended to a different medical record if and only if the access control list of the second record is a subset of the access control list of the first.
A clinician may have access to many records, possibly in the role of an advisor to a medical insurance company or department. If this clinician were corrupt, or could be corrupted or blackmailed, the secrecy of a large number of medical records would be compromised. Patient notification of the addition limits this threat.
Aggregation Principle:
Measures for preventing the aggregation of patient data must be effective. In particular, a patient must be notified if anyone is to be added to the access control list for the patients's record and if that person has access to a large number of medical records.
Finally, systems must implement mechanisms for enforcing these principles.
Enforcement Principle:
Any computer system that handles medical records must have a subsystem that enforces the preceding principles. The effectiveness of this enforcement must be subject to evaluation by independent auditors.
7.2.1. Bell-LaPadula and Clark-Wilson Models
Anderson notes that the Confinement Principle imposes a lattice structure on the entities in this model, much as the Bell-LaPadula Model imposes a lattice structure on its entities. Hence, the Bell-LaPadula protection model is a subset of the Clinical Information Systems security model. But the Bell-LaPadula Model focuses on the subjects accessing the objects (because there are more subjects than security labels), whereas the Clinical Information Systems model focuses on the objects being accessed by the subjects (because there are more patients, and medical records, than clinicians). This difference does not matter in traditional military applications, but it might aid detection of "insiders" in specific fields such as intelligence.
The Clark-Wilson model provides a framework for the Clinical Information Systems model. Take the CDIs to be the medical records and their associated access control lists. The TPs are the functions that update the medical records and their access control lists. The IVPs certify several items:
A person identified as a clinician is a clinician (to the level of assurance required by the system). A clinician validates, or has validated, information in the medical record. When someone (the patient and/or a clinician) is to be notified of an event, such notification occurs. When someone (the patient and/or a clinician) must give consent, the operation cannot proceed until the consent is obtained.
Finally, the requirement of auditing (certification rule CR4) is met by making all records append-only, and notifiying the patient whenever the access control list changes.
 | 
