PubMed Health⌕ Search

Biomedical subjects

G Pangalos

Publications and source records attributed to G Pangalos.

18 recordsLinked to original sources
PubMed2002

Security of medical multimedia.

The application of information technology to health care has generated growing concern about the privacy and security of medical information. Furthermore, data and communication security requirements in the field of multimedia are higher. In this paper we describe firstly the most important security requirements that must be fulfilled by multimedia medical data, and the security measures used to satisfy these requirements. These security measures are based mainly on modern cryptographic and watermarking mechanisms as well as on security infrastructures. The objective of our work is to complete this picture, exploiting the capabilities of multimedia medical data to define and implement an authorization model for regulating access to the data. In this paper we describe an extended role-based access control model by considering, within the specification of the role-permission relationship phase, the constraints that must be satisfied in order for the holders of the permission to use those permissions. The use of constraints allows role-based access control to be tailored to specifiy very fine-grained and flexible content-, context- and time-based access control policies. Other restrictions, such as role entry restriction also can be captured. Finally, the description of system architecture for a secure DBMS is presented.

Computer Security↗
PubMed2002

Developing a Public Key Infrastructure for a secure regional e-Health environment.

OBJECTIVES: Internet technologies provide an attractive infrastructure for efficient and low cost communications in regional health information networks. The advantages provided by the Internet come however with a significantly greater element of risk to the confidentiality and integrity of information. This is because the Internet has been designed primarily to optimize information sharing and interoperability, not security. The main objective of this paper is to propose the exploitation of public-key cryptography techniques to provide adequate security to enable secure healthcare Internet applications. METHODS: Public-key cryptography techniques can provide the needed security infrastructure in regional health networks. In the regional health-care security framework presented in this paper, we propose the use of state-of-art Public Key Infrastructure (PKI) technology. Such on e-Health PKI consists of regional certification authorities that are implemented within the central hospitals of each region and provide their services to the rest of the healthcare establishments of the same region. RESULTS: Significant experience in this area has been gained from the implementation of the PKI@AUTH project. CONCLUSIONS: The developed PKI infrastructure already successfully provides its security services to the AHEPA university hospital. The same infrastructure is designed to easily support a number of hospitals participating in a regional health information network.

Computer Security↗
PubMed2002

Integrating the lightweight authentication protocol (LAP) with access control mechanisms in wireless health care information systems.

Health information networks are expected to support information exchange that is authentic, accurate, private and available when, where and to whom is needed. With the increase of the shared medical information and resources in healthcare wireless information systems, unauthorized access to the information by illegal users also increases. The security of the transmitted information is a vital issue. In this paper, we report on the development of the Lightweight Authentication Protocol (LAP), which makes a mobile and distributed system more secure and flexible and we implement it in a Health Care Environment where the clinicians use mobile and wireless devices like PDAs. We also provide an indicative example of integrating the LAP with access control mechanisms. Context-based Team Access Control (C-TMAC) model is used in this example, since it provides great flexibility on user-permissions management in collaborative healthcare environments. LAP is indeed capable to support efficiently the advanced authorization procedures of such demanding active security models.

Computer Security↗
PubMed1997

Implementing security on a prototype hospital database.

This paper describes the methodology used and the experience gained from the application of a new secure database design approach and database security policy in a real life hospital environment. The applicability of the proposed database security policy in a major Greek general hospital is demonstrated. Moreover, the security and quality assurance of the developed prototype secure database is examined, taking into consideration the results from the study of the user acceptance.

Computer Security↗
PubMed1997

Security of medical image databases.

Medical images are an integral and indispensable part of health care information systems. Because of the critical nature of image information and stringent privacy requirements in medical environments, the medical images database systems must provide reasonable safeguards to assure confidentiality, integrity and availability of images to be deployable. In this paper we address mainly the confidentiality issues. Only authorized users should have for example access to medical images. Access to images is usually based on certain security constraints. Security constraints processing is a widely used mechanism for obtaining the appropriate level of the security required in traditional (non-multimedia) database systems. However, the security constraints processing in multimedia environments possess a number of interesting problems. In this paper we address the advantages and problems of using content-based security constraints on medical image databases. We also propose a methodology for the integration of security constraints into medical image databases, taking into account the true multimedia nature of the medical images (e.g. the content of the medical images).

Computer Communication Networks↗
PubMed1996

Security aspects for medical device vigilance information exchange.

The implementation of appropriate security mechanisms for an effective and efficient medical device vigilance information exchange is very important, as the system handles sensitive information. These mechanisms have to be designed in such a way that they maintain confidentiality, integrity and availability of the data of medical devices. In this paper the security aspects of the information exchange on medical device vigilance is examined in detail.

Computer Security↗
PubMed1996

Cardiological database management system as a mediator to clinical decision support.

An object-oriented medical database management system is presented for a typical cardiologic center, facilitating epidemiological trials. Object-oriented analysis and design were used for the system design, offering advantages for the integrity and extendibility of medical information systems. The system was developed using object-oriented design and programming methodology, the C++ language and the Borland Paradox Relational Data Base Management System on an MS-Windows NT environment. Particular attention was paid to system compatibility, portability, the ease of use, and the suitable design of the patient record so as to support the decisions of medical personnel in cardiovascular centers. The system was designed to accept complex, heterogeneous, distributed data in various formats and from different kinds of examinations such as Holter, Doppler and electrocardiography.

Cardiovascular Diseases↗
PubMed1995

An integrated secure design of a medical database system.

An integrated secure design methodology for the enhancement of database security in a hospital environment is presented in this paper. The proposed design methodology is based on both the discretionary and the mandatory database security policies. In this way, the advantages of both approaches are combined to enhance medical database security. The experimental implementation of the methodology in a major Greek hospital is also presented. The implementation has shown that the combined discretionary and mandatory security enforcement effectively limits unauthorized access to the medical database, without severely restricting the capabilities of the system.

Computer Security↗
PubMed1994

Enhancing medical database security.

A methodology for the enhancement of database security in a hospital environment is presented in this paper which is based on both the discretionary and the mandatory database security policies. In this way the advantages of both approaches are combined to enhance medical database security. An appropriate classification of the different types of users according to their different needs and roles and a User Role Definition Hierarchy has been used. The experience obtained from the experimental implementation of the proposed methodology in a major general hospital is briefly discussed. The implementation has shown that the combined discretionary and mandatory security enforcement effectively limits the unauthorized access to the medical database, without severely restricting the capabilities of the system.

Computer Security↗
PubMedDate not supplied

Development of an Internet Security Policy for health care establishments.

The Internet provides unprecedented opportunities for interaction and data sharing among health care providers, patients and researchers. However, the advantages provided by the Internet come with a significantly greater element of risk to the confidentiality and integrity of information. This paper defines the basic security requirements that must be addressed in order to use the Internet to safely transmit patient and/or other sensitive Health Care information. It describes a suitable Internet Security Policy for Health Care Establishments and provides the set of technical measures that are needed for its implementation. The proposed security policy and technical approaches have been based on an extensive study of the related recommendations from the security and standard groups both in EU amid USA and our related work and experience. The results have been utilized in the framework of the Intranet Health Clinic project, where the use of the Internet for the transmission of sensitive Health Care information is of vital importance.

Computer Communication Networks↗
PubMedDate not supplied

Access control based on attribute certificates for medical intranet applications.

BACKGROUND: Clinical information systems frequently use intranet and Internet technologies. However these technologies have emphasized sharing and not security, despite the sensitive and private nature of much health information. Digital certificates (electronic documents which recognize an entity or its attributes) can be used to control access in clinical intranet applications. OBJECTIVES: To outline the need for access control in distributed clinical database systems, to describe the use of digital certificates and security policies, and to propose the architecture for a system using digital certificates, cryptography and security policy to control access to clinical intranet applications. METHODS: We have previously developed a security policy, DIMEDAC (Distributed Medical Database Access Control), which is compatible with emerging public key and privilege management infrastructure. In our implementation approach we propose the use of digital certificates, to be used in conjunction with DIMEDAC. RESULTS: Our proposed access control system consists of two phases: the ways users gain their security credentials; and how these credentials are used to access medical data. Three types of digital certificates are used: identity certificates for authentication; attribute certificates for authorization; and access-rule certificates for propagation of access control policy. Once a user is identified and authenticated, subsequent access decisions are based on a combination of identity and attribute certificates, with access-rule certificates providing the policy framework. CONCLUSIONS: Access control in clinical intranet applications can be successfully and securely managed through the use of digital certificates and the DIMEDAC security policy.

Certification↗
PubMedDate not supplied

A framework for an institutional high level security policy for the processing of medical data and their transmission through the Internet.

BACKGROUND: The Internet provides many advantages when used for interaction and data sharing among health care providers, patients, and researchers. However, the advantages provided by the Internet come with a significantly greater element of risk to the confidentiality, integrity, and availability of information. It is therefore essential that Health Care Establishments processing and exchanging medical data use an appropriate security policy. OBJECTIVE: To develop a High Level Security Policy for the processing of medical data and their transmission through the Internet, which is a set of high-level statements intended to guide Health Care Establishment personnel who process and manage sensitive health care information. METHODS: We developed the policy based on a detailed study of the existing framework in the EU countries, USA, and Canada, and on consultations with users in the context of the Intranet Health Clinic project. More specifically, this paper has taken into account the major directives, technical reports, law, and recommendations that are related to the protection of individuals with regard to the processing of personal data, and the protection of privacy and medical data on the Internet. RESULTS: We present a High Level Security Policy for Health Care Establishments, which includes a set of 7 principles and 45 guidelines detailed in this paper. The proposed principles and guidelines have been made as generic and open to specific implementations as possible, to provide for maximum flexibility and adaptability to local environments. The High Level Security Policy establishes the basic security requirements that must be addressed to use the Internet to safely transmit patient and other sensitive health care information. CONCLUSIONS: The High Level Security Policy is primarily intended for large Health Care Establishments in Europe, USA, and Canada. It is clear however that the general framework presented here can only serve as reference material for developing an appropriate High Level Security Policy in a specific implementation environment. When implemented in specific environments, these principles and guidelines must also be complemented by measures, which are more specific. Even when a High Level Security Policy already exists in an institution, it is advisable that the management of the Health Care Establishment periodically revisits it to see whether it should be modified or augmented.

Access to Information↗
PubMedDate not supplied

Design of hospital database systems in a non-relational environment.

The lack of an appropriate, widely accepted, design procedure for use with non-relational database management systems has been a major, common problem in many efforts to develop an integrated hospital database. The availability of such a design procedure is particularly important today since the majority of the database management systems currently in use are non-relational. A database design procedure is proposed which should assist with the design of optimal non-relational hospital database systems. The proposed design procedure is separated into two distinct steps: the development of an appropriate intermediate relational database structure and the subsequent development of an equivalent non-relational one. A set of rules is given for the move from the proposed intermediate relational to the equivalent non-relational structure. An example application from the hospital environment is also included in order to better demonstrate the process.

Computer Communication Networks↗
PubMedDate not supplied

Development of an experimental hospital database system using a relational database management system.

The development of an integrated database system for the satisfactory support of the information processing requirements of a modern hospital is clearly a major task with many associated problems. A design and implementation procedure for the development of a relational hospital database system based on an experimental relational database management system is presented which should help overcome some of the problems currently encountered. A brief outline of the application and the underlying database management system is given and a standardized procedure for the design of the multilevel database schemata is presented. The associated problems and procedures required for such a development are also examined and a number of theoretical conclusions and claims are tested in a real life application environment.

Database Management Systems↗
PubMedDate not supplied

Design and implementation of computer-readable patient data cards--applications in Europe.

Computers have been widely accepted today as essential tools for handling and processing an ever-increasing flood of information. At the same time people, including patients and medical staff, are becoming more mobile and face the problem of interacting with the different computerized systems. We are also experiencing the acceptance of the small rectangular plastic cards as the instrument for vast numbers of transactions throughout the world. These factors have highlighted the possible attractions of machine-readable patient data cards that can be carried by the patients themselves. The patient data card is expected to provide quick reference information to any physician or health worker consulted by the carrier. This information should avoid duplication of diagnostic, therapeutic and prescription measures and help give a conveniently structured summary of the patient's medical history. Advances in technology have made it possible to move from the familiar credit card which can store only a limited amount of information, to new, similarly shaped cards with much greater capabilities. The basic technologies for patient data cards are examined. An analysis is then attempted of the possible information contents of such a card that could be used at a national and European level, and of the field trials in Europe so far. Questions of security and standardization are also addressed. A number of conclusions and recommendations are also made which are based on the experience gained from a relevant implementation attempted, and participation in a recent study undertaken by the EEC in the area.

Computer Security↗
PubMedDate not supplied

A generic methodology for health care data security.

The aim is to outline the framework of a generic methodology for specifying countermeasures in health care environments. The method is specifically aimed at the enhancement of security in existing health care systems, and a key element is the use of predetermined 'profiles' by which these may be classified. Example scenarios are presented to illustrate how the concept could be applied in practice. The paper is based upon work that was initially carried out as part of the Commission of European Communities SEISMED (Secure Environment for Information Systems in MEDicine) project, the aim of which is to provide security recommendations for European health care establishments (HCEs).

Computer Security↗
PubMedDate not supplied

EDI system definition for a European medical device vigilance system.

EDI is expected to be the dominant form of business communication between organizations moving to the Electronic Commerce era of 2000. The healthcare sector is already using EDI in the hospital supply function as well as in the clinical area and the reimbursement process. In this paper, we examine the use of EDI in the healthcare administration sector and more specifically its application to the Medical Device Vigilance System. Firstly, the potential of this approach is examined, followed by the definition of the EDI System Reference Model and the specification of the required system architecture. Each of the architecture's components are then explained in more detail, followed by the most important implementation options relating to them.

Computer Communication Networks↗