Privacy policy enforcement for health information data access

Abstract

Wireless technology is steadily improving the access and cost-effectiveness of healthcare data management. With the growth in information access, comes the challenge of maintaining patient record privacy and security. Our work develops an algorithm to evaluate ad-hoc user queries against database policies. We consider an efficient evaluation algorithm (defined at the schema-level), based on a classification of attributes in the policy and query (both of which can be written in SQL). Our algorithm can be used for policy integration as well, and scales well with typical query sizes that may be expected for mobile devices.