title: Technical guidelines for enhancing privacy and data protection in modern electronic medical environments.
abstract: Raising awareness and providing guidance to on-line data protection is undoubtedly a crucial issue worldwide. Equally important is the issue of applying privacy-related legislation in a coherent and coordinated way. Both these topics gain extra attention when referring to medical environments and, thus, to the protection of patients' privacy and medical data. Electronic medical transactions require the transmission of personal and medical information over insecure communication channels like the Internet. It is, therefore, a rather straightforward task to capture the electronic medical behavior of a patient, thus constructing "patient profiles," or reveal sensitive information related to a patient's medical history. The consequence is clearly a potential violation of the patient's privacy. We performed a risk analysis study for a Greek shared care environment for the treatment of patients suffering from beta-thalassemia, an empirically embedded scenario that is representative of many other electronic medical environments; we capitalized on its results to provide an assessment of the associated risks, focusing on the description of countermeasures, in the form of technical guidelines that can be employed in such medical environments for protecting the privacy of personal and medical information.
authors.affiliation: Information and Communication Systems Security Laboratory, Department of Information and Communication Systems Engineering, University of the Aegean, Samos GR-83200, Greece. sgritz@aegean.gr
authors.forename: Stefanos
authors.initials: S
authors.lastname: Gritzalis
authors.forename: Costas
authors.initials: C
authors.lastname: Lambrinoudakis
authors.forename: Dimitrios
authors.initials: D
authors.lastname: Lekkas
authors.forename: Spyros
authors.initials: S
authors.lastname: Deftereos
mesh_terms: D003195:Computer Communication Networks; D016494:Computer Security; D003219:Confidentiality; D003628:Database Management Systems; D004582:Electronics, Medical; D006115:Greece; D017408:Guidelines as Topic; D016247:Information Storage and Retrieval / Q000379:methods* / Q000592:standards; D016347:Medical Records Systems, Computerized; D018570:Risk Assessment / Q000379:methods*; D012307:Risk Factors; D013673:Technology Assessment, Biomedical