A HIPAA-compliant key management scheme with revocation of authorization.
Patient control over electronic protected health information (ePHI) is one of the major concerns in the Health Insurance and Accountability Act (HIPAA). In this paper, a new key management scheme is proposed to facilitate control by providing two functionalities. First, a patient can authorize more than one healthcare institute within a designated time period to access his or her ePHIs. Second, a patient can revoke authorization and add new authorized institutes at any time as necessary. In the design, it is not required to re-encrypt ePHIs for adding and revoking authorizations, and the implementation is time- and cost-efficient. Consent exception is also considered by the proposed scheme.
Department of Information Engineering and Computer Science, Feng Chia University, Taiwan, ROC.
Wei-Bin
WB
Lee
Department of Information Engineering and Computer Science, Feng Chia University, Taiwan, ROC; Department of Information Systems, Changhua Christian Hospital, Taiwan, ROC. Electronic address: P9521801@fcu.edu.tw.
Chien-Ding
CD
Lee
Department of Computer Science and Communication Engineering, Providence University, Taiwan, ROC.
Kevin I-J
KI
Ho
D019295:Computational Biology; D016494:Computer Security; D003219:Confidentiality; D032962:Consent Forms; D057286:Electronic Health Records / Q000458:organization & administration; D019983:Guideline Adherence; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D013624:Taiwan; D014481:United States
Cryptography; Health Insurance and Accountability Act (HIPAA); Key management; Revocation