Please enable JavaScript.
Coggle requires JavaScript to display documents.
Data protection in health care - Coggle Diagram
Data protection in health care
Privacy (Written consent)
Legal aspects
Right to consent/deny access to
personal data
GDPR General data protection regulation
personal data: Any information related to a natural person, that can be used to directly or indirectly identify that person
Sensitive data: Special categories of personal data, including biometric, genetic and, more in general, health-related data.
Ethics
security risks just when information is valuable for someone
“The protection of natural persons in relation to the processing of personal data is a fundamental right.”
Right to be let alone
Security (Data must be protected from unauthorized access)
Protection against unauthorized access (from INSIDE the institution or from OUTSIDE) Management of access policies
critical phases for data protection
sending phase-> interception (sniffing)
can happen
The dispatch phase
The receipt phase
document can be
Stolen and deleted
Stolen and changed
Redirected or used by another sender
Read/Copied by someone who is not authorized
archiving phase -> unauthorized access
Generation phase -> falsification
impact on professional reputation, local implications
to prevent each document has to be verified
digital signature
checksum -> fingerprint
possible damages
Data falsification→the document is changed
Privacy violation→the document is read by
someone who is not authorized
Integrity disruption→the document ist otally or partially damaged
Knowledge theft→the document is copied by someone who is not authorized
SOME informatics threats
MALWARE generic term for a software that has malicious purposes (virus spyware)
PHISHING, attempt to steal personal information (e.g. credentials) by redirecting users to a malicious website
SOCIAL ENGINEERING, attempt to persuade users to divulge confidential information, like passwords (e.g. the sender of an email who pretends to be the technical administrator of your domain), or to click on malicious links.
DEFENSE STRATEGIES
Workstation level
defend the workstation, regular software update
scan email attachments, choose the software accurately
Preserve personal data, be suspicious
Organization level
secure transmission protocols / cryptography
firewall cryptography
digital signature / cheksum
Firewell
controlled door: filters inbound and outbound
Detection of unwanted or suspicious connections from other network users or from applications running on the same computer.
It can operate by considering a controlled access list.
Actors and roles
actors
workgroup
workgroup member
administrator
onetime emergency user
roles
creator
compiler
signature
read
watchperson
manager
Integrity / Availability / reliability (Data must be protected from accidental destruction)
Data cannot be lost in a disaster (reliability)
Redundancy, in order to replace the original ones in case of data-loss events.
Backup file based or incremental
local
remote
Data must always be accessible when needed (availability)
Mirroring (RAID) redundant array of inexpensive disks
Data cannot be deleted /changed (integrity)
Preservation of data