Misuse of ‘Break-the-Glass’ Policies in Hospitals: Detecting Unauthorized Access to Sensitive Patient Health Data

Creators: Stark, Benjamin and Gewald, Heiko and Heinrich, Lautenbacher and Ulrich, Haase and Siegmar, Ruff
Title: Misuse of ‘Break-the-Glass’ Policies in Hospitals: Detecting Unauthorized Access to Sensitive Patient Health Data
Item Type: Article
Projects: CROSS
Journal or Publication Title: International Journal of Information Security and Privacy
Page Range: pp. 100-122
Date: 2018
Divisions: Informationsmanagement
Abstract: This article describes how the information about an individual’s personal health is among ones most sensitive and important intangible belongings. When health information is misused, serious nonrevertible damage can be caused, e.g. through making intimidating details public or leaking it to employers, insurances etc. Therefore, health information needs to be treated with the highest degree of confidentiality. In practice it proves difficult to achieve this goal. In a hospital setting medical staff across departments often needs to access patient data without directly obvious reasons, which makes it difficult to distinguish legitimate from illegitimate access. This article provides a mechanism to classify transactions at a large university medical center into plausible and questionable data access using a real-life data set of more than 60,000 transactions. The classification mechanism works with minimal data requirements and unsupervised data sets. The results were evaluated through manual cross-checks internally and by a group of external experts. Consequently, the hospital’s data protection officer is now able to focus on analyzing questionable transactions instead of checking random samples.
Citation:

Stark, Benjamin and Gewald, Heiko and Heinrich, Lautenbacher and Ulrich, Haase and Siegmar, Ruff (2018) Misuse of ‘Break-the-Glass’ Policies in Hospitals: Detecting Unauthorized Access to Sensitive Patient Health Data. International Journal of Information Security and Privacy, 12 (3). pp. 100-122.

Actions (login required)

View Item View Item