SECURITY MODELS FOR MEDICAL AND GENETIC INFORMATION

In the past, medical information was physically stored in hospitals, laboratories, and doctors’ offices. Access to this sensitive data was limited, and it was protected by its physical isolation and ignorance of its existence. With the digitization of medical data, this information is becoming accessible through distributed systems, including the Internet. This has increased the numbers of people that can potentially access medical information by orders of magnitude, often providing more efficient transfer of medical records and related information. Misuse of a person’s medical and genetic data could potentially negatively impact his ability to be hired, and limit his career path and his insurability. Clearly medical information is one of the most sensitive types of information and requires strong security measures. We discuss the requirements and policies required for an access control model suitable for medical and genetic information. We indicate the general structure of such a model and conclude that it requires a layered structure. We then show its highest level. We use the Unified Modeling Language (UML) to model a patient record and we make it more precise by defining constraints using the Object Constraint Language (OCL). .