SECURITY AND DATA NORMALIZATION COLLABORATION

sharps.orgDiscussion by Mark Frisse and Carl Gunter

The Emerging Clusters

Four groups of activities have emerged Policy rules and modules Audit of EHR access Encryption and trusted base Telemedicine

Discussion today: areas of possible overlap with SHARPN Discussion of Audit Toolkit Some general discussion questions

3

Introduction

Audit is important for EHRs Heavy reliance on accountability Critical trust with patients

Current techniques are too ad hoc and reactive Need audit that is meaningful To do this: develop audit techniques that are

more portable based on standardized logs Extensible Medical Open Audit Toolkit

(EMOAT) Carl Gunter, David Liebovitz, Brad Malin, Sanjay

Mehrotra together with staff and students

4

Background and Related Work Standards: DICOM, RFC 3881, IHE ATNA,

NHIN Audit Log Requests, HL7 PASS Audit Analysis

Community-based Anomaly Detection (CADS) Patient Flow-based Anomaly Detection (PFADS)

Process Experience-based Access Management Role-Up Algorithm for role engineering Reporting support for HHS Rule 45 CFR Part 164

5

Towards Standardized Log Analysis Mapped attributes are ones that have a

standard semantics Mapping type is a pair consisting of required

mapped attributes and optional mapped attributes

Application is compatible if it has the required attributes, may be able to use the others too

Three focus areas so far The Matrix Role Hierarchies Role Mapping

6

Analytic Techniques for Scoring CADS: Create a social network from joint

access to a record. Use k th nearest neighbor to form communities. Look for outliers and their neighbors.

PFADS: Form a graph from observed transitions between record accesses by users grouped in classes. Rare transitions are considered outliers.

8

Analytic Techniques for Role Engineering and Reporting Role Engineering

Role-up: Train a naïve Bayes classifier on actions of roles over an audit set. Use this to predict roles from actions. Choose a parameter to balance specificity and accuracy.

Reporting Two views: operations and patient Scoring to aid operations Role mapping to aid patients

9

EMOAT Part 1 of 210

EMOAT Part 2 of 211

CADS Comparison12

Reporting Application13

Future Work on EBAM/EMOAT Continued tuning and testing of the algorithms Addressing the scalability and flexibility of

EMOAT Extensions to HIE:

Communication between Cerner and Epic systems within NMH,

Illinois controlled substance system Extending the Matrix: JHU, AthenaHealth,

eClinicalWorks, and GE Centricity. Audit worshop?

Coordination with SHARPN?

14

the policy “cloud”

Denise

VanderbiltJHU, NWU

Helen

Policy Synthesis GroupFrisse (lead)Denise (co-lead)McCarthy (analyst)

VU ISIS

Stanford

CMU

SelectedResearchActivities

Policy prioritization and synthesis

commonuse cases& syntax

Laws &Policies

RTI Summaries

Dartmouth Summaries

Developer-readable

representation

Formalrepresentation

backward links backward links backward links

U Of IL

NWU

JHU

Potential discussion

SHARPn & privacy, consent Granularity (e.g., PCAST). Roles – access, consent, and encryption Test beds – who & for what purpose Thinking through the continuum from

“top secret” to “information altruists” Software tools

16

Further Discussion

How does SHARPn view the general issue of privacy, consent, and the granularity issues (e.g., PCAST).

To what extent are SHARPn investigators working through formalizing roles and other issues?

How do people view the continuum from "top secret" to "research for selective reasons" to "total information altruism." How are people thinking about these issues? What approaches seem most apropos?

17