Security and data normalization collaboration

1. Security and data normalization collaboration Discussion by Mark Frisse and Carl Gunter sharps.org

3. The Emerging Clusters • Four groups of activities have emerged • Policy rules and modules • Audit of EHR access • Encryption and trusted base • Telemedicine • Discussion today: areas of possible overlap with SHARPN • Discussion of Audit Toolkit • Some general discussion questions

4. Introduction • Audit is important for EHRs • Heavy reliance on accountability • Critical trust with patients • Current techniques are too ad hoc and reactive • Need audit that is meaningful • To do this: develop audit techniques that are more portable based on standardized logs • Extensible Medical Open Audit Toolkit (EMOAT) • Carl Gunter, David Liebovitz, Brad Malin, Sanjay Mehrotra together with staff and students

5. Background and Related Work • Standards: DICOM, RFC 3881, IHE ATNA, NHIN Audit Log Requests, HL7 PASS Audit • Analysis • Community-based Anomaly Detection (CADS) • Patient Flow-based Anomaly Detection (PFADS) • Process • Experience-based Access Management • Role-Up Algorithm for role engineering • Reporting support for HHS Rule 45 CFR Part 164

6. Towards Standardized Log Analysis • Mapped attributes are ones that have a standard semantics • Mapping type is a pair consisting of required mapped attributes and optional mapped attributes • Application is compatible if it has the required attributes, may be able to use the others too • Three focus areas so far • The Matrix • Role Hierarchies • Role Mapping

8. Analytic Techniques for Scoring • CADS: Create a social network from joint access to a record. Use k th nearest neighbor to form communities. Look for outliers and their neighbors. • PFADS: Form a graph from observed transitions between record accesses by users grouped in classes. Rare transitions are considered outliers.

9. Analytic Techniques for Role Engineering and Reporting • Role Engineering • Role-up: Train a naïve Bayes classifier on actions of roles over an audit set. Use this to predict roles from actions. Choose a parameter to balance specificity and accuracy. • Reporting • Two views: operations and patient • Scoring to aid operations • Role mapping to aid patients

10. EMOAT Part 1 of 2

11. EMOAT Part 2 of 2

12. CADS Comparison

13. Reporting Application

14. Future Work on EBAM/EMOAT • Continued tuning and testing of the algorithms • Addressing the scalability and flexibility of EMOAT • Extensions to HIE: • Communication between Cerner and Epic systems within NMH, • Illinois controlled substance system • Extending the Matrix: JHU, AthenaHealth, eClinicalWorks, and GE Centricity. Audit worshop? • Coordination with SHARPN?

15. Policy prioritization and synthesis the policy “cloud” Denise Helen CMU Stanford Policy Synthesis Group Frisse (lead) Denise (co-lead) McCarthy (analyst) commonuse cases& syntax SelectedResearchActivities VU ISIS U Of IL NWU JHU Vanderbilt JHU, NWU RTI Summaries Developer-readablerepresentation Formalrepresentation Laws &Policies Dartmouth Summaries backward links backward links backward links

16. Potential discussion • SHARPn & privacy, consent • Granularity (e.g., PCAST). • Roles – access, consent, and encryption • Test beds – who & for what purpose • Thinking through the continuum from “top secret” to “information altruists” • Software tools

17. Further Discussion • How does SHARPn view the general issue of privacy, consent, and the granularity issues (e.g., PCAST). • To what extent are SHARPn investigators working through formalizing roles and other issues? • How do people view the continuum from "top secret" to "research for selective reasons" to "total information altruism." How are people thinking about these issues? What approaches seem most apropos?