Comprehensive user requirements engineering methodology for secure and interoperable health data exchange

Abstract

BackgroundIncreased digitalization of healthcare comes along with the cost of cybercrime proliferation. This results to patients’ and healthcare providers' skepticism to adopt Health Information Technologies (HIT). In Europe, this shortcoming hampers efficient cross-border health data exchange, which requires a holistic, secure and interoperable framework. This study aimed to provide the foundations for designing a secure and interoperable toolkit for cross-border health data exchange within the European Union (EU), conducted in the scope of the KONFIDO project. Particularly, we present our user requirements engineering methodology and the obtained results, driving the technical design of the KONFIDO toolkit.MethodsOur methodology relied on four pillars: (a) a gap analysis study, reviewing a range of relevant projects/initiatives, technologies as well as cybersecurity strategies for HIT interoperability and cybersecurity; (b) the definition of user scenarios with major focus on cross-border health data exchange in the three pilot countries of the project; (c) a user requirements elicitation phase containing a threat analysis of the business processes entailed in the user scenarios, and (d) surveying and discussing with key stakeholders, aiming to validate the obtained outcomes and identify barriers and facilitators for HIT adoption linked with cybersecurity and interoperability.ResultsAccording to the gap analysis outcomes, full adherence with information security standards is currently not universally met. Sustainability plans shall be defined for adapting existing/evolving frameworks to the state-of-the-art. Overall, lack of integration in a holistic security approach was clearly identified. For each user scenario, we concluded with a comprehensive workflow, highlighting challenges and open issues for their application in our pilot sites. The threat analysis resulted in a set of 30 user goals in total, documented in detail. Finally, indicative barriers of HIT acceptance include lack of awareness regarding HIT risks and legislations, lack of a security-oriented culture and management commitment, as well as usability constraints, while important facilitators concern the adoption of standards and current efforts for a common EU legislation framework.ConclusionsOur study provides important insights to address secure and interoperable health data exchange, while our methodological framework constitutes a paradigm for investigating diverse cybersecurity-related risks in the health sector.Electronic supplementary materialThe online version of this article (10.1186/s12911-018-0664-0) contains supplementary material, which is available to authorized users.

Managing Complexity. From Documentation to Knowledge Integration and Informed Decision Findings from the Clinical Information Systems Perspective for 2018

“…Another core aspect that may not be overlooked within the CIS domain are the users. Pantelis Natsiavas and colleagues propose a comprehensive user requirements methodology for secure and interoperable health data exchange 18 . This candidate paper is worth reading as it also provides a comprehensive set of user requirements and presents sets of barriers as well as facilitators for health IT solutions.…”

Developing a Transnational Health Record Framework with Level-Specific Interoperability Guidelines Based on a Related Literature Review

“…The need for interoperability has already been recognized for a long time, and many related studies have also been conducted [ 5 ]. However, previous studies have mostly focused on technical interoperability, such as with data formats [ 19 , 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 ]. Interoperability includes not only the technical aspects, but also business processes, workflows, and policies.…”

Requirements elicitation for secure and interoperable cross‐border health data exchange: the KONFIDO study

“…In this regard, requirements elicitation is a central part of user requirements engineering [10]. In the current work, we consider requirements elicitation as the process of exploiting and combining various information sources (including end‐user input), in order to discover the current needs and agree upon the vision and goals of the targeted project [8, 11]. From the user's perspective, effective elicitation results in better understanding of their needs; in the designer's perspective, it results in a clear and high‐level specification of the problem that is to be solved, assuring that a solution is feasible, and it is being developed for the right problem [12].…”

“…The current study introduces a practical and comprehensive paradigm for eliciting diverse cybersecurity-related requirements in the health sector, part of the specific user requirements engineering process described in [8], focusing on cross-border health data exchange. The decision to use a custom approach and not adopt an existing user requirements engineering and elicitation methodology was taken to accommodate the challenges imposed by the specific project's context, i.e.…”

“…‘user requirements’; ‘design’; ‘technology development’; and ‘integration, testing and validation’. The overall user requirements engineering methodology employed is presented in [8], while an overview of the KONFIDO toolkit design as well as a description of its components is provided in [9].…”