Experiences in the logical specification of the HIPAA and GLBA privacy laws

Abstract

Despite the wide array of frameworks proposed for the formal specification and analysis of privacy laws, there has been comparatively little work on expressing large fragments of actual privacy laws in these frameworks. We attempt to bridge this gap by giving complete logical formalizations of the transmission-related portions of the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA). To this end, we develop the PrivacyLFP logic, whose features include support for disclosure purposes, real-time constructs, and self-reference via fixed points. To illustrate these features and demonstrate PrivacyLFP's utility, we present formalizations of a collection of clauses from these laws. Due to their size, our full formalizations of HIPAA and GLBA appear in a companion technical report. We discuss ambiguities in the laws that our formalizations revealed and sketch preliminary ideas for computer-assisted enforcement of such privacy policies.

Temporal Mode-Checking for Runtime Monitoring of Privacy Policies

“…To address this limitation, many logics and languages have been proposed for specifying privacy policies. Some examples are P3P [48,49], EPAL [50,51], Privacy APIs [52], LPU [53,54], past-only fragment of first-order temporal logic (FOTL) [10,11], predLTL [55], pLogic [56], PrivacyLFP [12], MFOTL [5][6][7], the guarded fragment of first-order logic with explicit time [4], and P-RBAC [57]. Our policy language, GMP, is more expressive than many existing policy languages such as LPU [53,54], P3P [48,49], EPAL [50,51], and P-RBAC [57].…”

“…First, they both assume that privacy policies are represented in first-order temporal logic, extended with explicit time. Such extensions have been demonstrated adequate for representing the privacy requirements of both HIPAA and GLBA [12]. Second, to ensure that only finitely many instances of quantifiers are tested during compliance checking, both lines of work use static policy checks to restrict the syntax of the logic.…”

Privacy through Accountability: A Computer Science Perspective

“…The idea that privacy expectations can be stated using context-relative informational norms is formalized in a semantic model and logic of privacy proposed with colleagues at Stanford and New York University [1] and developed further in follow-up work with my students and postdoctoral researchers [8]. At a high-level, the model consists of a set of interacting agents in roles who perform actions involving personal information in a given context.…”

“…We arrive at this enforceable logic by restricting the syntax of the expressive first-order logic we used in our earlier work to develop the first complete formalization of two US privacy laws-the HIPAA Privacy Rule for healthcare organizations and the Gramm-Leach-Bliley Act for financial institutions [8] 1 . These comprehensive case studies shed light on common concepts that arise in transmission principles in practice-data attributes, dynamic roles, notice and consent (formalized as temporal properties), purposes of uses and disclosures, and principals' beliefs-as well as how individual transmission principles are composed in privacy policies 2 .…”

“…This article provides an overview of a body of work on formalizing and enforcing practical privacy policies using computational techniques [1,2,[4][5][6][7][8][9][16][17][18] conducted jointly with my students, postdoctoral researchers, and colleagues at Carnegie Mellon, Stanford, and New York University. We find that one significant difference from traditional security settings is that the enforcement mechanisms in privacy settings often have only black-box access to the programs and people who operate on personal information.…”