Owner-controlled information

Abstract

Information about individuals is currently maintained in many thousands of databases, with much of that information, such as name and address, replicated across multiple databases. However, this proliferation of personal information raises issues of privacy for the individual, as well as maintenance issues in terms of the accuracy of the information. Ideally, each individual would own, maintain and control his personal information, allowing access to those who needed at the time it was needed. Organizations would contact the individual directly to obtain information, therefore being assured of using current and correct information.While research has been performed on users owning and controlling access to their personal information in an electronic commerce environment, we argue that this concept should be extended to all user information including, for example, medical and financial information. The end goal is not for users to simply maintain copies of this information, but to be the source of this information. This paper presents the concept of users owning their personal information and introduces some of the issues involved in users being able to control access to this information. The security requirements, including authentication, access control and audit, as well as user interfaces and trust, for this new paradigm are given particular emphasis.

The security and privacy implications of using social networks to deliver healthcare

“…These considerations are crucial for the groups to succeed, both in the sense of being able to obtain members and in the sense of helping those members as much as would groups that are physically together. These issues must be considered both as the rules for the group are being constituted, and as the group evolves over time, 5 We note that the USENET groups were typically selfmoderating, and when "flamers" came along to stir up members of the group, those who needed support simply left. because as time passes the need for new rules may arise, and the type of privacy and security desired may change.…”

“…This is essentially a problem of imple-menting originator-controlled access control, something that is required for digital rights management (DRM), among other controls. The privacy and security issues inherent in allowing users to control their own information, both in a health context and more generally, have been discussed in other papers (e.g., [5]). …”

E-Portfolios and Blogs: Online Tools for Giving Young Engineers a Voice

“…The advantage of a personal Web space is to give the e-portfolio owner the freedom to think differently, and to give them control over how they present themselves and their ideas to others. This essentially provides "consistency for the user's identity" on the Web [9].…”

Patient-centric authorization framework for sharing electronic health records

“…For instance, a patient's medical information pertaining to an HIV/AIDS diagnosis may be explicitly hidden from general medical information sharing unless a specific treatment option is indicated. To support this, the patient should ultimately own his or her medical records and be responsible for maintaining access rights for the distributed EHRs [12,6]. It is, therefore, essential that patients be provided with a secure, usable, and straightforward mechanism that allows them to quickly and easily authorize a variety of medical affiliates to access their sensitive records or a subset of the data within them.…”