Patient Privacy Violation Detection in Healthcare Critical Infrastructures: An Investigation Using Density-Based Benchmarking

Abstract

Hospital critical infrastructures have a distinct threat vector, due to (i) a dependence on legacy software; (ii) the vast levels of interconnected medical devices; (iii) the use of multiple bespoke software and that (iv) electronic devices (e.g., laptops and PCs) are often shared by multiple users. In the UK, hospitals are currently upgrading towards the use of electronic patient record (EPR) systems. EPR systems and their data are replacing traditional paper records, providing access to patients’ test results and details of their overall care more efficiently. Paper records are no-longer stored at patients’ bedsides, but instead are accessible via electronic devices for the direct insertion of data. With over 83% of hospitals in the UK moving towards EPRs, access to this healthcare data needs to be monitored proactively for malicious activity. It is paramount that hospitals maintain patient trust and ensure that the information security principles of integrity, availability and confidentiality are upheld when deploying EPR systems. In this paper, an investigation methodology is presented towards the identification of anomalous behaviours within EPR datasets. Many security solutions focus on a perimeter-based approach; however, this approach alone is not enough to guarantee security, as can be seen from the many examples of breaches. Our proposed system can be complementary to existing security perimeter solutions. The system outlined in this research employs an internal-focused methodology for anomaly detection by using the Local Outlier Factor (LOF) and Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithms for benchmarking behaviour, for assisting healthcare data analysts. Out of 90,385 unique IDs, DBSCAN finds 102 anomalies, whereas 358 are detected using LOF.

An Analysis of Integrating Machine Learning in Healthcare for Ensuring Confidentiality of the Electronic Records

“…The implementation of technology in the healthcare domain increases the probability of exposing sensitive health data [48]. It is one of the top three sectors that face the highest number of breached incidents annually [61]. Boddy et al discuss healthcare data confidentiality and specify that both the insider as well as outsider threats violate healthcare data confidentiality and results in patients' loss of trust in the healthcare service providers [45,57].…”

The Systematic Literature Review of Privacy-Preserving Solutions in Smart Healthcare Environment

“…Contrary to these propositions, the work performed by Ge et al [43] while aiming to predict disease by using deep learning also assured the data deletion approach by the data owner to limit access to their health data. Toward the identification of anomalous behaviors within electronic patient record (EPR) datasets, researchers Hurst et al [44] presented an investigation methodology. e proposed framework uses the LOF algorithm to detect unusual data patterns, labeling points as normal or anomalous, under the consideration of an HIL approach.…”

Securing electronic health records against insider-threats: A supervised machine learning approach

“…A sample of the raw EHR data is displayed in Table 1 for clarification. The disaggregation of the EHR is a necessary step for benchmarking normal and anomalous behaviours for each of the four action groups in the record for the supervised learning; as the core activities within each of the groupings differ to a high extent -as outlined in detail in previous work (Hurst et al, 2020).…”

“…Few other approaches use real world data on this scale and many adopt simulation for testing; yet none have tested the approach on this specific dataset. For clarity, the data used for the analysis is provided by a UK-based hospital (which the authors have made available on EASY-DANS (Hurst, 2021)), with the anomalous readings pre-labelled by means of density-based classification outlined in our related work in (Hurst et al, 2020) where anomalous points were confirmed in verbal consultation. 2) The focus of this approach is on insider threats, rather than external, and specifically focused on EHR datasets.…”