Securing a Health Information System with a government issued digital identification card

Abstract

Health Information Systems (HIS) are often deployed with inadequate security solutions. Given the importance and sensitivity of this matter and to guarantee the rule of law, as well as the legal and ethical value of decisions made in a hospital setting, often dealing with life/death situations, there is an urgent need for a much better provisioning of health information systems security.The launch of the Portuguese digital national identification smart card, the Citizen Card (CC), with strong authentication and digital signing capabilities, represents a new and very viable economic opportunity for securing a HIS and at the same time foster the creation of a much more secure national health information infrastructure. The CC is a versatile and secure card, with the latest in encryption and tamper resistance technologies, with standard support for a Public Key Infrastructure (PKI). The CC holds identification data in three different ways: printed, digital and machine readable. It substitutes five national cards, including the national health system ID card. The CC has separate authentication and digital signature keys, both issued and managed by a government certificate authority (CA).The main issues and problems with HIS security are presented, followed by brief explorations of themes related to the CC and HIS security. The relevant card characteristics are presented and discussed, with a special emphasis on the security aspects of the card when applied into the healthcare context. Smart cards are being deployed in healthcare everywhere around the world with highly encouraging results. Major programs have already been deployed with great success, although there are a few well identified issues that need to be addressed. The CC card has the advantage of having a PKI already in place at the national level, so the initial costs of integration testing, deployment and card management have already been taken care of by the national government. HIS advantage on this new opportunity is discussed from a technical and human perspective, and some of the major deployment problems that are likely to be encountered are presented, as well as HIS areas where the smart card crypto functionalities can be deployed with great advantage.There are advantages, as well as some problems in using a smart card in a HIS. The CC possible contributions in this field are as an easy, inexpensive, widely deployed way of using current technology to protect HIS security, and, ultimately, patient information, while at the same time fostering the expansion and deployment of interoperable HIS. Problems identified include possible reluctance in broad utilization of the CC in a professional setting, as well as the need to change currently adopted (although insecure) workflows.

Challenges of introducing a professional eID card within health care

“…Our results corroborate and add to the findings in the literature review carried out by Santos et al (2008). As noted in Section 2, Santos et al (2008) found that health-care professionals' use of eID cards raises such challenges as usability, resistance to use, inefficiency and the risk of leaving the card at home. As illustrated in this paper, we found the very same issues in our empirical material.…”

“…As noted in Section 2, Santos et al (2009) found that health care professionals' use of eID cards raises such challenges as usability, resistance to use, inefficiency, and the risk of leaving the card at home. As illustrated in this paper, we found the very same issues in our empirical material.…”

“…For instance, Campos et al (2011) argued that issues concerning identity management within health care tend to centre on interoperability, where it is important to consider a "functional understanding of the activity of eHealth", and its responsibilities and roles. Previous research has argued that there are special concerns when national eID cards are used within health care as part of a health information system (HIS) (Santos et al, 2009). Based on a literature review, it can be seen that concerns related to health care professionals' use of eID cards include issues such as usability, resistance to use, inefficiency, and the risk of leaving the card at home.…”

The Performance of National Identification and Registration Authority in Uganda: 2016-2017

“…Majority of countries were on a cross roads either to accept fear of terrorism or privacy (Matar, 2003), in Portugal the government linked access to health services with national ID (Santos, Correia, & Antunes, 2008), globally the national ID was meant for security reasons (Bennett & Lyon, 2013), in Asia especially Malaysia the citizens were querying the security issues on the national ID (Kee, Nee, Beng, & Fun, 2012) Shukri questioned the privacy and security of the national IDs (Kuada, Wiafe, Addo, & Djaba, 2017;Shukri & Hafiz, 2015), they system doesn't allow negotiations with another person in terms of cross checking identity and were irregularities are found its invalid national ID (Haala, 2005(Haala, , 2008, the National ID projects around the world are demeaning identity (Sobel, 2001), the national ID system has been reduced to who belongs to United States (Redman, 2008) and in Canada the national ID was resisted with reasons (Marleau, 2003). From the above analysis its clear that countries faced a lot of resistance to introduce the national IDs.…”