Using PAPAYA for eHealth - Use Case Analysis and Requirements

Abstract

This paper presents an eHealth use case based on a privacy-preserving machine learning platform to detect arrhythmia developed by the PAPAYA project that can run in an untrusted domain. It discusses legal privacy and user requirements that we elicited for this use case from the GDPR and via stakeholder interviews. These include requirements for secure pseudonymisation schemes, for allowing also pseudonymous users to exercise their data subjects rights, for not making diagnostic decisions fully automatically and for assurance guarantees, conformance with specified standards and informing clinicians and patients about the privacy protection. The requirements are not only relevant for our use case but also for other use cases utilising privacy-preserving data analytics to classify medical data.

Machine Learning–Based Analysis of Encrypted Medical Data in the Cloud: Qualitative Study of Expert Stakeholders’ Perspectives

“…Based on our interviews, the following key requirements were elicited relating to perceived tradeoffs and perceptions on informing eHealth stakeholders and patients about the proposed PET (as developed by the PAPAYA project), and its security and privacy protection features for enhancing transparency and promoting trust. Further details on user requirements and legal requirements elicited can be found in our prior work [ 38 ]. Notably, the following requirements are not specific to PAPAYA, but are in fact generalizable to similar PETs for automated data analysis of medical data on a cloud server.…”

“…We previously reported the PAPAYA arrhythmia detection use case, and legal and user requirements [ 38 ]; however, we did not elaborate on the analysis of the eHealth stakeholders’ perspectives and the perceived tradeoffs based on the conducted interviews.…”

Machine Learning–Based Analysis of Encrypted Medical Data in the Cloud: Qualitative Study of Expert Stakeholders’ Perspectives (Preprint)

“…Based on our interviews, the following key requirements were elicited relating to perceived tradeoffs and perceptions on informing eHealth stakeholders and patients about the proposed PET (as developed by the PAPAYA project), and its security and privacy protection features for enhancing transparency and promoting trust. Further details on user requirements and legal requirements elicited can be found in our prior work [38]. Notably, the following requirements are not specific to First, eHealth stakeholders will be reluctant to avail of the analytical services in the cloud if they have no confidence that the PET can deliver secure service without loss of quality or data.…”