Pekka Ruotsalainen

Health is wide concept covering a person's physical, mental and social well-being. Traditionally, regulated healthcare has been the main source for curative and preventive service offered to patients. Healthcare is in transition, however. Paradigms such as patient empowerment and patient in the centre as well as in-home care service are changing processes and locations healthcare services are offered. Parallel to healthcare, new service models such as pHealth, ubiquitous healthcare, and digital medicine are developing. In the near future, technology enables the creation of a personal digital health dossier (e.g. digital patient and virtual patient model) for any individual. This dossier is stored and used in the unsecure information space. This all means that the traditional paternalistic patient model where patient is a passive object for regulated healthcare services will not work in future pHealth and digital health anymore. Instead, the new patient role (e.g. pHealth user or health consumer role) is dynamic, context-aware and participatory. The pHealth user can also have many roles at the same time, such as the role of informed chooser, decision maker, and personal health coordinator. This requires that the pHealth user can make information-based meaningful decisions before starting to use health services, and that he or she can trust on service providers by having evidence-based and reliable information about the quality and health impact of the services offered. A big challenge is that pHealth and digital health take place in unsecure information space where current healthcare specific laws, regulations, and medical ethics are insufficient to guarantee users' autonomy and privacy as well as the application of fair information and ethical principles when processing personal health information. A new ethical, legal and technical framework is needed. One of the prerequisites successful pHealth and digital health has to meet is the possibility to create information based on trustworthy relationship between service user and service providers. Furthermore, a trusted information platform is inevitable.

Current paradigm changes for improving safety, quality and efficiency of care processes under massive deployment of information and communication technologies (ICT) place high requirements on privacy and security. These mainly focus on privilege management and access control harmonized in international standards and their further evolution. NIST and ISO, but especially HL7 play a prominent role in this context. Starting with classic role-based access control (RBAC) foundations to new specifications for security and privacy labeling of segmented health information, HL7 security is presented as a scalable intermediate solution on the way to comprehensive privilege management and access control by explicit, ontology-based, formal and therefore machine-processable policies. The successfully balloted HL7 labeling specification supports context-sensitive communication and cooperation between different stakeholders and processes with different purposes of use, based on meta-data of information, actors and processes involved. Basics of policy management and practical solutions are discussed.

PHealth occurs in uncontrolled and unsecure environment where predefined organizational trust does not exist. To be accepted by users, pHealth requires a privacy model where privacy is a personal property, i.e., a person can perform own will and define policies which regulate how personal health information (PHI) is used. Privacy and trust are interconnected concepts. Therefore, before beginning to use pHealth services, the person needs practical and reliable information that enables her or him to determine the trustworthiness level of services. To avoid the use of blind trust, organizations, researchers, policymakers, and standardization organizations have proposed the use of dynamic context-aware policies for privacy management in pHealth. To make meaningful privacy decision, a person should understand the impact of selected policy rules on the processing of PHI in different situations. In this paper, the use of computational trust information for defining privacy polies and reducing their number is proposed. A trust value and understandable trust attributes enable a person to tailor privacy policies requested for trustworthy use of pHealth services. Trust attributes proposed are derived from privacy concerns existing in open ubiquitous environment. These attributes also force pHealth services providers to publish information needed for trust calculation and in this way to support openness and transparency.

Modern eHealth, ubiquitous health and personal wellness systems take place in an unsecure and ubiquitous information space where no predefined trust occurs. This paper presents novel information model and an architecture for trust based privacy management of personal health and wellness information in ubiquitous environment. The architecture enables a person to calculate a dynamic and context-aware trust value for each service provider, and using it to design personal privacy policies for trustworthy use of health and wellness services. For trust calculation a novel set of measurable context-aware and health information-sensitive attributes is developed. The architecture enables a person to manage his or her privacy in ubiquitous environment by formulating context-aware and service provider specific policies. Focus groups and information modelling was used for developing a wellness information model. System analysis method based on sequential steps that enable to combine results of analysis of privacy and trust concerns and the selection of trust and privacy services was used for development of the information system architecture. Its services (e.g. trust calculation, decision support, policy management and policy binding services) and developed attributes enable a person to define situation-aware policies that regulate the way his or her wellness and health information is processed.

Based on a system-theoretical approach, aspects of real world systems have been introduced. In this context, the relations between a system's architecture, i.e. its components, their functions and relations, formally represented by domain-specific ontologies considering all domains relevant in the system's use case on the one hand and the system's behaviour ruled by the applied policies on the other hand have been described. A refinement of policies ruling a clinical setting has been exemplified. It could be shown that ubiquitous health systems must be designed and managed following a thoroughly systems-oriented, architecture-centric, ontology-based and policy-driven approach. The feasibility of the approach has been practically demonstrated.

A feasibility analysis has been performed to study the applicability of privacy attributes with a developed wellness information model. Information privacy concerns specifically access to individually identifiable personal information and one's ability to control information about oneself. We carried out a user scenario walk-through of the privacy attributes related to the wellness components. The walk-through showed a need to relate self-regulating privacy policies to the pervasive context so that during various trust-building processes, a person is aware and can control the use, disclosure and even secondary use of his personal, private wellness information.

A Conceptual Framework and Principles for Trusted Pervasive Health

Trustfulness (i.e. health and wellness information is processed ethically, and privacy is guaranteed) is one of the cornerstones for future Personal Health Systems, ubiquitous healthcare and pervasive health. Trust in today's healthcare is organizational, static and predefined. Pervasive health takes place in an open and untrusted information space where person's lifelong health and wellness information together with contextual data are dynamically collected and used by many stakeholders. This generates new threats that do not exist in today's eHealth systems. Our analysis shows that the way security and trust are implemented in today's healthcare cannot guarantee information autonomy and trustfulness in pervasive health. Based on a framework model of pervasive health and risks analysis of ubiquitous information space, we have formulated principles which enable trusted information sharing in pervasive health. Principles imply that the data subject should have the right to dynamically verify trust and to control the use of her health information, as well as the right to set situation based context-aware personal policies. Data collectors and processors have responsibilities including transparency of information processing, and openness of interests, policies and environmental features. Our principles create a base for successful management of privacy and information autonomy in pervasive health. They also imply that it is necessary to create new data models for personal health information and new architectures which support situation depending trust and privacy management.

Trustfulness (i.e. health and wellness information is processed ethically, and privacy is guaranteed) is one of the cornerstones for future Personal Health Systems, ubiquitous healthcare and pervasive health. Trust in today's healthcare is organizational, static and predefined. Pervasive health takes place in an open and untrusted information space where person's lifelong health and wellness information together with contextual data are dynamically collected and used by many stakeholders. This generates new threats that do not exist in today's eHealth systems. Our analysis shows that the way security and trust are implemented in today's healthcare cannot guarantee information autonomy and trustfulness in pervasive health. Based on a framework model of pervasive health and risks analysis of ubiquitous information space, we have formulated principles which enable trusted information sharing in pervasive health. Principles imply that the data subject should have the right to dynamically verify trust and to control the use of her health information, as well as the right to set situation based context-aware personal policies. Data collectors and processors have responsibilities including transparency of information processing, and openness of interests, policies and environmental features. Our principles create a base for successful management of privacy and information autonomy in pervasive health. They also imply that it is necessary to create new data models for personal health information and new architectures which support situation depending trust and privacy management.

Turning from organization-centric to process-controlled or even to personalized approaches, advanced healthcare settings have to meet special interoperability challenges. eHealth and pHealth solutions must assure interoperability between actors cooperating to achieve common business objectives. Hereby, the interoperability chain also includes individually tailored technical systems, but also sensors and actuators. For enabling corresponding pervasive computing and even autonomic computing, individualized systems have to be based on an architecture framework covering many domains, scientifically managed by specialized disciplines using their specific ontologies in a formalized way. Therefore, interoperability has to advance from a communication protocol to an architecture-centric approach mastering ontology coordination challenges.