Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records - Trust Management VIII (IFIPTM 2014) Access content directly
Conference Papers Year : 2014

Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records

Ying He
  • Function : Author
  • PersonId : 990566
Chris Johnson
  • Function : Author
  • PersonId : 990567
Yu Lyu
  • Function : Author
  • PersonId : 990568
Arniyati Ahmad
  • Function : Author
  • PersonId : 990569

Abstract

The increasing use of Electronic Health Records has been mirrored by a similar rise in the number of security incidents where confidential information has inadvertently been disclosed to third parties. These problems have been compounded by an apparent inability to learn from previous violations; similar security incidents have been observed across Europe, North America and Asia. This paper presents the results of an empirical study that evaluates the utility and usability of conventional text-based security incident reports with a graphical formalism based on the Goal Structuring Notation. The two methods were compared in term of the users’ ability to identify a number of lessons learned from investigations into previous incidents involving the disclosure of healthcare records. These lessons included both the causes of the incident but also the participants’ ability to understand the reasons why particular recommendations were proposed as ways of avoiding future violations. Even using a relatively small sample, we were able to obtain statistically significant differences between the two approaches. The study showed that the graphical approach resulted in higher accuracy in terms of number of correct answers generated by participants. However, subjective feedback raised further questions about the usability of both approaches as the readers of security incident reports try to interpret the lessons that can increase the security of patient data.
Fichier principal
Vignette du fichier
978-3-662-43813-8_8_Chapter.pdf (589.7 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01381682 , version 1 (14-10-2016)

Licence

Attribution

Identifiers

Cite

Ying He, Chris Johnson, Yu Lyu, Arniyati Ahmad. Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records. 8th IFIP International Conference on Trust Management (IFIPTM), Jul 2014, Singapore, Singapore. pp.109-124, ⟨10.1007/978-3-662-43813-8_8⟩. ⟨hal-01381682⟩
28 View
77 Download

Altmetric

Share

Gmail Facebook X LinkedIn More