Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2014

Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records

Ying He
  • Fonction : Auteur
  • PersonId : 990566
Chris Johnson
  • Fonction : Auteur
  • PersonId : 990567
Yu Lyu
  • Fonction : Auteur
  • PersonId : 990568
Arniyati Ahmad
  • Fonction : Auteur
  • PersonId : 990569

Résumé

The increasing use of Electronic Health Records has been mirrored by a similar rise in the number of security incidents where confidential information has inadvertently been disclosed to third parties. These problems have been compounded by an apparent inability to learn from previous violations; similar security incidents have been observed across Europe, North America and Asia. This paper presents the results of an empirical study that evaluates the utility and usability of conventional text-based security incident reports with a graphical formalism based on the Goal Structuring Notation. The two methods were compared in term of the users’ ability to identify a number of lessons learned from investigations into previous incidents involving the disclosure of healthcare records. These lessons included both the causes of the incident but also the participants’ ability to understand the reasons why particular recommendations were proposed as ways of avoiding future violations. Even using a relatively small sample, we were able to obtain statistically significant differences between the two approaches. The study showed that the graphical approach resulted in higher accuracy in terms of number of correct answers generated by participants. However, subjective feedback raised further questions about the usability of both approaches as the readers of security incident reports try to interpret the lessons that can increase the security of patient data.
Fichier principal
Vignette du fichier
978-3-662-43813-8_8_Chapter.pdf (589.7 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01381682 , version 1 (14-10-2016)

Licence

Paternité

Identifiants

Citer

Ying He, Chris Johnson, Yu Lyu, Arniyati Ahmad. Improving the Exchange of Lessons Learned in Security Incident Reports: Case Studies in the Privacy of Electronic Patient Records. 8th IFIP International Conference on Trust Management (IFIPTM), Jul 2014, Singapore, Singapore. pp.109-124, ⟨10.1007/978-3-662-43813-8_8⟩. ⟨hal-01381682⟩
28 Consultations
77 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More