John Mitchell : 2009 Security Meeting

Hospitals, clinics, and other organizations maintain and share confidential patient information that must be protected to preserve patient privacy and comply with applicable laws. In modern patient portals, for example, a patient may access his or her medical information, make appointments, view test results, renew prescriptions, or give family members or trusted friends partial access to medical records. We have formalized the US HIPAA law governing transfer of medical information in an executable form, so that such systems may automatically determine which actions are allowed. This formalization of the law is used in a proof-of-concept patient portal system that may be demonstrated on the web.