φ comp: An Architecture for Monitoring and Enforcing Security Compliance in Sensitive Health Data Environment

Even if electronic health records have revolutionise the efficiency and quality of delivering healthcare, security concerns remain one of its major setback. For this reason, compliance to security regulations when processing, storing, and transmitting health data is mandatory in many countries. This paper reports the design and implementation of $\varphi$ comp, an approach that automates the monitoring and enforcing of security compliance at runtime in sensitive health environment. It is composed of a distributed architecture which analyses the behaviour of e-health environments and subsequently enforces security rules to ensure compliance with respect to health security regulations such as HDS and HIPAA. The results of our experiments in a production environment showed that it is highly customisable with respect to different use case application, can easily and rapidly be deployed, and induces very low overhead on the third party infrastructure for compliance management.