Risk Analysis Based Security Compliance Assessment and Management for Sensitive Health Data Environment

The digitisation of personal health information (PHI) through electronic health record (EHR) has become widespread due to their efficiency in terms of cost, storage, processing, and the subsequent quality of delivering patient care. However, security concerns remain one of its major setback. In order to handle EHR, institutions need to comply with their local government security regulations. These regulations control to which extent health data can be processed, transmitted, and stored as well as define how misuses are addressed. This paper proposes φcomp, a solution for monitoring, assessing, and evaluating the compliance of health applications with respect to defined security regulations. φcomp is able to assess the level of security risk of an application at runtime and automatically perform the required mitigation actions to recover a compliant environment. φcomp was implemented in an industrial context and evaluated on a medical appointment application. The results of the experiments showed that it manages the security compliance of third party applications with low performance overhead and attenuate unacceptable levels of risk to restore compliance.