An Activity Theory Approach to Leak Detection and Mitigation in Patient Health Information (PHI)

2021 | Journal of the Association for Information Systems | Citations: 2

Authors: Valecha, Rohit; Upadhyaya, Shambhu; Rao, H. Raghav

Abstract: The migration to electronic health records (EHR) in the healthcare industry has ... Expand

Abstract: The migration to electronic health records (EHR) in the healthcare industry has raised issues with respect to security and privacy. One issue that has become a concern for healthcare providers, insurance companies, and pharmacies is patient health information (PHI) leaks because PHI leaks can lead to violation of privacy laws, which protect the privacy of individuals' identifiable health information, potentially resulting in a healthcare crisis. This study explores the issue of PHI leaks from an access control viewpoint. We utilize access control policies and PHI leak scenarios derived from semi structured interviews with four healthcare practitioners and use the lens of activity theory to articulate the design of an access control model for detecting and mitigating PHI leaks. Subsequently, we follow up with a prototype as a proof of concept.Rohit Valecha is an assistant professor of information systems and cyber security at the University of Texas at San Antonio. He has research interests in the use of social media for crisis response. His research on detection, mitigation, and prevention of misinformation has been funded by NSF. His research has been published in Management Collapse

Topics: access control healthcare data data breach anonymity identity theft

Methods: qualitative interview design artifact design science personal interview case study

Theories: activity theory

Which factors affect the scientific impact of review papers in IS research? A scientometric study

2021 | Information & Management | Citations: 0

Authors: Wagner, Gerit; Prester, Julian; Roche, Maria P.; Schryen, Guido; Benlian, Alexander; Paré, Guy; Templier, Mathieu

Abstract: Review papers are essential for knowledge development in Information Systems. Wh ... Expand

Abstract: Review papers are essential for knowledge development in Information Systems. While some are cited twice a day, others accumulate single digit citations over a decade. The magnitude of these differences prompts us to analyze what distinguishes those reviews that have proven to be integral to scientific progress from those that might be considered less impactful. Our results highlight differences between reviews aimed at describing, un­ derstanding, explaining, and theory testing. Beyond the control variables, they demonstrate the importance of methodological transparency and the development of research agendas. These insights inform all stakeholders involved in the development and publication of review papers. Collapse

Topics: productivity IS discipline systems analysis electronic market digital ecosystem

Methods: literature study bibliometric analysis robustness check meta analysis descriptive statistic

Maintenance of Enterprise Architecture Models

2021 | Business & Information Systems Engineering | Citations: 1

Authors: Silva, Nuno; Sousa, Pedro; Mira da Silva, Miguel

Abstract: Enterprise architecture (EA) models are tools of analysis, communication, and su ... Expand

Abstract: Enterprise architecture (EA) models are tools of analysis, communication, and support towards enterprise transformation. These models need a suitable maintenance process to support comprehensive knowledge of the enterprise’s structure and dynamics. This study aims to identify and discuss the existing approaches to EA model maintenance published in the scientific literature. A systematic literature review was employed as the research method. A keyword-based search in six databases identified a total of 4495 papers in which 31 primary studies were included. A total of nine categories of EA model maintenance approaches were identified from both information systems and enterprise engineering fields of research. The increasing amount of research in EA model maintenance suggests that the topic still presents opportunities for research contributions. This study also proposes future lines of research according to the results identified in the theoretical corpus. Collapse

Topics: access control enterprise architecture database system data management system support

Methods: case study computational algorithm literature sample survey literature study

An Accurate and Scalable Role Mining Algorithm based on Graph Embedding and Unsupervised Feature Learning

2020 | HICSS | Citations: 0

Authors: Abolfathi, Masoumeh; Raghebi, Zohreh; Jafarian, Jafar Haadi; Banaei-Kashani, Farnoush

Abstract: Role-based access control (RBAC) is one of the most widely authorization models ... Expand

Abstract: Role-based access control (RBAC) is one of the most widely authorization models used by organizations. In RBAC, accesses are controlled based on the roles of users within the organization. The flexibility and usability of RBAC have encouraged organizations to migrate from traditional discretionary access control (DAC) models to RBAC. The most challenging step in this migration is role mining, which is the process of extracting meaningful roles from existing access control lists. Although various approaches have been proposed to address this NP-complete role mining problem in the literature, they either suffer from low scalability, or present heuristics that suffer from low accuracy. In this paper, we propose an accurate and scalable approach to the role mining problem. To this aim, we represent user-permission assignments as a bipartite graph where nodes are users and permissions, and edges are user-permission assignments. Next, we introduce an efficient deep learning algorithm based on random walk sampling to learn low-dimensional representations of the graph, such that permissions that are assigned to similar users are closer in this new space. Then, we use k-means and GMM clustering techniques to cluster permission nodes into roles. We show the effectiveness of our proposed approach by testing it on different datasets. Experimental results show that our approach performs accurate role mining, even for large datasets. Collapse

Topics: access control role-based access control

Methods: computational algorithm cluster analysis experiment fuzzy clustering optimization model

Towards Secure, Decentralized, and Automatic Audits With Blockchain

2020 | European Conference On Information Systems | Citations: 0

Authors: Belchior, Rafael; Correia, Miguel; Vasconcelos, André

Abstract: Organizations are testing the potential of blockchain technology in different a ... Expand

Abstract: Organizations are testing the potential of blockchain technology in different areas, bringing implications to record-keeping and the associated business processes, namely audits. Permissioned, private blockchain frameworks can contribute to the processes behind audits by (i) alleviating auditor's work, (ii) hindering fraud and collusion between organizations and auditors, (iii) promote synergies between organizations and their stakeholders, and (iv) protecting access to sensitive information. This paper studies the use of blockchain technology as an enhancer of secure, distributed, and more automatized audits. The proposed solution uses a permissioned, consortium, blockchain to store audit logs. The blockchain is then leveraged to perform distributed and automatic audits over the recorded logs, aiming to reduce costs associated with audits. In particular, the solution is based on a 4-layer architecture: data acquisition, data transfer, data audit, and data analysis & storage layers. The evaluation shows that the proposed solution is secure and can save and analyse up to around 30 audit log entries per second. Collapse

Topics: blockchain Hyperledger data integrity privacy database system

Methods: design principle data modeling

A permissioned blockchain-based implementation of LMSR prediction markets

2020 | Decision Support Systems | Citations: 0

Authors: Carvalho, Arthur

Abstract: Since the seminal work by Hanson (2003), the Logarithmic Market Scoring Rule (LM ... Expand

Abstract: Since the seminal work by Hanson (2003), the Logarithmic Market Scoring Rule (LMSR) has become the de facto market-maker mechanism for prediction markets. We suggest in this paper three potential issues with centralized implementations of LMSR, which we refer to as the availability, security, and privacy problems. We also explain how a permissioned blockchain-based implementation of LMSR effectively solves all the above problems. Following the design science research framework (Peffers et al., 2007), our main contribution is a fully functional permissioned blockchain-based implementation of LMSR that is ready to be deployed. We believe our results are of great value not only to prediction market researchers and practitioners looking for LMSR implementations, but also to blockchain professionals looking for fully developed solutions as well as applications of suitable research frameworks to guide blockchain research and development. Collapse

Topics: blockchain privacy Hyperledger Ethereum research and development

Methods: design science simulation design artifact modeling language

Concerns and Trade-offs in Information Technology Acceptance: The Balance between the Requirement for Privacy and the Desire for Safety

2020 | Communications of the Association for Information Systems | Citations: 0

Authors: Ehrari, Humira; Ulrich, Frank; Andersen, Henning Boje

Abstract: In this paper, we construct a new motivation model by bridging self-determinatio ... Expand

Abstract: In this paper, we construct a new motivation model by bridging self-determination theory (SDT) with the unified theory of acceptance and use of technology (UTAUT). Using an explorative approach, we study how human motivational determinants influence the trade-off between safety and privacy in technology acceptance. We take the Scandinavian healthcare context as our empirical outset and explore how older Danish adults perceive sensor-based e-health monitor technology that monitors their health status. Danish municipalities have begun to use these technologies to identify early warning signs and, thereby, improve the quality of care and life by making people more self-reliant and reducing unnecessary hospitalization. However, one needs to consider ethical issues concerning privacy versus safety when implementing these technologies. After monitoring 21 respondents (mean age: 85) living independently at home over nine weeks, we interviewed them about their concerns regarding privacy and safety. We found that the respondents were willing to compromise their privacy if their autonomy and personal integrity were respected and if the benefits of sensor-based monitoring outweighed health-related threats. We used these findings and the theoretical outset to create a novel model that takes human motivation into account when using UTAUT. Collapse

Topics: privacy technology adoption electronic health intrinsic motivation information system use

Methods: qualitative interview experiment case study personal interview theory development

Theories: unified theory of acceptance and use of technology self determination theory motivation theory

Security and Privacy Requirements for Cloud Computing in Healthcare: Elicitation and Prioritization from a Patient Perspective

2020 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Ermakova, Tatiana; Fabian, Benjamin; Kornacka, Marta; Thiebes, Scott; Sunyaev, Ali

Abstract: Cloud computing promises essential improvements in healthcare delivery performan ... Expand

Abstract: Cloud computing promises essential improvements in healthcare delivery performance. However, its wide adoption in healthcare is yet to be seen, one main reason being patients’ concerns for security and privacy of their sensitive medical records. These concerns can be addressed through corresponding security and privacy requirements within the system engineering process. Despite a plethora of related research, security and privacy requirements for cloud systems and services have seldomly been investigated methodically so far, whereas their individual priorities to increase the system success probability have been neglected. Against this background, this study applies a systematic requirements engineering process: First, based on a systematic literature review, an extensive initial set of security and privacy requirements is elicited. Second, an online survey based on the best-worst scaling method is designed, conducted, and evaluated to determine priorities of security and privacy requirements. Our results show that confidentiality and integrity of medical data are ranked at the top of the hierarchy of prioritized requirements, followed by control of data use and modification, patients’ anonymity, and patients’ control of access rights. Availability, fine-grained access control, revocation of access rights, flexible access, clinicians’ anonymity, as well as usability, scalability, and efficiency of the system complete the ranking. The level of agreement among patients is rather small, but statistically significant at the 0.01 level. The main contribution of the present research comprises the study method and results highlighting the role of strong security and privacy and excluding any trade-offs with system usability. Enabling a richer understanding of patients’ security and privacy requirements for adopting cloud computing in healthcare, these are of particular importance to researchers and practitioners interested in supporting the process of security and privacy engineering for health-cloud solutions. It further represents a supplement that can support time-intensive negotiation meetings between the requirements engineers and patients. Collapse

Topics: privacy healthcare data cloud computing data security anonymity

Methods: survey literature study experiment structured literature research journal ranking

Theories: construal level theory

Cloud Surfing: A General Comparison of Cloud Identity Guidelines

2020 | Americas Conference on Information Systems | Citations: 0

Authors: Ghazizadeh, Eghbal; Deylami, Hanif; Shahzad, Abid; Cusack, Brian

Abstract: Identity and access management is an essential component to addressing security ... Expand

Abstract: Identity and access management is an essential component to addressing security issues in cloud. Nowadays, private organizations and government agencies at any level spend billions of dollars in an effort to protect user' identity and digital access while complying with legislation that mandates the implementation of security measures. This paper intends to illuminate and discusses in more detail three legislative acts: ENISA, CSA and NIST. These guidelines address the significant business and technical decisions that need to be considered by an organization seeking to implement Security as a Service, or an organization that is looking for guidance on how to assess an IAM offering. The current paper provides a brief description of all three legislative acts, a high-level comparison of suggested and/or mandated guidelines (highlighting gaps and overlaps) and suggests a possible threshold model that may incorporate security settings that satisfy requirements of all three legislative acts. Collapse

Topics: cloud computing legal context privacy identity management social media

Methods: literature study qualitative content analysis survey qualitative interview structured literature research

Algorithms and Applications to Weighted Rank-one Binary Matrix Factorization

2020 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Lu, Haibing; Chen, Xi; Shi, Junmin; Vaidya, Jaideep; Atluri, Vijayalakshmi; Hong, Yuan; Huang, Wei

Abstract: Many applications use data that are better represented in the binary matrix form ... Expand

Abstract: Many applications use data that are better represented in the binary matrix form, such as click-stream data, market basket data, document-term data, user-permission data in access control, and others. Matrix factorization methods have been widely used tools for the analysis of high-dimensional data, as they automatically extract sparse and meaningful features from data vectors. However, existing matrix factorization methods do not work well for the binary data. One crucial limitation is interpretability, as many matrix factorization methods decompose an input matrix into matrices with fractional or even negative components, which are hard to interpret in many real settings. Some matrix factorization methods, like binary matrix factorization, do limit decomposed matrices to binary values. However, these models are not flexible to accommodate some data analysis tasks, like trading off summary size with quality and discriminating different types of approximation errors. To address those issues, this article presents weighted rank-one binary matrix factorization, which is to approximate a binary matrix by the product of two binary vectors, with parameters controlling different types of approximation errors. By systematically running weighted rank-one binary matrix factorization, one can effectively perform various binary data analysis tasks, like compression, clustering, and pattern discovery. Theoretical properties on weighted rank-one binary matrix factorization are investigated and its connection to problems in other research domains are examined. As weighted rank-one binary matrix factorization in general is NP-hard, efficient and effective algorithms are presented. Extensive studies on applications of weighted rank-one binary matrix factorization are also conducted. Collapse

Topics: database system role-based access control access control information retrieval

Methods: computational algorithm experiment cluster analysis machine learning k-means clustering