Efficient key management for preserving HIPAA regulations

Authors:
Hui-Feng Huang;Kuo-Ching Liu
Affiliations:
Department of Computer Science and Information Engineering, National Taichung Institute of Technology, Taichung 404, Taiwan, ROC;Department of Medical Laboratory Science and Biotechnology, China Medical University, Taichung 404, Taiwan, ROC
Venue:
Journal of Systems and Software
Year:
2011

Citing 7
Cited 1

Use of elliptic curves in cryptography

Lecture notes in computer sciences; 218 on Advances in cryptology---CRYPTO 85
Responses to NIST's proposal

Communications of the ACM
Managing Medical and Insurance Information Through a Smart-Card-Based Information System

Journal of Medical Systems
A method for obtaining digital signatures and public-key cryptosystems

Communications of the ACM
A hybrid public key infrastructure solution (HPKI) for HIPAA privacy/security regulations

Computer Standards & Interfaces
A Cryptographic Key Management Solution for HIPAA Privacy/Security Regulations

IEEE Transactions on Information Technology in Biomedicine
New directions in cryptography

IEEE Transactions on Information Theory

A HIPAA-compliant key management scheme with revocation of authorization

Computer Methods and Programs in Biomedicine

Quantified Score

Hi-index	0.00

Visualization

Abstract

The protection of patients' health information is a very important issue in the information age. Health Insurance Portability and Accountability Act (HIPAA) of privacy and security regulations are two crucial provisions in the protection of healthcare privacy, especially electronic medical information. For the quality and efficiency of the electronic services, it is necessary to construct better performance for the user and the trusted party. Based on elliptic curve cryptography (ECC) and complying with HIPAA regulations, this article presents an efficient key management scheme to facilitate inter-operations among the applied cryptographic mechanisms. In addition, the proposed scheme can achieve the complete functionality which includes: (1) a dictionary of key tables is not required for users and other units; (2) users can freely choose their own passwords; (3) users can freely update their passwords after the registration phase; (4) the computational cost is very low for users and the trusted center or server; (5) users are able to access their individual medical information through the authorization process; (6) case of consent exceptions intended to facilitate emergency applications or other possible exceptions can also be dealt with easier.