More Like this

1. CareNet: Building Regulation-Compliant Home-Based Healthcare Services with Software-Defined Infrastructure

   https://doi.org/10.1109/CHASE.2017.121  

   Li, Peilong; Xu, Chen; Luo, Yan; Cao, Yu; Mathew, Jomol; Ma, Yunsheng (July 2017, IEEE 2nd International Conference on Connected Health: Applications, Systems and Engineering Technologies (IEEE CHASE 2017))

   Healthcare network and computing infrastructure is rapidly changing from closed environments to open environments that incorporate new devices and new application scenarios. Home-based healthcare is such an example of leveraging pervasive sensors and analyzing sensor data (often in real-time) to guide therapy or intervene. In this paper, we address the challenges in regulatory compliance when designing and deploying healthcare applications on a heterogeneous cloud environment. We propose the CareNet framework, consisting of a set of APIs and secure data transmission mechanisms, to facilitate the specification of home-based healthcare services running on the software-defined infrastructure (SDI). This work is a collaboration among computer scientists, medical researchers, healthcare IT and healthcare providers, and its goal is to reduce the gap between the availability of SDI and meeting regulatory compliance in healthcare applications. Our prototype demonstrates the feasibility of the framework and serves as testbed for novel experimental studies of emerging healthcare applications. 

   more » « less
2. Perspectives on Regulatory Compliance in Software Engineering

   https://doi.org/10.1109/RE51729.2021.00012  

   Kempe, Evelyn; Massey, Aaron (September 2021, 2021 IEEE 29th International Requirements Engineering Conference (RE))

   Compliance reviews within a software organization are internal attempts to verify regulatory and security requirements during product development before its release. However, these reviews are not enough to adequately assess and address regulatory and security requirements throughout a software’s development lifecycle. We believe requirements engineers can benefit from an improved understanding of how software practitioners treat and perceive compliance requirements. This paper describes an interview study seeking to understand how regulatory and security standard requirements are addressed, how burdensome they may be for businesses, and how our participants perceived them in the software development lifecycle. We interviewed 15 software practitioners from 13 organizations with different roles in the software development process and working in various industry domains, including big tech, healthcare, data analysis, finance, and small businesses. Our findings suggest that, for our participants, the software release process is the ultimate focus for regulatory and security compliance reviews. Also, most participants suggested that having a defined process for addressing compliance requirements was freeing rather than burdensome. Finally, participants generally saw compliance requirements as an investment for both employees and customers. These findings may be unintuitive, and we discuss seven lessons this work may hold for requirements engineering. 

   more » « less
3. Community cloud architecture to improve use accessibility with security compliance in health big data applications

   https://doi.org/10.1145/3288599.3295594  

   Valluripally, Samaikya; Raju, Murugesan; Calyam, Prasad; Chisholm, Matthew; Sivarathri, Sai Swathi; Mosa, Abu; Joshi, Trupti (January 2019, Community cloud architecture to improve use accessibility with security compliance in health big data applications)

   The adoption of big data analytics in healthcare applications is overwhelming not only because of the huge volume of data being analyzed, but also because of the heterogeneity and sensitivity of the data. Effective and efficient analysis and visualization of secure patient health records are needed to e.g., find new trends in disease management, determining risk factors for diseases, and personalized medicine. In this paper, we propose a novel community cloud architecture to help clinicians and researchers to have easy/increased accessibility to data sets from multiple sources, while also ensuring security compliance of data providers is not compromised. Our cloud-based system design configuration with cloudlet principles ensures application performance has high-speed processing, and data analytics is sufficiently scalable while adhering to security standards (e.g., HIPAA, NIST). Through a case study, we show how our community cloud architecture can be implemented along with best practices in an ophthalmology case study which includes health big data (i.e., Health Facts database, I2B2, Millennium) hosted in a campus cloud infrastructure featuring virtual desktop thin-clients and relevant Data Classification Levels in storage. 

   more » « less
4. Synthetic threads through the web of life

   https://doi.org/10.1073/pnas.2004833118  

   Power, Mary E. (April 2021, Proceedings of the National Academy of Sciences)

   CRISPR-Cas gene editing tools have brought us to an era of synthetic biology that will change the world. Excitement over the breakthroughs these tools have enabled in biology and medicine is balanced, justifiably, by concern over how their applications might go wrong in open environments. We do not know how genomic processes (including regulatory and epigenetic processes), evolutionary change, ecosystem interactions, and other higher order processes will affect traits, fitness, and impacts of edited organisms in nature. However, anticipating the spread, change, and impacts of edited traits or organisms in heterogeneous, changing environments is particularly important with “gene drives on the horizon.” To anticipate how “synthetic threads” will affect the web of life on Earth, scientists must confront complex system interactions across many levels of biological organization. Currently, we lack plans, infrastructure, and funding for field science and scientists to track new synthetic organisms, with or without gene drives, as they move through open environments. 

   more » « less
5. "Harmonizing regulatory spheres to overcome challenges for governance of Patient-Generated Health Data in the age of Artificial Intelligence and Big Data.”

   Winter, J.S. (January 2021, Telecommunications Policy Research Conference (TPRC).)

   Patient-generated health data (PGHD), created and captured from patients via wearable devices and mobile apps, are proliferating outside of clinical settings. Examples include sleep tracking, fitness trackers, continuous glucose monitors, and RFID-enabled implants, with many additional biometric or health surveillance applications in development or envisioned. These data are included in growing stockpiles of personal health data being mined for insight via big data analytics and artificial intelligence/deep learning technologies. Governing these data resources to facilitate patient care and health research while preserving individual privacy and autonomy will be challenging, as PGHD are the least regulated domains of digitalized personal health data (U.S. Department of Health and Human Services, 2018). When patients themselves collect digitalized PGHD using “apps” provided by technology firms, these data fall outside of conventional health data regulation, such as HIPAA. Instead, PGHD are maintained primarily on the information technology infrastructure of vendors, and data are governed under the IT firm’s own privacy policies and within the firm’s intellectual property rights. Dominant narratives position these highly personal data as valuable resources to transform healthcare, stimulate innovation in medical research, and engage individuals in their health and healthcare. However, ensuring privacy, security, and equity of benefits from PGHD will be challenging. PGHD can be aggregated and, despite putative “deidentification,” be linked with other health, economic, and social data for predictive analytics. As large tech companies enter the healthcare sector (e.g., Google Health is partnering with Ascension Health to analyze the PHI of millions of people across 21 U.S. states), the lack of harmonization between regulatory regimes may render existing safeguards to preserve patient privacy and control over their PHI ineffective. While healthcare providers are bound to adhere to health privacy laws, Big Tech comes under more relaxed regulatory regimes that will facilitate monetizing PGHD. We explore three existing data protection regimes relevant to PGHD in the United States that are currently in tension with one another: federal and state health-sector laws, data use and reuse for research and innovation, and industry self-regulation by large tech companies We then identify three types of structures (organizational, regulatory, technological/algorithmic), which synergistically could help enact needed regulatory oversight while limiting the friction and economic costs of regulation. This analysis provides a starting point for further discussions and negotiations among stakeholders and regulators to do so. 

   more » « less