Patient Privacy Protection Maturity Evaluation Framework

1. Introduction

Patient Privacy and Security has become very popular especially after the electronic data become a part of health life. Although they are (Privacy and Security) two different things, the term is used as a concept. By security it is meant about how to protect, while by privacy what to protect. Security is related to the storage and transfer of patient data with integrity, validity, and authenticity, privacy is related to the authorized access and disclosure of patient data [1,2].

Patient privacy can be defined as the right of individuals to hide/disclose his health related data from anyone, and control this the data no matter who has it, while disclosing for healthcare, treatment or other reasons [3,4].

Patient health data is the most sensitive data of a person. In case of exposing, it can shame people, cause to feel embarrassed, offended and discouraged, make people lose their job and family. On the other hand, these data can be used for research, education, public health, insurance payments etc. to improve healthcare service.

Health sector’s place is in the top three in the yearly reported data security events [5]. Healthcare institutions are direct threat to the patient privacy, because of: [5]

• information system dependence.
• medical device connections.
• multiple software usage.
• multi-user shared devices.

although they help patients by giving healthcare services.

In addition, healthcare staff and other employees’ having access to electronically stored or written patient record also present an internal threat. Most of the staff do not take even the simplest precautions because of negligence. User negligence is the major data security breach source [6,7].

Patient privacy can be violated due to the physical problems of health institutions, lack of attention of healthcare professionals, or can be sacrificed to so called protecting patient against risks [8,9,10].

Patient data is transferred electronically for many purposes, internet of things, homecare solutions, insurance, public health purposes, etc. between systems, devices, organizations. Fast improvement of medical technology brings also new patient data sources such as biometric sensors [11]. Privacy leakage of medical wearable devices is another threat to patient privacy [12,13]. Haris, Haddadi, and Hui [14], examined the privacy leakage risks on mobile computing on mobile and wearable devices. In exchanging patient data electronically with other systems, patient privacy is a major issue that has to be considered in health information exchange (HIE) [15]. Murdoch gave examples about the identification of patients from the anonymized data in which protected health information is removed [16]. The study shows that protected data is also at stake, no matter an institution employs any policy or not.

Despite so many threats and risks on patient privacy, the majority of healthcare institutions do not invest enough to protect patient privacy [16,17].

Protecting privacy and collecting, storing, using health data is a tough balance. So, collection, storage, access, usage, and exposure of these data must be subject to regulations such as law, institutional policy, technical infrastructure etc.

Two big and important regulations on this issue are General Data Protection Regulation (GDPR) and Health Information Portability and Accountability Act (HIPAA).

GDPR imposes obligations onto organizations and people who wants to target or collect data related to people in the EU [18,19]. Although it is not dedicated to health data, it is the toughest privacy and security law in the world.

Health Information Portability and Accountability Act (HIPAA), is a dedicated and detailed patient privacy rule.

Securing and ensuring patient privacy is an ethical obligation of healthcare professionals and institutions, in accordance with the ethical codes and principles [20]. But also, there must be a legal obligation imposed by law just like HIPAA and GPDR. Because violations are done intentionally, unintentionally, accidentally, or negligibly in healthcare institutions by personnel.

The staff should know high penalties are going to be applied for the ones in charge of violation, and the healthcare institution management is the main responsible to apply such controls and fines. To avoid unintentional privacy violations, healthcare staff should be trained. That is the responsibility of the management.

Patient privacy is thoroughly discussed in scientific literature. Blockchain based mechanisms [21,22], AI based studies [23,24], and many other approaches. All these studies have one common objective: ensuring and securing patient privacy while serving the data for better healthcare service.

If there is no defined policy/principle/standard/requisition/prerequisite, it is not possible for healthcare institutions to protect patient privacy. In the literature there are a lot of patient privacy scale/inventory for a wide range of evaluation purposes, but each evaluate only a part, personnel related features, patient related features, system related features, etc. This deficiency prevents us from developing complete mechanisms including all aspects of patient privacy protection, because we can’t measure and determine the weak points. We can’t manage something that we can’t measure, as the management guru Peter Drucker famously said [25]. In addition, regulations fall behind the rapidly improving technologies they try to govern [16] by being inapplicable or impotent in terms of novel cases and technologies [4].

Because of these problems, the objective of this study is to introduce a complete patient privacy protection maturity evaluation framework, in all aspects, for healthcare institutions. In this framework, in the first step, the arguments to protect patient private data is established and documented. In the next step, an inventory, in which the objective is to measure healthcare institutions’ level of patient privacy protection maturity, is developed. The sub aims of the study are listed below.

• Suggestion of the electronically stored and need to be protected minimum and maximum data sets.
• Access mechanisms to these data sets
• Authorization mechanisms of healthcare staff
• Education/Awareness/informing mechanisms of healthcare staff about patient privacy

Because the nurses are the dominating healthcare staff in number and they are directly front facing the patients, the case study is conducted among nurses. In another words, nurses evaluated the institution in which they are working.

2. Materials and Methods

2.1. Ethical Considerations

This study is ethically approved by the XX University Non-Invasive Research Ethical Committee on XXXX with the XX document.

2.2. Study Design

The study is performed in three steps. The arguments to protect patient private data is established first, in another words, conceptual framework is developed, in the second step patient privacy protection maturity inventory is developed, then the validity and reliability of the inventory is examined. In the last step, evaluation results of the inventory are examined. Study design is presented in Figure 1.

2.3. Conceptual Framework

The dimensions of the Patient privacy protection maturity evaluation framework are:

• Management
• Users
• Patient
• Data
• Healthcare Information System (HCIS)

From the bottom up, the hierarchy of the dimensions is given below in Figure 2. The management is the topmost important part, so it is on the base. Without management support and the things had to be done by management, patient privacy and security cannot be provided. Then the human comes, which is composed of users, patients, and managers namely. Data model is the third part. At the top, the measures, and the mechanisms in HCIS are important.

The variables of the evaluation framework are given in Figure 3. All the variables and mechanisms are presented below, in detail.

Patient Privacy Policy: All healthcare institutions should have a written, approved and declared a public policy about the patient privacy. Patient’s rights, institution’s and staff’s responsibilities together with penalties should be clearly stated in this policy.

Training program (users & patient): All healthcare institutions should train their staff and patients in terms of privacy. In this training, the staff should be trained about the awareness, things to do, things not to do, possible threats, possible outcomes of privacy violations, possible penalties for both the faulty institution and faulty person. The patients should be trained in terms of awareness, his rights, complaining mechanism, consent, control over his private data.

Inspections: All healthcare institutions should make periodic, planned, or instant inspections about the patient privacy. At the end of every inspection, there should be an effective carrot and stick mechanism. The results of the inspections should be published.

Patient Consent Management: Unfortunately, “Patient consent” is a problem area. Patients are not mature enough to decide on their consent truly. Either they are afraid of not having a good service and give consent although they are not willing to, or they are afraid of something bad (in vain) and do not give consent. They should be informed properly about the procedures and usage of their data, the risks together with their realization rate, etc. to enable the patient to give the right consent and not to give the wrong consent.

Interoperability Policy: In the technology era, the systems are not running alone. There are many other systems and devices interacting with. For a HCIS to be interoperable is a good virtue, but the patient privacy and security should be considered and handled as a challenge. To accomplish this, all healthcare institutions should have a written, approved and declared policy describing the way to interoperate with connecting devices and systems in data exchange in terms of patient privacy.

Responsibility Declaration: All healthcare institutions should have a written, approved and declared responsibility declaration, stating clearly about its responsibilities and penalties in terms of patient privacy and security.

Privacy and Security Documentation: All healthcare institutions should have a privacy and security documentation, to ease human (Users/Patients/Managers) for guidance. It should contain standards, laws and regulations, how-to descriptions.

Awareness: Awareness is a very important issue for human factor of the patient privacy and security. Without knowing an issue exactly what it is and what it is not, one cannot take necessary actions. Human factor of the healthcare institutions should be very well aware of the patient privacy and security.

Using own username and password: The most common violation of patient privacy and security is caused by users’ not using their own username and password in healthcare institutions. HCIS users are not sensitive about their usernames and passwords, they give it to other users. As we have stated before, user negligence is the major data security breach source. Considering that all users have different authorization, sharing usernames and passwords means most of the users operate in the HCIS with the authorization that they do not have.

Logging: All the daily operations performed by HCIS users should be stored in HCIS database. This logging history has to be used for possible privacy and security violations, also can be used for retrospective examination in case of complaint or suspicion.

Private Data Sets: All healthcare institutions should have a clearly defined, listed and declared private data set about the patient. This private data set should be subject to special mechanisms both in HCIS and routine use. The proposed private data set derived from HIPAA can be:

• Names.
• All elements of dates (except year).
• Phone numbers.
• Fax numbers.
• E-mail addresses.
• Social security numbers.
• Medical record numbers.
• Health plan numbers.
• Account numbers.
• Certificate/license numbers.
• All means of vehicle numbers.
• All means of device identifiers.
• Web Universal Resource Locators (URLs).
• Internet Protocol (IP) addresses.
• All means of biometric identifiers.
• Any comparable images.
• Any other unique identifying numbers.

Data Access Hierarchy: Having clearly defined the private data set, all the elements of the data set should have an access hierarchy level. That means, all elements should be indicated by means of access security importance level. An example of data access hierarchy is given in Table 1.

User Access Definition: By User Access Definition, the healthcare institution defines the level of privacy authorization of the HCIS users. Data Access Hierarchy and User Access Definition help institution manage which user can access which private data set element. An example is given below.

Table 2. An example user access definition.

Data	Hierarchy level
Physician	7
Nurse	5
Technician	2
Lab technician	2
Office Worker	1

Table 2. An example user access definition.

Data	Hierarchy level
Physician	7
Nurse	5
Technician	2
Lab technician	2
Office Worker	1

When the system combines the user access definition and data access hierarchy, it is seen that a physician can access all the data set given in Table 1 (he has the access definition as 7 which is equal to or greater than all data access hierarchy levels). A nurse can access only to telephone certificate number, plate number. Technician, lab technician and office worker cannot access any private data set element.

Data Security Mechanism: Data security mechanism is a collection of measures to prevent data from unauthorized access and malicious attacks, such as secure protection of hardware, biometric measures, firewalls etc.

Anonymity: Anonymity is an important measure to protect patient privacy. Especially research studies, data exchange, consultations, billing … procedures are very sensitive applications and prone to privacy violations. To protect privacy, anonymity is a good way of solution in such applications.

Transmission Security: In transmission of patient data, the institution should be careful about two stages; the time that the data travels, the time that data is sent and received. There must be mechanisms to ensure the data are not viewed or changed at the time of the travel while on the way.

Controlled Research: Research is very important for development of new technologies/advances/prognosis etc., but there is a danger about abuse and misuse of patient private data. To prevent privacy violation and enable research, there must be a control mechanism, the best solution can be anonymity.

Authorization and Authentication: These issues are very well known and do not need further definition. The only thing that can be made clear may be authorization should be done according to the User Access Definition.

Private Data Access Logging: Any access to private data set should be exclusively logged, separately from the logging defined above. By this special logging, privacy violations can be spotted timely and online.

Privacy Violation Alert: In HICS there can be smart, online alert mechanisms about the potential patient privacy violation, to enable management to prevent a possible case.

Backup Security: While backing up the data in the HCIS database, there should also be mechanisms to prevent privacy violations and protect privacy.

Need to Know: This is a very important principle that can be used to protect security. In access to private data sets, the construction of the user access definition can be referenced according to need-to-know principle. If a user does not need to know an element of the private data set, then the access should not be given.

2.4. Data Collection

Study is conducted, in the biggest hospital in XX country, having 800 nurses employed. Volunteered nurses (400) participated in the study, with a face-to-face interview, and 307 completely answered surveys are analyzed.

2.5. Statistical Analysis

Analysis and measurements are done by means of Statistical Package for the Social Sciences (SPSS) and Analysis of Moment Structures (AMOS).

2.5.1. Content Validity

To measure the content validity of the inventory, experts in the field of nursing and in the field of measurement and evaluation were asked to evaluate each expression in terms of comprehensibility and compatibility. The inventory is arranged and modified according to the feedback of the experts.

2.5.2. Structure Validity

In the beginning, Exploratory Factor Analysis (EFA) is done prior to Confirmatory Factor Analysis. In EFA, Kaiser-Meyer-Olkin (KMO) and Bartlett’s tests are used as prerequisite to determine the items’ fitness to the Confirmatory Factor Analysis (CFA), in addition communalities are examined. Later, data are analyzed with CFA to confirm validity, reliability, goodness-of-fit testing. For structural validity, fits tests, Comparative Fit Index (CFI), Goodness of Fit Index (GFI), Adjustment Goodness of Fit Index (AGFI), Normed Fit Index (NFI) are used.

In CFA, the most frequently used indicators are chi-square, root- mean-square-error (RMSE), or root-mean-square-error of approximation (RMSEA) [26]. Chi-Square is proved to be sensitive to sample size, it tends to be more significant as the sample size grows, to get rid of that handicap and avoid bias, χ²/df should be used together with other goodness of fit indexes (AGFI, GFI, CFI, NFI, IFI, and RMSEA) [27]. CFA fit indexes are given in Table 3. [27,28].

2.5.3. Reliability

Reliability of the inventory is examined by Guttman’s, Cronbach's Alpha, and Spearman-Brown coefficients.

2.5.4. Evaluation of the Hospital

Data is captured using Patient Privacy Protection Maturity Inventory, developed specifically for this study. In the Inventory, 30 questions exist in which healthcare staff are to express their evaluations/answers using five-point Likert scale, Strongly Agree, Moderately Agree, Not sure, Moderately Disagree, Strongly Disagree. Fuzzy logic methodology, namely Fuzzy Conjoint Analysis (FCA), is used for calculations of the Inventory results. Likert scale context, having ambiguity and multiplicity in meaning, is very suitable for fuzzy logic methodologies. FCA is the statistical and multi criteria evaluation method to determine the value of a product that one appraises and one’s preferences related to the criteria employed [29].

Literature has proposed to use fuzzy logic and conjoint analysis together to model the subjective preferences of the evaluators [30].

Likert scales of inventory are converted into fuzzy triangular numbers (fuzzification). In fuzzification, crisp values and linguistic variables of the method is converted into fuzzy sets. In Table 4, the triangular numbers used to fuzzify inventory ratings captured are given.

The membership of each Inventory variable to the defined linguistic variables (our Likert scales), µR(Xj",F" j), is computed with;

$$\mu R\left(Xj,\mathrm{F}j\right)=\sum _{i=1}^n\left[\raisebox{1ex}{$wi$}\!\left/ \!\raisebox{-1ex}{$\sum wi$}\right.\right].Xi$$

(1)

Where;

• wi is the answer given by i-th participant
• ∑Wi is the sum of the answers given to ith inventory item
• wi / ∑Wi is the weight of the i-th participant.
• Xi is the corresponding fuzzy set of the i-th respondents (if the answer is “Moderately disagree” then Xi is (0,0.25,0.5))
• Fj is the jth inventory item.
• n is the total number of answers.

This membership gives us the fuzzy set of each Inventory variable. Now it is time for comparison of these sets with the defined fuzzy sets, and to determine, to the which linguistic variable the given response is closer. Here, the aim is to capture which original linguistic variable is the closest to the final fuzzy set obtained from participants’ answers. Similarity is measured by;

$$\mathrm{Sim}(Ri(yj,\mathrm{A}),\mathrm{F}(xj,\mathrm{l})=\frac{1}{\left[1+\sqrt{{\sum }_{j=1}^n(\mu Ri}\left(yj,A\right)-\mu F\left(xj,l\right){)}^2\right]}$$

(2)

Where;

• Ri (yj, A) is the fuzzy set determined by 2 (formula 2)
• F (xj, l) is the standard fuzzy sets defined (Table 1)

In the last step of the evaluation, patient privacy maturity score of the evaluated institution is determined. This determination is done according to the similarity values. If the similarity is close to the worst Likert scale, “Strongly Disagree”, then the patient privacy maturity score is Maturity level 1, when to the “Moderately Disagree”, it is Maturity level 2, when to the “not sure”, it is Maturity level 3, when to the “Moderately agree”, it is Maturity level 4, when to the “Strongly Agree”, it is Maturity level 5. The higher the maturity score of the healthcare institution, the more mature it is, in terms of patient privacy.

3. Results

400 volunteered nurses have participated in the study,307 of them are included, aged between 22 and 61 with an average of 35,79. 19 participants are female (6.20%) and 288 male (93.80%), 99 married (32.20%) and 208 single (67.80%). 39 participants express their education as high school graduate (12.70%), 36 as BS (11.70%),203 as university (66.10%), 27 as MS (8.80%),2 as Ph.D (0.70%). 29 participants are working in emergency department (9.40%), 12 in operations (3.90%), 31 in surgical departments (10.10%), 137 in internal medicine (44.60%), 41 in administration (13.30%), and 57 in intensive care (18.60).

Before factor analysis, reliability is measured. Cronbach’s Alpha, our reliability coefficient, for all 30 variables is measured as 0.973 Spearman-Brown coefficient is 0.949, and Guttman's coefficient is 0.973. Cronbach’s Alpha, Spearman-Brown coefficient and Guttman's coefficient according to the dimensions are given in Table 5.

As a pre-requisite to CFA, KMO Measure of Sampling Adequacy (MSA) value, 0.959, is measured to see if the variables fit to factor analysis. The measured value is very close to 1. The Bartlett’s Test of sphericity proved to be significant (p=0). These prove research variables are appropriate for a factor analysis [31].

In the EFA, the five dimensions explain a total of 72.175% of the variance among the items in the study. Varimax rotation analysis is evaluated seven times. All communalities were over the required value of 0.500 (between 0.504-.822).

In the CFA, the fit values obtained is given in Table 6.

The similarity coefficients and the closest Likert scales of all inventory items are given in Table 7. It is seen that all the items are closer to ‘Moderately disagree’. The highest coefficients are marked as bold. In Table 6, the highest value is taken, in another words, the value closest to 1, as explained in methods section. Corresponding Likert scale of the value is the most similar choice we are looking for.

The similarity coefficients and the closest Likert scales according to the dimensions are given in Table 8. As in the variables, all close to the Likert scale ‘Moderately disagree’.

4. Discussion

In this study, a complete, patient privacy protection maturity evaluation framework, is introduced. In this framework, healthcare institutions are evaluated in five dimensions under 30 different criteria that have direct impact on patient privacy protection. This evaluation is executed by means of patient privacy maturity inventory, developed specifically for this study, to capture the evaluation data.

According to the validity and reliability analysis, it can be sad that inventory is valid and reliable to measure the privacy protection maturity of a healthcare institution. All reliability coefficients (Guttman's, Cronbach’s Alpha and Spearman-Brown) are near to 1, showing very high reliability. EFA shows a high explanation ratio with 72.175%, together with high communality scores. CFA proves almost perfect fit, except AGFI value which has acceptable fit.

It seems as if all participants agreed on the results. Similarity values are very close to 1, changing between 0.76 and 0.86 (in 27 variables >0.8, in 9 variable greater than 0.84), as if almost all users have given the same answer. This shows a complete agreement on the evaluation of the institution.

According to the evaluation results, the institution’s patient privacy protection maturity score appears as “Maturity level 2”, in all items and dimensions. Meaning; almost, no privacy policy, no training program, no inspections, no documentation, no defined private data sets, no data access mechanisms. This result is compatible with the motivation of the study. If there is no principle/standard/requisition/prerequisite defined, it is not possible for healthcare institutions to protect patient privacy. We have said that securing and ensuring patient privacy is an ethical obligation of healthcare professionals and institutions [21]. In addition, we have said that also an obligation must be imposed by law just like in HIPAA and GPDR. This study results support these assertions. Ethics can be avoided especially when human life, health, or any other good intentioned excuse is on the agenda, or these wonderful excuses can be a shelter to potential violations. As stated before, if legal regulations do not force, healthcare institutions do not invest enough to protect patient privacy [32] and do not spend enough resources [1].

Most privacy violations are found out by the individual (patient/staff/etc) whose privacy is violated, not by an analyst or a smart mechanism [5]. That shows there can be much more violations remain undetected because nobody examines.

This study shows to meet the patient privacy requirements of the evaluation institutions should invest in human and HCIS, by spending time and money, by constructing a body to plan and investigate. This study also show institutions do not take required measures to detect and prevent patient privacy violations in time, before done; most violations of patient privacy are seen when a dedicated investigation is performed, and it is usually too late because violation is already done, and harm is experienced [5].

Not to be late, required measures are supposed to be taken, periodic investigations should be made, and the whole system, all components, should be evaluated.

Managing a healthcare institution with the perfect level of patient privacy protection maturity requires a complete evaluation to prove it is. If it is not at the desired level, we must find out the missing or lacking points. This is possible if and only if you evaluate on the scope of patient privacy. This inventory may give the institutions to measure where they are in terms of patient privacy protection.

The results of the study prove that the framework and inventory can be used as a measurement for healthcare institutions, it can also be used to construct policies and standards about. This study is only a case study, but it can be applied to different healthcare institutions and verify the model’s accuracy with more cases. But with the current obligations and regulations, this study shows the result would not be different.

For further research, the framework can be used to evaluate more healthcare institutions together and analyze the comparative results. The evaluators can be all healthcare staff instead of nurses, and again comparative results between staff can be analyzed. Another version can be using professional evaluators. These evaluators can be trained before the study, then the same team can evaluate different types, sizes, … of healthcare institutions.

5. Conclusions

The biggest significant contribution of the study is its being a complete evaluation framework in terms of patient privacy protection. As it has been stated in the introduction part, although privacy evaluation in healthcare is thoroughly discussed, many evaluation and protection methods are introduced, evaluations are done in only one or a few aspects. In fact, privacy protection is a more complicated issue, and it has many elements which must run together, complete one another, to protect patient privacy. These privacy-protection-complement elements are introduced in this study, as another contribution to the scientific literature.

The framework evaluates the healthcare institution and determines the patient privacy maturity score. The possible scores are Maturity level from 1 to 5, in which higher score is better. By means of this concrete output, the level of maturity of any healthcare institution can be measured, points to improve can be understood, and in the next evaluation, progress in the level of maturity can be seen.

The framework enables us to spot and determine the weak sides and gaps of patient privacy protection of an institution. It can point potential privacy violation issues. This evaluation can be done periodically to examine the maturity improvement on the scope of patent privacy. In addition, we can compare different healthcare institutions in terms of patient privacy protection and rank them from the highest level to the lowest or vice versa. This comparative analysis may be useful especially for the chain healthcare groups, having more healthcare institutions to make inhouse comparisons and build standards.