A Hybrid Web Based Personal Health Record System Shielded with Comprehensive Security

We present the design and development of a hybrid, web-based scheme for creating, maintaining and sharing personal health records (PHRs) with embedded security. We adopt a hybrid approach to processing PHRs and present a prototype called Personal Health Manager (PHM) that is based on this hybrid model. PHRs in the PHM prototype are owned by patients but updated by medical professionals who have been granted access to the record by the owner. Our prototype design provides a framework to begin exploring the major security concerns such as confidentiality, integrity, availability, authentication, authorization and non-repudiation (as part of the X.800 security architecture) that arise with the adoption of an electronic method for maintaining and sharing highly sensitive healthcare information. We provide comparison of our work with existing PHR tools based on parameters that distinguish PHR models such as ownership of data and security considerations.