3.2 Privacy of eHealth Information
Maintaining the privacy of health information is of the highest importance, so it should
only be made available to appropriate people depending on the circumstance. This im-
plies the need to be able to authenticate the identity of a person accessing an eHealth
user profile, and to confirm that the role of the person is appropriate to the type of
information being accessed.
The rules for disclosing health related data may depend not only on the data itself,
but on several context parameters, like the health condition, the geographical location,
the person’s age, the dependencystatus, and of course on the status of the person/system
that requires access to the data. The standard will specify rules for classifying and ac-
cessing such parameters.
3.3 Roles
In order to manage privacy, for each attribute in a user profile it will be necessary to
state who has the right to view or modify the information. Such rights should be tied to
roles. Roles embrace those of health personnel, formal and informal carers and telecare
agents. Some roles may be mutually exclusive, others may be complimentary, and one
person may have different roles in different situations. A standard for classification of
roles related to eHealth personalization is therefore needed, and will be included in our
work.
Also needed is an internationally agreed upon system for certifying the role of a par-
ticular person. For the appropriateness of roles to be confirmed it will thus be necessary
to ensure that a person’s eHealth profile contains an accurate record of their eHealth
related role. The extensive ETSI work on a Universal Communications Identifier (UCI)
[9] will be used as input (among others) to the current work, thereby ensuring a reliable
way to authenticate the identity of a person accessing an eHealth profile.
eHealth roles identified in our work comprise the following: Doctor, carer, informal
carer, care mediator, emergency service, client and client administrator. For each of
these roles, there will be different ways of characterizing the user, different views of the
eHealth system, and different access rules.
3.4 System Architecture
A general model for user profile management is being proposed by the ETSI project
team STF342. Our results will be used to extend this model into the eHealth domain.
In the model, it is suggested that maintaining and updating the user profile according
to preferences and context should be performed by a Profile Agent. The architecture of
the Profile Agent including possible connections with external systems is depicted in
Figure 1.
Although profile data may distributed among several devices and services, to ensure
consistent behaviour the data should be managed from a single location. This is the
purpose of the Profile Storage Agent, which will handle storage and retrieval of profile
data from multiple profile storage locations, each one storing only components that
apply to a particular device or service. Ideally, profile data should always be available,
45