Risks of being on the Grid: the BioMedical challenge Yannick Legré CNRS/IN2P3 – EGEE Biomedical WG

1. Risks of being on the Grid: the BioMedical challengeYannick LegréCNRS/IN2P3 – EGEE Biomedical WG GGF 12, Brussels September 21st 2004 www.eu-egee.org EGEE is a project funded by the European Union under contract IST-2003-508833

2. the HealthGrid vision HealthGRID In this context "Health" does not involve only clinical practice but covers the whole range of information from molecular level (genetic and proteomic information) over cells and tissues, to the individual and finally the population level (social healthcare). Patient related data PublicHealth Association Modelling Computation Databases Public Health Patient Patient Tissue, organ Tissue, organ Cell Cell Molecule Molecule INDIVIDUALISED HEALTHCARE MOLECULAR MEDECINE S. Nørager Y. Paindaveine European Commission DG-INFSO Computational recommendation GGF12, September 21st 2004 - 2

3. Health Grid – Security Needs Confidentiality Integrity Availability Physical Security Traceability Access Control Credit: Syed Naqvi GGF12, September 21st 2004 - 3

4. Issues related to medical data • Ubiquitous, Quick and Secure Transfer of Information • Medical Information is: • Multimedia, Large and Increasing in Size. • Relevant on the Long-term. • Medical Data is Critically Confidential. • Legal Regulations at National Level is an added difficulty to the Integration of Large Repositories of Personal Data. • Nearly Impossible to: • Store all Data Outside the Hospital Borders. • Have plain Access to whole Personal Data. • Difficult to: • Provide Access from the Internet. • Replicate Data (Even Temporally). • Pervasive Access and Fault Tolerance • Medical Healthcare is Performed All Over the Clock, 7 Days a Week. • Fault Tolerance to All Other Critical Resources (Water, Light, Heating) is Considered. • Difficult to: • Guarantee an ‘Always on’ Application. • Guarantee a Quality of Service. Credit: Ignacio Blanquer GGF12, September 21st 2004 - 4

5. Risks • No respect of data privacy policies • GRID Nodes Should be Installed Within Medical Data Networks. • Data Should be Stored Encrypted. • Information that Flows Across the GRID Should be Filtered to Show Only the Relevant and Authorized Data. • Consider the Legal Issues of European and National Directives. • Confidentiality, Integrity, Authorization and Authentication are Provided by the GRID. • Lack of Robustness • Fault Tolerant and Pervasive. • High degree of Repeatability in the Results. • Failure in protecting peoples’ privacy can have devastating consequences on business (e.g. public opinion, lawsuits) • Health related information is very sensitive and prone to abuse • Privacy impacts society as a whole (e.g. loan applications, insurance, scholarship, ...) • Privacy violation is irreversible • Confidential information can never be considered confidential again, once it was out in the open • Legal Violation • Different regulation for different countries… Credit: Ignacio Blanquer GGF12, September 21st 2004 - 5

6. Ongoing work on biomedical requirements in Europe… • Within the framework of EGEE, biomedical security requirements described in (http://egee-na4.ct.infn.it/requirements/) • HealthGrid white paper publicly available on HealthGrid web site since June 15th, 2004 (http://www.healthgrid.org) • Chapter 8 dedicated to Privacy, Security and Ethical issues • Chapter 9 dedicated to Legal issues GGF12, September 21st 2004 - 6

7. The HealthGrid initiative • To provide a place of dialog and exchange between European and international projects • Web site: www.healthgrid.org • To produce collaborative documents • HealthGrid White Paper • To organize conferences and workshops on Health grids • Third European HealthGrid Conference • Location : Oxford (UK) • Dates: April 7th – 10th 2005 • Information and registration (available soon): http://oxford2005.healthgrid.org GGF12, September 21st 2004 - 7