Towards a Model for Risk and Consent Management of Private Health

Health information custodians and network providers within the circle of care for a patient must meet certain legal obligations regarding the collection, access and disclosure of personal health information. We present a framework for consent and risk management that can be used to help manage a patient’s consent for releasing personal health information, and analyze the risk involved in handling this type of data. A patient’s preferences for specific privacy policies (expressed in P3P) are elicited through querying, and extra information is inferred using a Bayesian network. A risk analysis is performed to help a custodian to make informed decisions when handling personal health information. Thus the custodian and provider can help each other meet their respective legal obligations, and patients are more easily able to exercise their privacy rights.