"Security and Data Integrity in Google Health"

Umesh Shankar

Umesh Shankar, Google
Wednesday, May 5, 2010

Sponsored by ISTS and Computer Science Department

Abstract

Google Health is a Personal Health Record (PHR) application, allowing users to aggregate their medical data in one place, view it and make sense of it, combine it with relevant reference and scholarly information, and have control over who can access it. The sensitivity of the data requires great care to secure it and ensure users' privacy, and the diversity of data sources---users, medical providers, home medical devices, and mobile applications---requires flexibility in input methods. We will discuss the challenges that arise in authentication, authorization, and data provenance, as well as how we address these in practice. Both external protocols and a flexible, scalable model for crypto key management used internally will be covered.

Last year's HITECH act renewed the push to make patient data available ubiquitously and electronically, but the problem of how to make a single coherent representation of it is unsolved. We will touch on a novel proposal for a very different method of representing medical records that addresses this issue.

Bio

Dr. Umesh Shankar is a security engineer at Google, focusing on user data protection and application security. He has published work in areas such as static analysis, network intrusion detection, ad-hoc networks, trusted computing, and usable security and privacy. He has also served on the program committees for numerous conferences. Dr. Shankar is currently a member of the SHARPS healthcare IT project's advisory board. He received a Ph. D. in computer science from the University of California, Berkeley, and an A.B. in computer science from Harvard University.