SAS analytiikka tietojen käytönvalvonnan tukena taustaa uudistuvasta tietosuojalainsäädännöstä

Transkriptio

1 make connections share ideas be inspired SAS analytiikka tietojen käytönvalvonnan tukena taustaa uudistuvasta tietosuojalainsäädännöstä Jaana Sinipuro, SAS Finland

2 Uudistuva tietosuojalainsäädäntö EU:n tietosuoja-asetusehdotus hyväksytään (mahdollisesti) noin vuoden sisällä Aiheuttaa toteutuessaan uusia velvoitteita rekisterinpitäjälle Uusia valtuuksia myös valvontaviranomaiselle, eli tietosuojavaltuutetulle Ennakkokuuleminen ja ennakkohyväksyntä Käsittelyn kieltäminen (tilapäinen / pysyvä) Hallinnollisten seuraamusten määrääminen Lähde: Tietosuoja-lehti 3/2012

3 Rekisterinpitäjän uusia mahdollisuuksia Profilointi käy, jos asiakas suostuu Vrt Automatisoitu päätös / nykyinen henkilösuojalaki Tarkoittaa ihmisten henkilökohtaisten ominaisuuksien automaattista arviointia siten että arvioinnilla on merkittäviä vaikutuksia häneen... Ammatillinen suorituskyky, taloudellinen tilanne, sijainti, terveys, mieltymykset, luotettavuus sekä äyttäytymisen automaattinen analysointi tai ennakointi. Sallitaan, kun se tehdään sopimuksen tekemisen tai täytäntöönpanon yhteydessä ja siihen osallistuu ihminen. Lähde: Tietosuoja-lehti 3/2012

4 Rekisterinpitäjän uusia velvoitteita (1/2) Tilivelvollisuus (Accountability) itse todennettava tietojen käsittelyn lainmukaisuus. Kattava dokumentointi. Kuvattava koko henkilötietojen käsittelytoiminta ja tarkasteltava systemaattisesti miten asetuksen velvoitteet toteutuvat. Ilmoitusvelvollisuus (Data Breach Notification) tietoturvaloukkauksista rekisterinpitäjän on ilmoitettava loukkauksesta valvontaviranomaiselle 24 tunnin kuluessa tai perusteltava mahdollinen viivästys. Ilmoituksessa on kuvailtava loukkaus, tehdyt toimenpiteet ja seuraukset. Jos loukkauksesta aiheutunut todennäköisiä haittavaikutuksia rekisteröidylle on myös heille ilmoitettava. Lähde: Tietosuoja-lehti 3/2012

5 Rekisterinpitäjän uusia velvoitteita (2/2) Tietojen kulkeminen sähköisessä muodossa asiakkaan mukana mahdollistettava tietojen siirto toiseen järjestelmään. Vaikutustenarviointi (Privacy Impact Assesment) arvio suunniteltujen käsittelytoimien vaikutuksesta henkilötietojen suojalle Kuvataan henkilötietojen käsittely, riskiarvio ja riskienhallinnan toimenpiteet. Toimitetaan valvontaviranomaiselle. Lähde: Tietosuoja-lehti 3/2012

6 Päänsärkyä uudistuksesta? SAS voi tarjota koetellun vaihtoehdon...

7 make connections share ideas be inspired SAS analytics for monitoring person data security Pattern recognition experiences from Norway Inge Krogstad, SAS Institute

8 The Challenge Exposing irregular lookups Problem Unwarranted access to sensitive data Today a manual process Patient complaints Random selection from journal database Vision Partly Automated System Analytic based and data driven Focus on the real cases Move from reactive to proactive procedure

9 Is it a Challenge? Typical breach of the Duty of Confidentiality The employee has professional relationship with patient The patient is a colleague Dig into the patient's family / acquaintance The patient is a famous person (celebrity, public figure) The patient is particularly of medically interesting

10 Exposing irregular lookups Classical approach pore results! Filtering data and descriptions of normal and abnormal activities Capturing requests from users via IT systems (logs) Tracking of employees with respect to rotas, shifts, location and authorization Using rule engine to search The risk scoring approach Solve the predictive problem Based on Indications - scenarios Split the issues into dimensions The rules is inside the data Time Person Roles Organization Medical Area of interest/knowledge

11 Our Method Analyze the individual versus the group? Activity for the group Activity of individuals in the group How do the members of the group behave? ACTIVITIES/DOMAI N ORGANIZATION / STRUCTURE/ROLES How is the individuals acting in relation to the group? ACTIVITIES/DOMAI N ORGANIZATION / STRUCTURE/ROLES

12 Is the deviation enough to call it a pattern? Activities for the group Activity for an individual that acts different then the group How do the members of the group behave? ACTIVITIES/DOMAI N ORGANIZATION / STRUCTURE/ROLES How is the individuals acting in relation to the group?

13 Time: Lookup vs. patient situation Employee/org Patient/org Lookup 1 Lookup 2 Lookup 3 Referral and admission Treatment episode

14 Person: Lookups on patient Employee/org Patient/org

15 Organization: lookup by employee vs. department Employee/org Patient/org

16 Piloting and experiences from Norway ACTIVITIES: - ULLEVÅL MOLDE OUS DATA INTEGRATION: - DIFFERENT JOURNAL SYSTEMS - COMMON DATA MODEL ANALYTICS: - MODEL LIBRARY WITH 20+ SCENARIOS & RISK FACTORS USER APPLICATIONS: - REPORT GALLERY, CHARTS - SPIDER DIAGRAMS - DRILLDOWN CUBES IMPLEMENTATION: - PLUG IN SCENARIOS - INTEGRATE WITH EXISTING INFRASTRUCTURE/SYSTEMS - DATA MODEL - WEB BASED SOLUTION - TRAINING KIT

17 Library of scenarios Scenario Description Timeline Unexpected result in terms of lookup and timeline Printing Unexpected printing activity in terms of the timeline Particular patient Many highly suspicious lookups on particular patient for one day Crossing Unusual crossings between staff organization and the patient organization lookup profile Lookup on patients at departments that are unusual for that employee Long timeline and intervals Lookup over long time and with long intervals High numbers of patients High numbers of different patients seen during a particular period High patients frequency High number of different patients seen over all periods Many different patients Lookup on unexpected many different patients for particular period Colleague lookup Lookups against colleagues Exposed patient Many different employees that looked up on a particular patient Actualization Actualization made for accessing patient data Documentation Documentation done on journal for patient Frequency and behavior Frequencies by employee versus frequency for other employees in the same organization unit Interest for patient How interested are the employees for the particular patient versus all other employee in the same organizational unit Role and behavior Role and interest Number of patients see by the employee versus the behavior of others in the same position (role) How interested are the employees in the patient versus other professionals in the same position

18 A typical scenario package (example from pilot project) Scenario package Unexpected result in relation to the timeline Unusual crossings between employee organization and patient organization Lookup on patient at departments that is not expected for particular employee High number of different patients seen during a distinct period Documentation done into journal system How interested are the employee in a particular patient vs. everyone in the same organization How interested are the employee in a particular patient vs. other professionals in same role Lookup on colleague SCORE INTEREST VS. ROLE INTEREST VS. DEPT. COLLEAGUES DOCUMENTATION HIGH FREQ PATIENTS UNUSUAL DEPARTMENT CROSSING TIME

19 Scoring the scenarios Sc.1 Sc.2 Sc.3 Sc.4... Sc w.1 w.2 w.3 w.4... w.n

20 Value for the customer Provides insight into the use of hospital data Which employees accessed patient data? What did the employee do and look for? Finds divergence from patterns Identify employees doing something different then others Identify exposed patients (i.e. celebrities, public figures) Identify distinct patterns Find employees with lookups that are different then other Succeed to isolates high risk behavior Rank the risk on breach of the Duty of Confidentiality Provide high risk score reporting COMPLIANT

21 Functionality and applications Data integration, models and ETL connects information about employees, patients, spreads and other logs COMPLIANT Plug in scenarios and risk factor library Custom scoring procedures and risk calculation Secured database and encrypted system for risk scores, person-id and historical data Web reporting gallery, charts, spider diagrams and drill down cubes Application for tuning, knowledge transfer and training kit

22 Our method captures the entire process REQUIREMENTS - LAWS AND REGULATIONS GOALS AND STRATEGIES PATTERNS INSTRUCTIONS SCENARIOS DETECTION AND MONITORING REPORTING AND KNOWLEDGE BUILDING TUNING THE SYSTEM

23 make connections share ideas be inspired Inge Krogstad PhD, CoE SAS Institute