An Ontology for a HIPAA compliant cloud service

Abstract

With increasing adoption of digitized patient records and physician’s notes, managing patient records and medical data has become a major challenge for healthcare providers. Hence, cloud based healthcare services have flooded the market with their promise of ubiquitous access, scalability and low cost. The Health Insurance Portability and Accountability Act (HIPAA) regulates the privacy and security of this data maintained by the healthcare providers and all cloud based healthcare services in the United States must comply with it. The HIPAA Privacy Rule protects the privacy of individually identifiable health information, called protected health information (PHI). The Security Rule protects a subset of information covered by the Privacy Rule, which includes all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form. We have developed a semantically rich Web Ontology Language (OWL) ontology to define the HIPAA privacy and security rules. This ontology extends the service lifecycle ontology that we have developed for automatically acquiring and consuming cloud based services in that it helps define healthcare domain specific security and privacy measures. Our HIPAA ontology defines in detail the concepts that have been specified in the act. Using this ontology in conjunction with our Cloud lifecycle ontology and incorporating the compliance and security guidelines in, users can discover and acquire Healthcare services that will comply with HIPAA security requirements. In this paper we describe this ontology.