Security

From Informatics

Authorization

Use Case

• Duke University has a list of all patients at the Duke University hospital. Doctors at Duke can access Duke hospital patient information. The doctors are registered in the Duke GMS.
• Columbia University has a list of all the patients at the Columbia University hospital. Doctors at Columbia can access Columbia hospital patient information. Doctors are registered in the Columbia GMS.
• Ohio State University has a list of patients at the Ohio State University hospital. All doctors that are "caBIG doctors" can access this information. Doctors are registered in the caBIG GMS. More specifically, this GMS will have a pointer to the Duke GMS and Columbia GMS. I like to think of this as an association table with a foreign key to the Duke GMS table and the Columbia GMS table.

Issue: Will hospitals make their patient data public so that any doctor from one of the caBIG institutions will have access to this data? What about HIPAA?