Using Encryption to Protect Medical Records from Prying Eyes and Tampering!

The era of the Internet of Everything (IoE) has arrived, meaning that the storage, transmission, and utilization of various data in medical environments face significant security risks. Whether it is medical record data, monitoring data, or even associated medical instrumentation, everything needs to be properly protected to prevent any unnecessary risk. In this era of information explosion, data privacy and information security have become the two primary concerns.

Taiwan faces two major dilemmas in healthcare cybersecurity: first, the uneven distribution of resources and capabilities across medical institutions; second, the complexity of medical data circulation, which involves multiple organizations and public agencies.

"Cloud migration" is an irreversible trend for medical institutions. It offers convenient data preservation and management, reducing the likelihood of data loss and the need for reconstruction. However, entrusting data to the public cloud also introduces new cybersecurity risks. During the inventory process, medical institutions must carefully examine their own system vulnerabilities and invest in refining their current structures. Before attempting patches, organizations need to clearly define their requirements, understand the level of cybersecurity they need to achieve, and implement appropriate deployments based on cost and demand.

Fan Chun-Yi, a Distinguished Professor at the Department of Computer Science and Engineering and Director of the Information Security Research Center at National Sun Yat-sen University, also mentioned that during wartime, the operation of medical systems is vital, directly relating to the survival and health of the people. However, because of their importance, medical systems become prime targets for hackers. The destruction of Ukraine's medical systems not only led to a shortage of medical resources but also prevented patients from receiving timely treatment.

Furthermore, hacker attacks have had a significant impact on social operations. The stability of social operations is crucial for wartime logistical support. However, during this conflict, hacker attacks in Ukraine severely compromised the smooth operation of society. For example, disruptions to the medical system meant the wounded could not be treated promptly, which not only endangered their lives but also posed a massive challenge to wartime logistics.

Professor Fan Chun-Yi pointed out that these hacker attacks have had a profound impact on the stability of Ukrainian society and wartime logistical support, warranting significant attention. Protecting the security of medical systems and social operations is paramount, requiring strengthened cybersecurity measures and increased awareness of hacker attacks. Only by ensuring the normal operation of medical systems and maintaining social stability can the lives of Ukrainian citizens and the overall interests of the nation be protected.

Through the example of the Russia-Ukraine war, we can realize that the resilience of medical systems is crucial. Fan mentioned that in today’s increasingly complex data circulation environment, we must assume the system has already been compromised and promote a "Zero Trust" policy, encouraging organizations to think about response strategies under the assumption of a breach.

Professor Fan and his research team, based on the Fast Healthcare Interoperability Resources (FHIR) standard, use encryption technology to ensure that medical data can circulate globally. By encrypting every medical record, this data cannot be peeked at or stolen by hackers on the cloud because it only circulates in ciphertext form. Only authorized individuals, such as the attending physician or the patient themselves, can access the data. A series of conversion mechanisms can also transform the current electronic medical record system used by the Ministry of Health and Welfare (CDA R2, HL7 Clinical Document Architecture, Release 2.0) into the international FHIR standard. Through this mechanism, medical institutions can share medical records and utilize this data for AI learning and analysis, allowing academic and medical units to better utilize data for the benefit of future generations.