Development of a secure medical research environment

The confidentiality of medical information, including patient data security, is an increasingly important issue in today's health care environment. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) [1] requires the Department of Health and Human Services to create specific rules for managing the security and privacy of computer-based patient medical records. In November 1999, the Department of Health and Human Services implemented the privacy requirements of the HIPAA proposal to improve the effectiveness of public and private health programs by protecting individually identifiable health information. In this paper we will give a brief description of some widely used security measures. We will also address the steps that were taken at the Imaging Science and Information Systems (ISIS) Center at Georgetown University to secure our research environment and the patient medical information used within the network, and describe our efforts to become more HIPAA compliant. The paper concludes with some clinical applications.