This chapter reviews the common health data security and privacy challenges to provide an overview of the context—the concerns and the types of cybersecurity threats that healthcare institutions face. Also highlighted are the latest scientific work related to two primary solutions for protecting health data used for individual care, namely, access control and cryptography and two additional solutions for protecting data used for secondary purposes, namely, data de-identification and privacy-preserving distributed data mining (PPDDM). We exemplify implementation of these solutions using three real-life use cases in healthcare and pivot our discussion on how healthcare institutions can develop cybersecurity policy and prepare themselves for complying with relevant security and privacy regulations like Europe’s General Data Protection Regulation (GDPR) and the Healthcare Insurance Portability and the Accountability Act (HIPAA) in the United States.

Cloud computing has many benefits relevant to the healthcare industry. Although the adoption of cloud services for healthcare systems is increasing, employment of cloud services raises many security and privacy concerns for patients and healthcare providers. We still lack a clear set of requirements consented by the different stakeholders; here in particular IT and healthcare professionals. In this study, we examine whether user perspectives on requirements for e-health on the cloud are consistent with best practice guidelines and regulatory requirements. This work contributes to the requirements engineering phase for a secure e-health cloud framework developed in a European project (ASCLEPIOS, https://www.asclepios-project.eu/). We used qualitative analysis, based on in-depth interviews, to describe and characterize clinicians' perspectives on the requirements of cloud services for healthcare data security and privacy. We examined whether these user perspectives were in harmony with the regulatory framework of the General Data Protection Regulation (GDPR), and best practice guidelines of a relevant standard, ISO 18308:2011. Ten clinicians were identified and interviewed at six healthcare organizations in Norway, the Netherlands and Germany. While user perspectives were largely consistent with both GDPR and ISO, some concerning differences in access control were noted between large and small healthcare institutions.