Meeting Healthcare Security Standards: From Legal Requirements to Technical Implementation
Ambre Journot¹, Karima Boudaoud², Christian Delettre³
¹ Université Côte d’Azur – Laboratoire I3S-CNRS, Sophia Antipolis, France (Email: ) ² Université Côte d’Azur – Laboratoire I3S-CNRS, Sophia Antipolis, France (Email: ) ³ Deltekzen, Valbonne, France (Email: )
DOI: https://doi.org/10.48545/advance2025-fullpapers-3_1
Abstract
Ensuring the security of healthcare data continues to pose a significant challenge, particularly for professionals operating beyond the confines of institutional frameworks. Existing tools frequently prove inadequate in meeting the regulatory requirements and usability expectations of these practitioners. This paper undertakes a comprehensive analysis of the legal and normative framework governing the protection of sensitive medical information. The analysis culminates in the derivation of a set of essential criteria that any compliant and practical solution must fulfill. We then proceeded to evaluate several secure messaging and health-focused platforms, highlighting their limitations with respect to these criteria. To address these criteria, we introduce U-HealthSec, an architecture is designed to ensure strong data protection while remaining accessible to non-expert users. U-HealthSec integrates established cryptographic methodologies and security protocols with regulatory compliance, thereby addressing the operational and legal requirements of healthcare professionals in a comprehensive and scalable manner.
Keywords
Medical data security; End-to-end encryption (E2EE); GDPR compliance; Attribute-Based Keyword Search (ABKS); Secure file sharing; Health information systems; Privacy-by-design; Authentication (OAuth2, MFA); Healthcare compliance; Independent practitioners; HDS hosting; Data minimization; Auditability and non-repudiation