A General Approach for Securely Querying and Updating XML Data

Over the past years several works have proposed access control models for XML data where only read-access rights over non-recursive DTDs are considered. A few amount of works have studied the access rights for updates. In this paper, we present a general model for specifying access control on XML data in the presence of update operations of W3C XQuery Update Facility. Our approach for enforcing such updates specifications is based on the notion of query rewriting where each update operation defined over arbitrary DTD (recursive or not) is rewritten to a safe one in order to be evaluated only over XML data which can be updated by the user. We investigate in the second part of this report the secure of XML updating in the presence of read-access rights specified by a security views. For an XML document, a security view represents for each class of users all and only the parts of the document these users are able to see. We show that an update operation defined over a security view can cause disclosure of sensitive data hidden by this view if it is not thoroughly rewritten with respect to both read and update access rights. Finally, we propose a security view based approach for securely updating XML in order to preserve the confidentiality and integrity of XML data.Comment: No. RR-7870 (2012

Message Deleted? Resolving Physician-Patient E-mail through Contract Law

This article examines the impact of e-mail on the physician-patient relationship, and how contract law can resolve the uncertainties incumbent in this nascent form of communication. Significantly, courts have yet to indicate when the physician-patient relationship begins by e-mail, or to what extent e-mail affects the duties of the relationship. Instead of waiting for judicial guidance, physicians and patients can employ specialized contracts to clarify the role that e-mail plays in their relationship. As a result, more physicians and patients will regard e-mail correspondence as a valuable means of communication, and a tool for improving the quality of health care as well

Understanding the knowledge gaps in whistleblowing and speaking up in health care: narrative reviews of the research literature and formal inquiries, a legal analysis and stakeholder interviews

BackgroundThere is compelling evidence to suggest that some (or even many) NHS staff feel unable to speak up, and that even when they do, their organisation may respond inappropriately.MethodsThe study comprised four distinct but interlocking strands: (1) a series of narrative literature reviews, (2) an analysis of the legal issues related to whistleblowing, (3) a review of formal Inquiries related to previous failings of NHS care and (4) interviews with key informants.ResultsPolicy prescriptions often conceive the issue of raising concerns as a simple choice between deciding to ‘blow the whistle’ and remaining silent. Yet research suggests that health-care professionals may raise concerns internally within the organisation in more informal ways before utilising whistleblowing processes. Potential areas for development here include the oversight of whistleblowing from an independent agency; early-stage protection for whistleblowers; an examination of the role of incentives in encouraging whistleblowing; and improvements to criminal law to protect whistleblowers. Perhaps surprisingly, there is little discussion of, or recommendations concerning, whistleblowing across the previous NHS Inquiry reports.LimitationsAlthough every effort was made to capture all relevant papers and documents in the various reviews using comprehensive search strategies, some may have been missed as indexing in this area is challenging. We interviewed only a small number of people in the key informant interviews, and our findings may have been different if we had included a larger sample or informants with different roles and responsibilities.ConclusionsCurrent policy prescriptions that seek to develop better whistleblowing policies and nurture open reporting cultures are in need of more evidence. Although we set out a wide range of issues, it is beyond our remit to convert these concerns into specific recommendations: that is a process that needs to be led from elsewhere, and in partnership with the service. There is also still much to learn regarding this important area of health policy, and we have highlighted a number of important gaps in knowledge that are in need of more sustained research.Future workA key area for future research is to explore whistleblowing as an unfolding, situated and interactional process and not just a one-off act by an identifiable whistleblower. In particular, we need more evidence and insights into the tendency for senior managers not to hear, accept or act on concerns about care raised by employe