Tattooing: one step closer to secure health data

The name on the X-ray film is not enough to ensure the correct association between X-ray and patient, or to reallocate a misplaced film to its intended recipient. A malicious person or an administrative error can lead to a regrettable exchange between two patients. Medecom and researchers at IMT Atlantique, part of the Carnot institute Télécom & Société numérique, are therefore working on a more secure system based on the tattoo principle. The two organizations have been collaborating on this technology for over ten years, and four years ago launched the SePEMeD joint laboratory on the subject, supported by the French National Research Agency (ANR). Since then, the maturity and viability of tattooing have become increasingly concrete.

Secret message

" Tattooing borrows from the principle of steganography, the art of hidden writing, which is almost as old as cryptography," explains Gouenou Coatrieux, a researcher in image and information processing at IMT Atlantique. " In the case of X-rays, we modify certain pixels of the image to hide a message, thus leaving an invisible mark," he continues. The advantage of watermarking is that the protection is independent of the storage format. X-rays can therefore be exchanged between departments, or between different hospital structures, each with a different X-ray processing system, without affecting the tattoo, which will continue to contain the patient's information.

In addition to traceability, tattooing has two other advantages. Firstly, it can be used to detect insurance fraud. If an X-ray is altered by a malicious individual, to simulate a pathology for example, the secretly tattooed pixels will also be altered, betraying the attempted fraud. Secondly, tattooing can be carried out on data that has already been encrypted, thanks to a method patented by Medecom and IMT Atlantique. This makes it possible to ensure traceability while maintaining the confidentiality of the medical information contained in the image. It also makes it possible to write information on the access rights of certain doctors directly onto the encrypted data.

Towards standardization?

Although tattooing technology is now mature, it still has to pass the standardization stages before it can be implemented in the software and IT systems of healthcare professionals. " Our objective now is to show that image modification by tattooing has no impact on image quality or on the diagnostic capacity of practitioners", confides Michel Cozic, Medecom's R&D Director. The SePEMeD team is therefore committed to conducting qualitative studies on tattooed data with doctors.

At the same time, we need to convince certain healthcare professionals of the benefits of tattooing. The protection of personal data, and in particular medical data, is not uniformly taken into account in the healthcare world. " In hospitals, professionals tend to believe that the environment is necessarily secure, which is not always the case," points out Michel Cozic. In France, and more generally in Europe, attitudes to data security are changing. The new general regulation on personal data protection (RGPD) introduced by the European Commission is proof of this. However, it will still be some time before the entire medical community takes data protection into account in a systemic way.

Ten years of research... and ten more?

Because there's still a long way to go before tattooing is used by all healthcare professionals, the SePEMed story continues. Created in 2014 to bring to fruition a collaboration between IMT Atlantique and Medecom that has lasted for over ten years, SePEMeD was originally intended to last just three years. However, following the success of its research, which is leading to promising applications, this first joint laboratory to be accredited by the ANR in the field of data security will continue its roadmap until at least 2020. In addition to data traceability, SePEMeD is also looking at securing the remote processing of images stored in encrypted form in the cloud.

" Our areas of work are updated in line with our results," emphasizes Gouenou Coatrieux, giving meaning to the SePEMed laboratory's extension. An observation shared by Michel Cozic: " At present, we're focusing our research on questions of data access by browsers, and the integration of watermarking modules into existing products used by professionals. " Compatibility of the algorithms with the configurations and IT systems of healthcare facilities will indeed be one of the major challenges for the adoption of the technology. And last but not least, the ergonomics of use. " Nobody wants to have to enter passwords into software ", rightly observes Medecom's R&D Director. So we need to succeed in integrating tattooing as a transparent security solution for practitioners.

The advantage of working with IMT Atlantique: "It's also about people".

One of the objectives of the Carnot Télécom & Société numérique institute is to professionalize relations between companies and researchers. Michel Cozic, R&D Director at Medecom, explains: " Collaboration is also about people. With IMT Atlantique, exchanges go very well, we understand each other. On both sides, we accept each other's differences, constraints and compromises. We come from two different environments, and that means discussions. There has to be trust, understanding and a common understanding of interests. And that's what we've managed to create with the SePEMeD laboratory."