1. Sensor Systems for Monitoring Congestive Heart Failure: Location- based Privacy Encodings Edmund Seto, Posu Yan, Ruzena Bajcsy University of California, Berkeley TRUST Autumn 2011 Conference November 2, 2011

2. Congestive Heart Failure  Inability for the heart to pump enough blood to the rest of the body.  Cardiovascular disease is the #1 killer in the U.S.  Approximately 5.7 million Americans have Congestive Heart Failure.  Each year 670,000 Americans will be newly diagnosed with CHF.  The estimated direct and indirect cost of CHF in the U.S. for 2009 is $37.2 billion.

3. Congestive Heart Failure  CHF is a chronic disease  Treatable  Medications  Lifestyle changes (diet, smoking, physical activity, weight, etc.)  Frequent monitoring (every 3-6 months w/doctor)  Attention to symptoms (cough, fatigue, weight gain, swollen feet)  Telemonitoring  Systematic review by Louis, et al., 2003  18 observational studies and 6 randomised controlled trials  Findings suggest telemonitoring benefits:  Early detection of deterioration  Reduce readmission rates  Reduce length of hospital stay  Reduce readmissions  Reduced mortality

4. Case Study: Congestive Heart Failure Mobile device GPS Accelerometer BT digital scale BT blood pressure Data sent to server at Vanderbilt Patient receives regular feedback messages

5. Privacy Considerations Device security (authentication, device loss, etc.) Wireless security (eavesdropping, DoS, Phishing, etc.) Data security (encryption, access rights, audit trails, etc.) Privacy policies – Patients control their data – Some potential benefits to sharing their data – But, also some potential risks to sharing their data

6. Secure Communication Framework for Networked Tele-Health Applications Aaron Bestick, Posu Yan, Ruzena Bajcsy

7. Defining Contextual Exposure For example, doctor may be interested in: Where is patient getting physical activity? Where is patient having high blood pressure? Where is patient having lunch?

8. Elaboration on contextual exposure Problem: Where is patient getting physical activity? “Physical activity” defined by p(t) (e.g., physical activity obtained from accelerometry) “Where” defined by x(t) (e.g., location obtained from GPS) Hence: x(t) for all t when p(t)>threshold intensity of activity Furthermore: g(x(t)) = places (e.g., parks, schools, home, etc.) and… Σ g(x(t)) / T (i.e., proportion of monitoring period that exposure occurred)

9. Privacy of Inferred Context Location of home, work, etc.

10. Introduce random error

11. Aggregation (1 km)

12. Aggregation (2 km)

13. Model of the patient What might influence a patient’s encoding decisions? Risk adversity (cost) – Less data shared, the lower the privacy risk – Factors in various aspects of “trust” (of their physician, the network, data security, laws, etc.) Possible reward – Sharing more data, might lead to better care … and obviously, these vary between individuals

14. Model of the doctor What might influence a doctor’s perspective on encoded data? Generally more detailed data is better than less Up to a point (saturation) … and presumably, less variation between doctors (e.g., standard treatment protocols)

15. Privacy in the Federal Health IT Plan: a Game Theoretic Approach Daniel Aranki, Ruzena Bajcsy What is the optimal “move” of the device?

16. Future work Finish implementation of the recipe architecture, including the collaboration server User studies to define useful encodings User studies to define utility functions Analyze (and optimize) the patients’ decisions by extending this framework to consider various privacy and security threats. THANKS!