Privacy-by-Design and Minimization within a Small Electronic Health Record: The Health360 Case Study

Round 1

Reviewer 1 Report

The paper presents a framework for data privacy in health records with some parameters. Some aspects of the paper need to be improved.

·       The abstract does not cover the background/existing methods and the need to devise new framework.

·       Neither introduction section covers the details of the state-of-the-art methods, nor a separate section is included. There should be a clear discussion of the existing works for the readers to be clear about the objectives of the proposed framework.  

·       Figures are not visible. The quality of Figures (2 and 4) needs to be improved.

·       The architecture of the framework presented in figure 2, needs discussion with respect to privacy and security which is the main objective of the framework. The same discussion on figure 4 can be covered in more detail.

·       The conclusion should cover the research directions for researchers to work further on the subject.

Author Response

We are thankful to the Reviewer for his/her constructive comments, allowing us to improve the clarity and the overall quality of the manuscript.

Please, find below the reviewer's comments (in plain text) and our response (in italics).

The paper presents a framework for data privacy in health records with some parameters. Some aspects of the paper need to be improved.

• The abstract does not cover the background/existing methods and the need to devise new framework.

Thank You. The Abstract section is, according to the Journal requirements, quite short, therefore it is often hard to condensate all the concepts there. However, the main need to implement and distribute a new framework is quite simple: large clinical centers have financial agreements with the main international players in the field of electronic health records and similar products, having the opportunity to spend significant amounts of money for purchasing products and licences and for product maintenance. Conversely, small clinical centers, without such possibilities, often collect clinical records by pen-and-paper or, for most technologically advanced centers, by Excel sheets, with then limited possibilities when it comes to data consultation and intelligent analysis. In this regard, Health360 could be an excellent solution, to provide such centers with a place where data can be inserted and stored in a safe, GDPR-compliant way, eventually consulted everytime this is needed, and featuring an excellent user experience when it comes to the ease of use and modular architectural structure. We tried to include some short tips to this extent, by adding some “key-terms” in the Abstract.

• Neither introduction section covers the details of the state-of-the-art methods, nor a separate section is included. There should be a clear discussion of the existing works for the readers to be clear about the objectives of the proposed framework.

Thank You. In the Introduction section, we added some sentences with references about the current needs from the clinical side in terms of ICT tools for data collection in light of their advantages. We used this to better specify the concept of Health360 to fill in this gap.

• Figures are not visible. The quality of Figures (2 and 4) needs to be improved.

Thank You. It looks like our file was somewhat corrupted. We double-checked all the figures and provided those indicated with higher resolution.

• The architecture of the framework presented in figure 2, needs discussion with respect to privacy and security which is the main objective of the framework. The same discussion on figure 4 can be covered in more detail.

The main objective of the framework is not solely about privacy and security, but it deals with data collection in a safe, secure, regulation-compliant manner. Dealing with the two figures above mentioned, Figure 2 is just a graphical explanation of the concept of accessibility and user-friendliness of Health360, with all the considerations about privacy and security that are spread throughout the manuscript. As for Figure 4, some more detail about the points you raised have been included in the present, revised version, and can be found in section 4.4.

• The conclusion should cover the research directions for researchers to work further on the subject.

Thank You. We agree with you and updated the Conclusion section accordingly.

Reviewer 2 Report

-- contributions are unclear, please revise, especially in the Introduction section

-- please improve the figure quality of fig. 1

-- also improve the quality of figure 4

-- I suggest revising the conclusion in order to show the findings of the study

-- is the only contribution to developing a framework for data collection?

Author Response

We are thankful to the Reviewer for his/her constructive comments, allowing us to improve the clarity and the overall quality of the manuscript.

Please, find below the reviewer's comments (in plain text) and our response (in italics).

-- contributions are unclear, please revise, especially in the Introduction section

Thank You. In the Introduction section, we better, briefly specified the actual criticisms in the field, and the contribution Health360 is expected to bring to the state-of-the-art.

-- please improve the figure quality of fig. 1

Thank You. Done.

-- also improve the quality of figure 4

Also, done.

-- I suggest revising the conclusion in order to show the findings of the study

Thank You. We revised the conclusion accordingly and also added some tips for future developments.

-- is the only contribution to developing a framework for data collection?

Thank You. Of course, it is not. However, it has unique characteristics in terms of modularity, usability, adaptability, safety and security and it plays a role to fill in the gap for data collection in small clinical centers and/or within research projects. We tried to better specify this point in the Introduction and Conclusions.