School of Informatics

Recent research have proposed a link between two large theoretical bodies, namely the Construal Level Theory (CLT) and the Dual Process Theory (DPT). The proposed connection is that DPT systems share characteristics with CLT constructs; that systems operate at different levels of abstraction. While these claims have been made, there has been no direct attempt to scrutinize the implication. The hypothesis that a link between these theories exists is examined empirically in this paper. We investigate whether people respond in a DPT system specific way when primed with different levels of construal. 89 high school students were primed with different levels of construal and performed binary choice judgments of either easy or hard difficulty. We expected that the percent of correct judgments that participants made while primed with a lowlevel construal would be higher than participants primed with a high-level construal, in the easy condition. Conversely, we expected that the percent of correct judgments that participants made while primed with a high-level construal would be higher than participants primed with a low-level construal, in the hard condition. The results indicate that there is no such connection. We discuss whether this result is due to diminishing priming and/or a failure to replicate other studies.

Based on the findings of the Ingroup Allocation Model (IAM), which suggests that people use evaluative communication to form and maintain groups and as a result increase the individuals' inclusive fitness, we present the Dark Past & Bright Future (DPBF) hypothesis.

To be efficient and patient focused, healthcare units need to be process oriented and integrated with the processes and IT systems of other healthcare units. A process manager facilitates integration of different systems by using graphical and executable process models. The process manager also communicates directly with healthcare personnel via desktop computers and mobile devices. This article reports on a Swedish project where a prototype system was developed and tested with several healthcare units. The experience shows several advantages and opportunities. For example, current information about patients can be transferred automatically between healthcare units; resource intensive manual tasks can be replaced with automated tasks; and long-term process monitoring and quality assessment can be enabled. However, introducing a process manager requires attention to issues of security, ethics and legality. Healthcare units may also show differences in security awareness and IT maturity, which could obstruct the introduction of a process manager.

In the context of information systems and information technology, information security is a concept that is becoming widely used. The European Network of Excellence INTEROP classifies information security as a nonfunctional aspect of interoperability and as such it is an integral part of the design process for interoperable systems. In the last decade, academics and practitioners have shown their interest in information security, for example by developing security models for evaluating products and setting up security specifications in order to safeguard the confidentiality, integrity, availability and accountability of data. Earlier research has shown that measures to achieve information security in the administrative or organisational level are missing or inadequate. Therefore, there is a need to improve information security models by including vital elements of information security. In this paper, we introduce a holistic view of information security based on a Swedish model combined with a literature survey. Furthermore we suggest extending this model using concepts based on semiotic theory and adopting the view of an information system as constituted of the technical, formal and informal (TFI) parts. The aim is to increase the understanding of the information security domain in order to develop a well-founded theoretical framework, which can be used both in the analysis and the design phase of interoperable systems. Finally, we describe and apply the Information Security (InfoSec) model to the results of three different case studies in the healthcare domain. Limits of the model will be highlighted and an extension will be proposed.

In healthcare, patient information is a critical factor. The right information at the right time is a necessity in order to provide the best possible care for a patient. Patient information must also be protected from unauthorized access in order to protect patient privacy. It is furthermore common for patients to visit more than one healthcare provider, which implies a need for cross border healthcare and continuity in the patient process.

In healthcare, patient information is a critical factor. The right information at the right time is a necessity in order to provide the best possible care for a patient. Patient information must also be protected from unauthorized access in order to protect patient privacy. It is furthermore common for patients to visit more than one healthcare provider, which implies a need for cross border healthcare and continuity in the patient process.

Enterprise systems interoperability is impeded by the lack of a cohesive, integrated perspective on non-functional aspects (NFA). We propose to respond to the fragmentation in NFA research by supporting a shared, common understanding. For this purpose:-first, we propose a common NFA ontology, which generalizes and integrates the different non-functional aspects under a common top-level ontology. Second, we introduce a series of specialized ontologies on specific non-functional aspects, such as trust, risk, privacy, threat and misuse. By fostering a consensual and shared view of the non-functional aspects domain, we aim to move closer to enhancing semantic enterprise interoperability. This shared perspective on what non-functional aspects are and how they relate to the other 'functional' aspects of enterprise systems, is the key towards enterprise interoperability.

In healthcare, patient information is a critical factor. The right information at the right time is a necessity in order to provide the best possible care for a patient. Patient information must also be protected from unauthorized access in order to protect patient privacy. It is furthermore common for patients to visit more than one healthcare provider, which implies a need for cross border healthcare and continuity in the patient process.

Background: Community-based primary care focuses on health promotion, awareness raising, and illnesses treatment and prevention in individuals, groups, and communities. Community Health Workers (CHWs) are the leading actors in such programs, helping to bridge the gap between the population and the health system. Many mobile health (mHealth) initiatives have been undertaken to empower CHWs and improve the data collection process in the primary care, replacing archaic paper-based approaches. A special category of mHealth apps, known as mHealth Data Collection Systems (MDCSs), is often used for such tasks. These systems process highly sensitive personal health data of entire communities so that a careful consideration about privacy is paramount for any successful deployment. However, the mHealth literature still lacks methodologically rigorous analyses for privacy and data protection. Objective: In this paper, a Privacy Impact Assessment (PIA) for MDCSs is presented, providing a systematic identification and evaluation of potential privacy risks, particularly emphasizing controls and mitigation strategies to handle negative privacy impacts. Methods: The privacy analysis follows a systematic methodology for PIAs. As a case study, we adopt the GeoHealth system, a large-scale MDCS used by CHWs in the Family Health Strategy, the Brazilian program for delivering community-based primary care. All the PIA steps were taken on the basis of discussions among the researchers (privacy and security experts). The identification of threats and controls was decided particularly on the basis of literature reviews and working group meetings among the group. Moreover, we also received feedback from specialists in primary care and software developers of other similar MDCSs in Brazil. Results: The GeoHealth PIA is based on 8 Privacy Principles and 26 Privacy Targets derived from the European General Data Protection Regulation. Associated with that, 22 threat groups with a total of 97 subthreats and 41 recommended controls were identified. Among the main findings, we observed that privacy principles can be enhanced on existing MDCSs with controls for managing consent, transparency, intervenability, and data minimization. Conclusions: Although there has been significant research that deals with data security issues, attention to privacy in its multiple dimensions is still lacking for MDCSs in general. New systems have the opportunity to incorporate privacy and data protection by design. Existing systems will have to address their privacy issues to comply with new and upcoming data protection regulations. However, further research is still needed to identify feasible and cost-effective solutions.

To address the research gap on age-based differences in health information literacy (HIL), we investigate how younger (born 1960-) and older adults (1946-1960), and elderly citizens (-1945) differ from each other by their HIL competencies. Data were collected with an online survey of patients using the Swedish national electronic health record system. Altogether 2587 users responded. One-way ANOVA with post hoc tests revealed several differences between the groups: younger adults were less likely to value health information than older adults; older adults and elderly were least likely to compare information from multiple sources and had trouble in determining health information needs; older adults were most likely to have trouble understanding health terminology and the elderly to have difficulties in understanding medicinal package labels. The study shows that HIL is not necessarily improving or declining but adapting to challenges of advanced age.

This study explores patients’ perspectives on sharing their personal health data, which is traditionally shared through discussions with peers and relatives. However, other possibilities for sharing have emerged through the introduction of online services such as Patient Accessible Electronic Health Records (PAEHR). In this article, we investigate strategies that patients adopt in sharing their PAEHR. Data were collected through a survey with 2587 patients and through 15 semi-structured interviews with cancer patients. Results show that surprisingly few patients share their information, and that older patients and patients with lower educational levels share more frequently. A large majority of patients trust the security of the system when sharing despite the high sensitivity of health information. Finally, we discuss the design implications addressing identified problems when sharing PAEHR, as well as security and privacy issues connected to sharing.

Healthcare is an information-intensive activity involving the collection, communication and display of large amounts of information. This information is highly sensitive and most countries have special legislation to prevent its misuse. Hence, it is natural to use the support of computers in order to efficiently improve such an information-intensive organization. The increased use of computers for handling the information also gives access to information held in databases in a way that was previously impossible [21]. Swedish healthcare has gone through an efficiency improvement the last few years but it will also face major challenges and changes in the years to come.

Bring Your Own Device (BYOD) is an emerging research area focusing on the organisational adoption of (primarily mobile) devices used for both private and work purposes. There are many information security related problems concerning the use of BYOD and it should therefore be considered an issue of strategic importance for senior managers. This paper presents a systematic literature analysis using a BYOD strategic management framework to assess developing research trends. The analysis reveals early work in the analysis and design aspects of BYOD strategies, but a lack of research in operationalizing (planning, implementation and evaluating) strategy – the action phase. The resulting research agenda identifies twelve management issues for further research and four overall research directions that may stimulate future research.

Healthcare is very information-intensive. Hence, it has become necessary to use the support of computers in order to efficiently improve such an information-intensive organisation.This thesis points out deficiencies in the area of information security in home healthcare regarding personal integrity and secrecy. Home healthcare is, in Sweden, performed by the municipalities. The work is based on the recommendations and common advice for processing of personal data compiled by the Data Inspection Board. Two municipalities in the Vastra Gotaland Region have been investigated. One of the municipalities has a manual system and the other has a computerized system for personal data management.The work includes a field study where persons from both municipalities have been observed. It also includes interviews based on the comprehensive questions from the Data Inspection Board and questions arisen from the observations.The work shows that a very clear need of training among personnel involv...