Securing Electronic Patient Health Information (ePHI): An Analysis of Data Security and Compliance with Privacy Regulations

Abstract

With the rise in need of Electronic Health Records (EHR), keeping confidentiality, integrity, and privacy intact of Patient Health Information (PHI) becomes of utmost importance, particularly while sharing via email which is inherently non-secure. The current work proposes a hybrid encryption approach on the basis of Advanced Encryption Standard (AES-256) with symmetric key cryptography and Elliptic Curve Cryptography (ECC) as asymmetric encryption. AES-256 is selected because it performs well to encrypt large datasets, and ECC provides secure key exchange and digital signature support with less computation overhead compared to RSA. The system addresses issues of key encryption, such as secure transmission of information, identification authentication, and digital signatures for message integrity.Besides AES and ECC, the system incorporates a Zero-Knowledge Proof (ZKP) protocol, enabling privacy-preserving identity authentication without exposing sensitive data. This is important in ensuring PHI protection because ZKP permits identity and message authenticity verification with private data left secure. The hybrid system is balanced between speed of encryption and security, such that it remains scalable and usable for real-time healthcare use cases. By integrating AES for quick data encryption, ECC for secure key management, and ZKP for added privacy, this solution provides an end-to-end solution for securely sending PHI through email. It successfully solves encryption issues while maintaining confidentiality, integrity, and privacy in healthcare communication without compromising efficiency. This encryption framework ensures compliance with major data privacy regulations including HIPAA and GDPR, making it applicable for real-world healthcare environments across both the U.S. and the EU.