Information Systems (IS) are vital for a wide range of applications, particularly those that prioritize safety and rely heavily on them for their effectiveness and reliability. While several advantages are associated with them, there is an increasing apprehension regarding their safety consequences. Despite extensive research and publication on the safety advantages of IS, several case studies have shown distinct, potentially life-threatening problems and safety dangers associated with IS. Accidents occur when there is a disparity between the user’s perception of the situation and the actual state of the regulated or managed process. This is remarkably accurate for accidents involving user interactions and safety information systems. To mitigate this issue, this research suggests implementing a Self-Adaptive System (SAS). This advanced technology has the potential to autonomously adapt to dynamic events and environments, thereby significantly enhancing usability and reducing user frustration. Our study, which utilized SAS software, aimed to assess the influence of user usability and frustration. In this design, the IS automatically adjusts its information content and navigation structure based on the circumstances of its use, such as compensating for user distraction. To verify the validity of our findings, we conducted a controlled experiment. The investigation aimed to determine whether an SAS, which possesses knowledge of interruptions, enhances usability and reduces frustration levels compared to non-adaptive systems (NAS). The controlled trial results indicated that individuals using the SAS exhibited better usability than those using the NAS and experienced significantly less frustration than a specific type of NAS.

CONTEXT: Assurance Cases (ACs) are prepared to argue that the system’s desired quality attributes (e.g., safety or security) are satisfied. While there is strong adoption of ACs, practitioners are often left asking an important question: are we confident that the claims made by the case are true? While many confidence assessment methods (CAMs) exist, little is known about the use of these methods in practice. OBJECTIVE: Develop an understanding of the current state of practice for AC confidence assessment: what methods are used in practice and what barriers exist for their use? METHOD: Structured interviews and an email questionnaire were used to gather data from practitioners with experience contributing to real-world ACs. Open-coding was performed on transcripts. A description of the current state of AC practice and future considerations for researchers was synthesized from the results. RESULTS: A total of n = 19 practitioners were interviewed. The most common CAMs were (peer-)review of ACs, dialectic reasoning (“defeaters”), and comparing against checklists. Some practitioners also used models to gain confidence in an AC. Participants preferred qualitative methods and expressed concerns about quantitative CAMs. Barriers to using CAMs included additional work, inadequate guidance, subjectivity and interpretation of results, and trustworthiness of methods. CONCLUSION: While many CAMs are described in the literature there is a gap between the proposed methods and needs of practitioners. Researchers working in this area should consider the need to: connect CAMs to established practices, use CAMs to communicate with interest holders, crystallize the details of CAM application, curate accessible guidance, and confirm that methods are trustworthy.

Self-adaptive systems are able to change their behaviour at run-time in response to changes. Self-adaptation is an important strategy for managing uncertainty that is present during the design of modern systems, such as autonomous vehicles. However, assuring the safety of self-adaptive systems remains a challenge, particularly when the adaptations have an impact on safety-critical functions. The field of safety engineering has established practices for analyzing the safety of systems. System Theoretic Process and Analysis (STPA) is a hazard analysis method that is well-suited for self-adaptive systems. This paper describes a design-time extension of STPA for self-adaptive systems. Then, it derives a reference model and analysis obligations to support the STPA activities. The method is applied to three self-adaptive systems described in the literature. The results demonstrate that STPA, when used in the manner described, is an applicable hazard analysis method for safety-critical self-adaptive systems.

Many primary care clinics have transitioned from paper-based record keeping to computer-based Electronic Medical Record (EMR) systems. This transition provides opportunities for computer-based data analytics in support of practice improvement and more evidence-based clinical research. Unfortunately, the data in primary care EMRs is often not readily accessible to researchers, who often have to overcome significant political, organizational and technical hurdles before gaining access to such data. As a consequence, knowledge discovery and translation has been slow and burdensome in this area. Primary care research networks (PCRN) have been proposed as a way to addressing these limitations. This paper reports on the development of a PCRN in British Columbia, referred to as SCOOP (The Social Collaboratory for Outcome Oriented Primary Care). We describe its technical architecture and draw comparisons to related and previous initiatives.

Most modern relational DBMS have the ability to monitor and enforce referential integrity constraints (RICs). In contrast to new applications, however, heavily evolved legacy information systems may not make use of this important feature, if their design predates its availability. The detection of RICs in legacy systems has been a long-term research topic in the DB reengineering community and a variety of different methods have been proposed, analyzing schema, application code and data. However, empirical evidence on their application for reengineering large-scale industrial systems is scarce and all too often "problems" (case studies) are carefully selected to fit a particular "solution" (method), rather than the other way around. This paper takes a different approach. We analyze in detail the issues posed in reengineering a complex, mission-critical information system to support RICs. In our analysis, we find that many of the assumptions typically made in DB reengineering methods do not readily apply. Based on our findings, we design a process and tools for detecting RICs in context of our real-world problem and provide preliminary results on their effectiveness.

Graphs have become increasingly popular for modeling data in a wide variety of applications, and graph summarization is a useful technique to analyze information from large graphs. Privacy preserving mechanisms are vital to protect the privacy of individuals or institutions when releasing aggregate numbers, such as those in graph summarization. We propose privacy-aware release of graph summarization using zero-knowledge privacy (ZKP), a recently proposed privacy framework that is more effective than differential privacy (DP) for graph and social network databases. We first define group-based graph summaries. Next, we present techniques to compute the parameters required to design ZKP methods for each type of aggregate data. Then, we present an approach to achieve ZKP for probabilistic graphs.

Software repositories can provide valuable information for facilitating software reengineering efforts. In recent years, many researchers have started to follow a holistic approach, considering diverse software artifacts and the links existing between them. However, when analyzing data-intensive systems, comparatively little attention has been devoted to the analysis of an important system artifact: the database. Even fewer approaches attempt to uncover facts about the evolution history of database schemas. We have developed a tool-supported method for analyzing and visualizing database schema history. This paper reports early results of applying and validating this method. We discuss our experiences to date and point out several novel research perspectives in this domain.

Automated clinical coding (ACC) transforms narrative text in clinical records into a structured form. ACC may assign unique identifiers from standard terminologies. Previous ACC research focuses on mapping narrative phrases to terminological descriptions (e.g. concept descriptions). These methods make little or no use of the additional semantic information available through topology. We investigate a token based (non-phrase based) ACC approach that exploits additional semantic information available in SNOMED CT. Our method codes tokens as SNOMED CT concepts and manipulates concepts according to linguistic structures present in narrative text. It performed well (85.6%) in a recall test and performed significantly better than MetaMap in a precision test. MetaMap correctly coded 16% and our ACC method correctly coded 30%. This paper demonstrates the viability of non-phrase based ACC methods.

Privacy preservation is important for machine learning and data mining, but measures designed to protect private information often result in a trade-off: reduced utility of the training samples. This paper introduces a privacy preserving approach that can be applied to decision tree learning, without concomitant loss of accuracy. It describes an approach to the preservation of the privacy of collected data samples in cases where information from the sample database has been partially lost. This approach converts the original sample data sets into a group of unreal data sets, from which the original samples cannot be reconstructed without the entire group of unreal data sets. Meanwhile, an accurate decision tree can be built directly from those unreal data sets. This novel approach can be applied directly to the data storage as soon as the first sample is collected. The approach is compatible with other privacy preserving approaches, such as cryptography, for extra protection.

The American Law Institute has recently published principles of software contracts that may have profound impact on changing the software industry. One of the principles implies a nondisclaimable liability of software vendors for any hidden material defects. In this paper, we describe the new principle, first from a legal and then from a software engineering point of view. We point out potential ramifications and research directions for the software engineering community.

There is a rapidly growing market for direct-to-consumer health services offered through the Internet and other information and communication technologies (ICT). Personal health information is one of the most sensitive types of data;while consumer health services have many potential health benefits, privacy advocates have warned consumers about the privacy risks associated with the indiscriminate use of direct-to-consumer services. Some tools and methods have been developed to aid consumers in assessing the privacy risk of ICT-based consumer health services. Most of these methods focus on the privacy policies published by the service provider, and are limited to a particular class of service offerings, e.g., Personal Health Records. While these methods have proven useful in gauging the apparent risk associated with certain types of services, they fall short of addressing the inherent risks of an entire spectrum of different service types. Moreover, privacy policy based risk assessment falls short of catching some of the more subtle privacy threats, such as indirect information disclosure due to targeted advertisements and social computing. This paper attempts to fill this gap by proposing a complementary tool to aid consumers in gauging the inherent privacy risks associated with consumer health services. The tool was developed based on a systematic review of the types of services and their associated privacy risks.

BACKGROUND: Tokenization is an important component of language processing yet there is no widely accepted tokenization method for English texts, including biomedical texts. Other than rule based techniques, tokenization in the biomedical domain has been regarded as a classification task. Biomedical classifier-based tokenizers either split or join textual objects through classification to form tokens. The idiosyncratic nature of each biomedical tokenizer's output complicates adoption and reuse. Furthermore, biomedical tokenizers generally lack guidance on how to apply an existing tokenizer to a new domain (subdomain). We identify and complete a novel tokenizer design pattern and suggest a systematic approach to tokenizer creation. We implement a tokenizer based on our design pattern that combines regular expressions and machine learning. Our machine learning approach differs from the previous split-join classification approaches. We evaluate our approach against three other tokenizers on the task of tokenizing biomedical text. RESULTS: Medpost and our adapted Viterbi tokenizer performed best with a 92.9% and 92.4% accuracy respectively. CONCLUSIONS: Our evaluation of our design pattern and guidelines supports our claim that the design pattern and guidelines are a viable approach to tokenizer construction (producing tokenizers matching leading custom-built tokenizers in a particular domain). Our evaluation also demonstrates that ambiguous tokenizations can be disambiguated through POS tagging. In doing so, POS tag sequences and training data have a significant impact on proper text tokenization.

Proper tokenization of biomedical text is a non-trivial problem. Problematic characteristics of current biomedical tokenizers include idiosyncratic tokenizer output and poor tokenizer extensibility and reuse. To address these problematic characteristics, we identified and completed a novel tokenizer design pattern for biomedical tokenizers. We separated a tokenizer into three components: a token lattice and lattice constructor, a best lattice-path chooser and token transducers. Token transducers create tokens from text. These tokens are assembled into a token lattice by the lattice constructor. The best path (tokenization) is selected from the token lattice, tokenizing the text. We applied our design pattern and our token transducer identification guidelines in the creation of a tokenizer for SNOMED CT concept descriptions and compared our tokenizer to three other tokenizer methods. Medpost and our adapted Viterbi tokenizer perform best with a 90.1% and 93.7% accuracy respectively.

Society faces increasing reliance on software-intensive systems to manage health services, from scheduling, billing, and patient records to the control of life-critical devices and procedures. There are important concerns about software quality, security, and privacy, user interfaces, system interoperability, process automation and improvement, and many other issues of current concern to software engineering practitioners and researchers. It is widely recognized that information and communication technologies (ICTs) will transform healthcare of the future, being a driving force for improving care and access, while reducing the overall cost when broadly calculated based on overall productivity and quality of life.

Social computing is a relatively new approach to systems design that emphasizes the importance of facilitating collaboration and communication between users. Although social networking is now part of mainstream culture, the use of these applications in the health care space is still in its infancy in Canada. As major vendors are preparing to enter the marketplace, it is important for a wide variety of stakeholders to discern the ramifications of this next wave of technological innovation. This paper discusses social networking applications for health care, and the challenges of dealing with this new type of information management system under current Canadian law. While regulatory authorities have considered the privacy and security implications of social networking in the course of investigating complaints, this paper contains the first explicit analysis of the legal difficulties surrounding the use of social networking for health care applications in Canada. Those risks not covered by the current regulatory framework are assessed from the standpoint of privacy-by-design, as we discuss how software developers can build privacy protection into social networking applications.

Large-scale software systems must adhere to complex, multi-lateral security and privacy requirements from regulations. It is industrial practice to define such requirements in form of natural language (NL) documents. Currently existing approaches to analyzing NL confidentiality requirements rely on a manual linguistic transformation and normalization of the original text, prior to the analysis. This paper presents an alternative approach to analyzing requirements by using semantic annotations placed directly into the original NL documents. The benefits of this alternative approach are twofold: (1) it can effectively be supported by an interactive annotation tool and (2) there is a direct traceability between annotation structures and the original NL documents. We have evaluated our method and tool support using the same real-world case study that was used to evaluate the earlier linguistic approach. Our results show that our method generates the same results, i.e., it uncovers the same problems.

Computer-based clinical decision support (CDS) contributes to cost savings, increased patient safety and quality of medical care. Most existing CDS systems are stand-alone products (first generation) or part of complete electronic medical record packages (second generation). Experience shows that creating and maintaining CDS systems is expensive and requires effort that should be economized by sharing them among multiple users. It makes good economic sense to share CDS service installations among a larger set of client systems. The paradigm of a service-oriented architecture (SOA) embraces this idea of sharing distributed services. Some attempts making CDS services available to distributed health information systems exist. However, these approaches have not gained much adoption. We argue that they do not provide a sufficient level of decoupling between client and CDS in order to be broadly reusable in SOAs. In this paper, we present a new CDS service component called EGADSS, which has been designed and implemented with the declared objective to minimize the coupling between client and CDS server. We present our key design decisions, which are guided by empirical research in SOA development. We evaluate our result theoretically by measuring the level of decoupling achieved compared to existing CDS approaches. Furthermore, we report on an empirical evaluation of the resulting design, integrating the EGADSS service with an example client system.

OBJECTIVES: As patient care becomes more collaborative in nature, there is a need for information technology that supports interdisciplinary practices of care. This study developed and performed usability testing of a standalone computer-based information tool to support the interdisciplinary practice of palliative severe pain management (SPM). DESIGN: A grounded theory-participatory design (GT-PD) approach was used with three distinct palliative data sources to obtain and understand user requirements for SPM practice and how a computer-based information tool could be designed to support those requirements. RESULTS: The GT-PD concepts and categories provided a rich perspective of palliative SPM and the process and information support required for different SPM tasks. A conceptual framework consisting of an ontology and a set of three problem-solving methods was developed to reconcile the requirements of different interdisciplinary team members. The conceptual framework was then implemented as a prototype computer-based information tool that has different modes of use to support both day-to-day case management and education of palliative SPM. Usability testing of the computer tool was performed, and the tool tested favorably in a laboratory setting. CONCLUSION: An interdisciplinary computer-based information tool can be developed to support the different work practices and information needs of interdisciplinary team members, but explicit requirements must be sought from all prospective users of such a tool. Qualitative methods such as the hybrid GT-PD approach used in this research are particularly helpful for articulating computer tool design requirements.

Clinical decision support systems (CDSS) can significantly increase the quality of care while decreasing cost and effort. They are difficult to develop and most existing systems are proprietary, tightly integrated with specific electronic medical record (EMR) systems, and expensive to own. EGADSS is an open-source CDSS that has been developed as a standalone, standards-based, re-usable component to make decision-support available for any EMR. In order to realize this vision, the EGADSS team has had to develop an open interface for medical data exchange, which maximizes interoperability, simplicity and standardconformance. This paper reports on a solution to this challenge based on the HL7 Clinical Document Architecture (CDA) and the electronic medical summary standard. CDA-based medical summaries are used to encapsulate virtual medical records about patients that serve the DSS component as temporary databases. We show how these temporary databases can be queried from within Arden syntax-based guidelines in a standard query language. Moreover, we show how the CDA can be used to communicate CDSS alerts and recommendations back to the EMR. We report on our evaluation with a prototype implementation and compare it with alternative approaches.

There is a growing concern to ensure personal information is protected in the emerging information society, and this can be attributed to the increasing incident of identity theft and confidentiality breach. There are also potential risks associated with mishandling personal information in the healthcare sector, for example, medical conditions, which should remain confidential, can be disclosed to unauthorized persons, subsequently leading to negative social and psychological effects on the affected individuals. Many governments and international agencies have developed legislations and guidelines to prevent misuse of personal information by organizations in their jurisdictions. However, there is a challenge in properly integrating the complex nature and interaction of confidentiality concerns in many information systems. This is because the concerns involve multiple interests - the data owner, the data custodian, potential users of the system, as well as government agencies, and they can be conflicting. In addition, the requirements are usually specified in free text form, which can be ambiguous and difficult to translate to software systems. A better understanding of confidentiality requirement properties will assist information system designers and developers in specifying and analyzing the requirements, and ultimately result in good "confidentiality-aware" systems. This research is aimed at developing an approach for improved specification, modelling and analysis of confidentiality requirements. In this paper, we describe the study to identify key confidentiality properties, which will enable precise specification of confidentiality requirements

The key objective of this workshop is to explore innovative approaches to the adoption of software engineering tools and practices-in particular by embedding them in extensions of Commercial Off-The-Shelf (COTS) software products and/or middleware technologies. The workshop aims to advance the understanding and evaluation of adoption of software engineering tools and practices by bringing together researchers and practitioners who investigate novel solutions to software engineering adoption issues.

Modernizing heavily evolved and poorly documented information systems is a central software engineering problem in our current IT industry. It is often necessary to reverse engineer the design documentation of such legacy systems. Several interactive CASE tools have been developed to support this human-intensive process. However, practical experience indicates that their applicability is limited because they do not adequately handle imperfect knowledge about legacy systems. In this paper, we investigate the applicability of several major theories of imperfect knowledge management in the area of soft computing and approximate reasoning. The theories are evaluated with respect to how well they meet requirements for generating effective human-centred reverse engineering environments. The requirements were elicited with help from practical case studies in the area of database reverse engineering. A particular theory called "possibilistic logic" was found to best meet these requirements most comprehensively. This evaluation highlights important challenges to the designers of knowledge management techniques, and should help reverse engineering tool implementers select appropriate technologies.

The omnipresence of the Internet and the World Wide Web (Web) via phone lines, cable-TV, power lines, and wireless RF devices has created an inexpensive media for telemonitoring and remotely controlling distributed electronic appliances. The great variety of potential benefits of aggregating and connecting embedded systems over the Internet is matched by the currently unsolved problem of how to design, test, maintain, and evolve such heterogeneous, collaborative systems. Recently, component-oriented software development has shown great potential for cutting production costs and improving the maintainability of systems. We discuss component-oriented engineering of embedded control software in the light of emerging requirements of distributed, net-centric systems. Our approach is baed on applying the graphical specification language SDL for composing complex networks of embedded software components. From the SDL specification, we generate internet-aware connector components to local embedded controller networks. The described research is carried out in a collaborative effort between industry and academia.

Information systems have to evolve continually in order to keep up with emerging requirements. Various problems arise with each such evolution step, e.g. the modification of the application's conceptual data structure, the migration of existing data, the adaption of application code, and the modification of technical documentation. Most database systems provide only limited support for schema evolution while problems like data migration and application migration are tackled manually by the programmers. This evolution process is unsatisfactory for a number of novel complex evolutionary information systems (CEIS) in the area of business and engineering applications. The paper describes our experiences with a case study in developing a CEIS in the domain of analysis and design of mixed signal printed circuit boards. We show that a meta schema approach combined with a well defined set of schema transformations is a practical way to cope with evolution. Based on this case study, we distinguish application specific from reusable architectural components and propose a systematic approach of building CEIS.

Object-oriented technology has become mature enough to satisfy many new requirements coming from areas like computer-aided design (CAD), computer-integrated manufacturing (CIM) or software engineering (SE). However, a competitive information management infrastructure often demands the merging of data from CAD, CIM or SE systems with business data stored in a relational system. In addition, complex dependencies between those data stored in the different systems might exist and should be maintained. One approach for seamless integration of object-oriented and relational systems is to migrate the data (and the corresponding schema) from a relational to an object-oriented system. In this paper, we describe an integrated design environment that supports the migration process and overcomes the major drawbacks of comparable approaches.