Djoko Theresa A Pardo
email: tpardo@ctg.albany.edu

Sigit Sayogo
email: dsayogo@ctg.albany.edu

Donna S Canestraro

Computing and Information Technology Challenges for 21st Century Financial Market Regulators

Keywords: financial market, computing and information technology challenges, financial market regulators

This paper reports on a research effort designed to begin to systematically identify the most critical computing and information technology-related challenges facing financial market regulation activities. Computing and information technology adaptation in financial markets create a paradox. Information technology is needed for effective governing of financial markets, yet advances in information technology and the increasingly complex adaptations of that technology make it more difficult for regulators to have a clear picture of what is actually happening. Drawing on in-depth interviews with professionals from the financial market community, this paper outlines three primary challenges facing regulation efforts: 1) information sharing and integration, 2) mediating interrelationship among financial market constituents, 3) data-driven decision making. The paper concludes with recommendations for future research about the challenges and

Introduction

This paper delineates critical Computing and Information Technology (CTI) related challenges facing financial market regulators in 21 st century financial markets. A U.S. General Accounting Report (2009) pointed to the complexity of financial market due to new and complex financial products and large and interconnected financial institutions and conglomerates [START_REF]Bank Secrecy Act: Federal Agencies Should Take Action to Further Improve Coordination and Information-Sharing Efforts[END_REF]. The complexification of financial markets has led to intensive adaptation of advanced CTIs to improve financial market oversight mechanisms. The institutionalization of information technology transformed and changed the character and structure of financial market reflecting in the transactions processing, competition, innovation, [START_REF] Cerny | The dynamics of financial globalization: Technology, market structure, and policy response[END_REF] and also oversight. Financial market regulators as well have become increasingly dependent on computing and information technology to track, monitor, and analyze the large number of transactions in modern financial markets. Activity in and around the markets is increasingly based on data-driven decisions which rely on the use of computing and information technology.

The impact of technology depends on how it is used, regulated, and/or guided [START_REF] Barry | The Ethical Assessment of Technological Change: an overview of the issues[END_REF]. A report from a two year investigation by the Financial Crisis Inquiry Commission confirms that information technology and trading systems themselves are not the cause of the financial crisis, but the way in which technology is currently used, may be. Computing and information technology has shown its resilience toward external exposure and demonstrates great potential to complement the weakness of oversight mechanisms in expanding markets. For instance, the terrorist attack of September 11, 2001 showed the reliability of the disaster recovery capability of ICTbased financial systems [START_REF] Beck | Can IT lean against the wind?[END_REF] and the uncovering of the $64 billion Ponzi scheme by Bernie Maddoff was made possible through the use of information technology [START_REF] Hurtado | FBI Uses Triage to Shift From Terror to Madoff, Subprime Probes -Bloomberg[END_REF]. On the other hand, the increasingly complex adaptations of that technology within the financial markets make it more difficult for regulators to create the necessary policies and practices necessary to monitor financial markets. This difficulty results in mismatches in the currency of market versus oversight and surveillance systems. Testimony given by Mary Schapiro, Chair of the Security Exchange Commission (SEC), on the flash crash of May 6, 2010, outline the challenges created by such a mismatch between technologies used in the process of market oversight and surveillance and the technologies and trading systems in financial market [START_REF] Schapiro | Testimony Concerning the Severe Market Disruption on May 6[END_REF]. This situation obstructs regulators effort to develop clarity about what is actually happening. The risk of adopting new technologies is real, but often underestimated [START_REF] Werner | Calculating the Unknown. Rationalities of Operational Risk in Financial Institutions[END_REF].

This paper reports on a research project designed to begin to systematically identify the most critical computing and information technology-related challenges facing financial market regulators. Drawing on in-depth interviews with financial market professionals, this paper outlines a preliminary mapping of the most critical information technology challenges facing 21 st century financial market regulators. Subsequently, this paper outlines a preliminary research agenda for studying the impact of information technology challenges on 21 st century financial market regulation. The rest of the paper is organized as follows. Section 2 briefly draws on the relevant literature to outline known CTI related challenges to financial market regulation and what is known about the impact of those challenges. Section 3 presents the research design and methods used, section 4 presents the results as well as the practical impact of the challenges for IT professionals. Section 5 outlines an agenda for future research. Finally, section 6 provides the conclusion.

2

Literature Review

The Role of Computing and Information Technology in Financial Market Governance

Hakken (2010) proposes four instrumental roles for CTIs in financial market [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]. The first role is CTIs as the enabler of rapid development of financial product innovations that exceed the threshold of transparent and perceptible structures of financial products [START_REF] Crotty | Profound Structural Flaws in the US Financial System that Helped Cause the Financial Crisis[END_REF][START_REF] Vardi | The Financial Meltdown and Computing[END_REF]. The structure of financial products becomes so complex that assessing the transparency and risks becomes less feasible [START_REF] Zandi | Financial Shock: a 360o Look at the Subprime Morgage Implosion, and How to Avoid the Next Financial Crisis[END_REF]. The intensification of financial innovations was due to the role of CTIs in channeling and disseminating two essentials ingredients of financial products, namely: new sources of funds with low interest rates and surging demands from global investors [START_REF] Zandi | Financial Shock: a 360o Look at the Subprime Morgage Implosion, and How to Avoid the Next Financial Crisis[END_REF].

The second role is to mediate globalized markets. CTIs afforded the creation of "unboundaried market in capital" through the development of international computing networks [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]. The globalization and boundary-less capital market resulted in escalating the unpredictability and uncertainty in the markets and challenges the "subjective boundary of financial regulators [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]".

The third role is complexification of risk assessment models. The current risk-assessment models are no longer adequate to assess risks associated with rapidly developed financial innovation [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]. Hakken argues that the problem is on the tendency to perceive the result of computer-based risk assessment models as the "end" and not as "means" to judiciously aid competent professionals to assess the risks [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]. Arguably, richer information, such as: insights and expert analysis should complement computer-based-risk assessment [START_REF] Wilkinson | Financial Stability Reports: How Useful During a Financial Crisis[END_REF]. Finally, Hakken contends that CTIs contribute to making asset values more ambiguous and obscure [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF].

2.2

The Primary Functions of CTIs This section will discuss three primary functions of CTIs recognized as challenges to financial market regulators, namely: 1) information sharing and information integration, 2) interrelationship among financial market institutions, and 3) high level and complex computing to support for data-driven decision making.

Information Sharing and Information Asymmetry among Financial Market

A number of studies have shown the significant value that stems from inter-organizational information sharing in the private [START_REF] Houston | Creditor rights, information sharing, and bank risk taking[END_REF] and public sectors [START_REF] Dawes | From "Need to Know" to "Need to Share": Tangled Problems, Information Boundaries, and the Building of Public Sector Knowledge Networks[END_REF]. Interorganizational information sharing is regarded as one of the distinguishing core capabilities of modern ICTs [START_REF] Pardo | Governance structures in crossboundary information sharing: Lessons from state and local criminal justice initiatives[END_REF].

Current literature outlines three possible benefits of information sharing among actors in financial markets, 1) diminish the potential of risk taking, 2) reduce information asymmetry, and 3) improve transparency [START_REF] Houston | Creditor rights, information sharing, and bank risk taking[END_REF]. Information sharing is important in improving risk management. Information sharing provides better benchmarks for risk assessment that will influence investors' risk behavior [START_REF] Han | Innovator or owner? Information sharing, incomplete contracts and governance in financial risk management systems[END_REF]. Information sharing is also important for financial market regulators to meet the primary objectives of ensuring the safety and soundness of the financial system and protecting stakeholders [START_REF]Better Information Sharing Among Financial Services Regulators Could Improve Protections for Consumers[END_REF][START_REF]Bank Secrecy Act: Federal Agencies Should Take Action to Further Improve Coordination and Information-Sharing Efforts[END_REF].

Information sharing could also diminish information asymmetry among financial market actors. Information asymmetry emerges as a result of disconnected communication, internally or externally. A number of studies argue that information asymmetry will increase the likelihood of financial problem [START_REF] Guillén | The Global Crisis of 2007-2009: Markets, Politics, and Organizations[END_REF][START_REF] Sheng | Financial Crisis and Global Governance: A Network Analysis[END_REF]. Guillen and Suarez (2010) found that massive information asymmetry in the banking sector in the US and Europe result in decreased trust that lead to the recent financial crisis [START_REF] Guillén | The Global Crisis of 2007-2009: Markets, Politics, and Organizations[END_REF].

Interorganizational Networks

The advances of CTIs in the financial market had paradoxical impacts, creating global networking and challenging the governance and oversight mechanisms of financial markets. The potential benefits of information and communication technology to support the operation of network governance and collaboration has been highlighted in a number of studies [START_REF] Crotty | Profound Structural Flaws in the US Financial System that Helped Cause the Financial Crisis[END_REF][START_REF] Dawes | Interagency information sharing: Expected benefits, manageable risks[END_REF][START_REF] Pardo | Sustainable cross-boundary information sharing[END_REF]. The importance of network governance and collaboration is also acknowledged in the testimony of Mary Schapiro, in which she pointed out the significance of the coordination required to address inter-market manipulations and abuses and called a robust effort to build consolidated audit and tracking systems in the interconnected markets [START_REF] Schapiro | Testimony Concerning the Severe Market Disruption on May 6[END_REF].

The inter-dependency in the current financial market regulations systems challenges the adequacy of its management and governance and leads to three possible caveats. 1) Regulatory and jurisdictional overlaps among regulators, 2) Complicated risk assessment, and 3) likelihood of systemic risks. First, a number of studies point at the mismatch between the market and regulators particularly in the United States [START_REF] Guillén | The Global Crisis of 2007-2009: Markets, Politics, and Organizations[END_REF][START_REF] Sheng | Financial Crisis and Global Governance: A Network Analysis[END_REF]. Regulations in the US financial markets are divided among agencies that regulate different financial market segments. Government agencies and Self Regulatory Organizations (SROs) share regulatory responsibilities that often overlap [START_REF]Bank Secrecy Act: Federal Agencies Should Take Action to Further Improve Coordination and Information-Sharing Efforts[END_REF]. The overlapping regulations create problems since the resulting gaps in the US regulatory system can be manipulated by financial market actors. For instance, In the Senate Hearing on March 2009, Ben Bernanke stated that the crisis was also related to the fact that "AIG (The American International Group, Inc) [is able to] exploited a huge gap in the regulatory system" [START_REF] Guillén | The Global Crisis of 2007-2009: Markets, Politics, and Organizations[END_REF].

Second, networked governance increases the difficulties of predicting and assessing market risks [START_REF] Hurlburt | An Ethical Analysis of Automation, Risk, and the Financial Crises of[END_REF][START_REF] Wilkinson | Financial Stability Reports: How Useful During a Financial Crisis[END_REF]. Extensive global networks of sellers and buyers of financial products and crossborders interdependency make it virtually impossible to tracks the associated risks [START_REF] Hurlburt | An Ethical Analysis of Automation, Risk, and the Financial Crises of[END_REF]. The rapid development of financial innovation and interconnected markets can lead to gaps in tech-nologies as well used for market oversight and surveillance against the technologies and systems used in the financial market [START_REF] Schapiro | Testimony Concerning the Severe Market Disruption on May 6[END_REF].

Finally, interconnectivity increases the likelihood of systemic risks [START_REF] Hurlburt | An Ethical Analysis of Automation, Risk, and the Financial Crises of[END_REF]. The development of ICTs results in stronger global financial linkages that lead to increases in the likelihood of creating systemic risks [START_REF] Hurlburt | An Ethical Analysis of Automation, Risk, and the Financial Crises of[END_REF][START_REF] Sheng | Financial Crisis and Global Governance: A Network Analysis[END_REF]. Initial tremors in a local market could easily reverberate globally [START_REF] Hurlburt | An Ethical Analysis of Automation, Risk, and the Financial Crises of[END_REF].

Information Processing and Data Driven Decision Making

CTI development affords a high level computing and data processing which affects financial market regulators in two ways. First, regulators increasingly rely on quantitative measurement performed by "Quants1 " for oversight and decision making. Second, risk assessment becomes more complicated due to risky products. These two issues are interrelated, in the sense that both point at the complications for market oversight mechanisms and decision making for the regulators.

Complicated oversight mechanisms arguably lead to increased reliance on quantitative indicators for risk assessment and market surveillance. The limitation of increased reliance on quantitative indicators for risk assessment is the inaccuracy of models used to reflect the actual risk of a financial product or in a market. The behavior of the market is shaped by various influences, some of which are unquantifiable, these might not be fully captured in the structured data [START_REF] Mahajan | Mining Financial News for Major Events and Their Impacts on the Market[END_REF]. The computational efforts using structured data are still inadequate to capture the inherent risks in recent financial innovation and might potentially augment the cost of asymmetric information [START_REF] Arora | Computational complexity and information asymmetry in financial products[END_REF].

3

Research Design and Methodology

Research Design

This research employs semi-structured interviews and focus group discussion. This approach enabled researchers to gain in-depth understanding and experiences of knowledgeable individuals expertly involved in financial market. Five organizations and approximately 25 individuals participated in individual face to face or phone interviews and focus groups. The larger set of interviewees minimize the problematic data bias pertain to qualitative research. The bias was also reduced by the fact that the interviewees are selected from different functions and different industries in financial market.

Interview Profile

The team of researchers interviewed 25 participants encompassing various components of financial markets. Specifically, 7 participants from investment banking, 4 participants from broker-dealer units of nation-wide insurance company, one interviewee came from market analyst and research, two interviewees were from the financial guarantee industry, and 11 were from self-regulatory organizations. The interviewees described their positions as related to general counsel, compliance function, legal department, or information technology.

Interview Procedure

Each interview lasted an average of between 45 minutes for interviews and 1 hour 20 minutes for group discussion. The interviews/group discussions were conducted separately, four by a face-to-face meeting and four by phone interview. A notification by phone and email was sent to each interviewee before each interview. During the interview, the participants were presented with one major question; What are the most critical challenges facing by financial market actors in the 21 st century? After each challenge was identified, interviewees were asked to clarify and elaborate each challenge and to reflect the challenge to their organization. Subsequently, the interviewees were asked to rank the challenges according to their perceived level of importance to their organization. Although the numbers of interviewee were not large, the interviews were sufficiently in-depth thus generate a significant amount of data.

Result

Common themes across the challenges were identified from interview transcripts (See table 1). Three primary CTIs related challenges were identified. The following sub-sections discuss the challenges within each theme. Quotes from the interviews and focus groups are provided to support the theme development.

Information Sharing and Integration

The focus group discussions and interviews indicate majority agreement on the significance of information sharing issues. This analysis identified five inter-related challenges within the context of information sharing and integration (See table 1).

Disparate Legacy System

The interviewees noted that the banking industry has undergone a substantial numbers of mergers and acquisitions resulting in a number of disparate legacy systems. One interviewee from a Broker-Dealer pointed out that integrating legacy systems is a major hurdle for organizations. These efforts brought together many different firms along with their legacy systems resulting in a variety of systems that don't "talk to each other" and various "gold copies"; copies of data captured at different level and organization. This results in restrictions on information sharing and undermines efforts to eliminate inter-market manipulations. Keeping up the changes in regulations and compliance as well as new and changing privacy requirements represent the second set of major challenges. An interviewee from an investment bank notes the sheer numbers of policy changes they have to comply with -"at anytime the SROs have 2 dozens proposals to change rules". The legacy systems, onerous rules and regulations lead to difficulties in using IT to deal with compliance responsibilities. This set of conditions is a major hurdle especially for small institutions. Keeping up with the changes of regulations can be very costly and need to be budgeted well in advance.

Integrating business and technology units

The need to integrate business and technology units to support intra-organizational information sharing is another issue. The data indicates the classic case of disintegration between IT and business units. The IT people and business unit people need to, but do not, talk to each other and nor do they have a common language to faciliate information sharing. One of the interviewees emphasized "technology is there, most IT skills are there, business knowledge and experience are real challenges". A certain level of IT fluency is important. Interviewees spoke to the need for understand the role, application, and architecture of technology aoutlining s well as challenges around data quality and integrity, knowledge of the architecture of systems and work flow.

Interorganizational Network

The majority of the interviewees asserted the importance of addressing interconnectivity and interdependency among financial regulation systems. The regulation of the United States financial markets is divided among agencies that regulate the different financial market segments and often overlap. Companies engaging in multiple financial markets find themselves regulated by different institutions with different approaches to regulation. The interviewees from investment banking pointed out the duplication and overlap of regulations that result in a large number of inefficiencies and lack of coordination among the regulators. For instance, according to the interviewees, NYSE, FINRA, and SEC send very similar inquiries which require separate efforts to respond. These overlaps in regulations lead to redundancy in efforts to ensure compliance with regulations thus inducing higher costs for compliance.

Interviewees from insurance and broker-dealers, noted that interdependency sometimes creates competition within regulations/regulators. The regulators compete with each other to be the first to protect consumers, identify fraud creating inconsistencies, and appeal to the public. This competitiveness among regulatory agencies poses a problem for financial firms as they work to comply with various regulations. The financial firms often have to marry various strict rules imposed by different agencies. The overlaps in financial regulations create confusions for firms to choose which one to focus on and to follow. As an example, the interviewee from investment bank mention that "eight option exchanges have different rules, [so] which do you use as the right one in monitoring systems".

The interviewees from self-regulatory organization (SROs) also point at the same issue. The SROs highlight "reputational risk" as one of their primary risk. The reputational risks relate to the risk of being relevant to the market and risk of losing power over the market. As asserted by one of the interviewee, "I think one of the greatest challenges right now is remaining relevant, there is a lot of works going on as the result of regulatory reform…that could jeopardize the organization as the whole…is the business gonna move from cash security to swap such that SRO's B gain a lot more power and SRO's A roles are minimize". Negotiation of power and power dependencies are considered as characteristics of networked governance.

The interviewees from SROs also expressed concern about the impact of these interdependencies on the risk assessment. They especially noted concerns about future efforts of regulators to evaluate risks. Informed risk analysis is important, but in the case of networked systems, regulators, the interviewees agreed, also need to understand the interdependencies and dealing with multiple regulatory schemes. As interviewees from the SROs put it, "[it is] hard to know how firms are morphing their behaviors in areas we don't have access to…".

Information Processing and Data Driven Decision Making

One interviewee from the financial guarantee industry described the problem associated with integrated data and information sharing as "no one on the other end would know what to do with that information". Implied in this statement are the challenges of processing and interpreting the data and information. Interviewees from the investment bank, insurance companies, and broker-dealer all emphasized the increasing volume of data. They noted an exponential growth of trading information and data as result of current high-tech trading systems. This concern was found to be more imminent for financial regulators as compared to other actors of financial market.

For financial regulators, information processing involves collecting data and figuring out how to interpret it. Having large amounts of intricate financial market information leads to several possible issues for information processing. The first issue relates to the increase complexity in efforts to analyze the behavior of markets. Over the years, the regulation has changed from prescriptive to less prescriptive and become more contextual. The regulations they noted, have become too broad, too general, and offer alternatives. As result, the information collected by regulators is more complex and creates problems when analyzing market behavior and in particular when trying to understand cause and effect relationships. It is more difficult now they noted, for analysts to connect the aggressive behavior of some firms to the current economic crisis. .

The second issue relates to the difficulties of identifying the relevancy of data or information. One interviewee indicated that expanded filing requirements yields different types of information which lead analysts to question the relevancy of data. The example given by the interviewee is corporate bonds in which there is no way to differentiate among the bonds. As a result, there is different information and different granularity of data that complicates the processing of information.

The third issue noted by interviewees from self-regulatory agencies is that the limitation created by reliance on quantitative indicators or "quants" for risk assessment. "Quants" are mathematical gurus who build mathematical models to exemplify the financial risks in the financial product innovation or/and command excellent ability to perform quantitative analysis [START_REF] Salmon | Recipe for Disaster: The Formula That Killed Wall Street[END_REF]. They assert that the problem with "quants" is that "they cannot marry the practical with the theoretical". For instance, quants are concerned only with measuring quantitatively the high yield of bond market and raise concern about it. However, according to the interviewees, the quants do not connect the dots to consider about what to do with the information. This issue also points at the requirements to have integrated skills for IT professionals/graduates. Financial or information technology skill alone is not adequate to deal with the future challenges of financial market.

Discussion

As discussed above, analysis of the interviews and focus group discussions identified three primary CTI related challenges for 21 st century financial market regulators: 1) information sharing and integration, 2) mediating interrelationship among financial market constituents, and 3) data-driven decision making. The challenges also serve as the framework for the recommendations for future research presented below.

Information Sharing and Information Asymmetry

This research identified the need to foster information sharing across financial market constituents. Well-designed and executed information sharing is necessary for improving risk assessment and risk management. There is the need to have closer working relationship, discussion, and communication among financial regulators, IT professionals, and financial firms. One of the interviewees described the communication between regulators and firms that used to exist and currently missing. "regulator of the [this organization] used to come in like in 2000, they use to meet [with me] annually and then they would ask about credit default swaps and wrapping this and wrapping that…I was impressed they were asking some reasonable questions and then nothing ever happen with that sort of like their academic division…[interview result]" Disconnected communication, both internally inside organizations and externally among financial market actors could result in information asymmetry. In support to the Houston's argument [START_REF] Houston | Creditor rights, information sharing, and bank risk taking[END_REF], information sharing could diminish the information asymmetry and increase transparency among actors of financial market. Research is needed to address this situation.

Future research could address current limitations in integrating and making effective use of existing information and limitations in creating integrated communication among financial market constituents. A comprehensive understanding of the information sharing structure of the financial actors (in particular financial regulators) is needed to identify factors that can obstruct information sharing and therefore hinder effective prudential regulation, consumer protection and, in general, reduction of the systemic risks. Venue for future research could also assess the needed capabilities to foster close working relationship and communication among financial market constituents. Among others, possible sample questions that new research could explore are:

1. What kinds of information sharing mechanisms are presently used among the financial regulatory agencies? 2. What are the challenges of integrated communication and information sharing among financial market regulators/actors? 3. What kinds of capabilities are needed to have effective cross-boundary information and data sharing among financial market regulators/actors? 4. What kinds of critical success factors are required to better account for variations in the capabilities of actors in the networked financial market?

Interorganizational Network

Networks of actors that trust each other and share information are the foundation for more advanced systems of information sharing and information integration. However, governance by networks comes with problems and challenges. This research found the importance of addressing challenges of interconnectivity and interdependency particularly among financial market regulators. The interdependency could create negative impacts for financial market in the sense of 1) increase redundancy and information overlaps, 2) create competitiveness among regulators, and 3) complicate risk assessment process. This research found several avenues for future research in relation to the interdependency among financial actors. First, the concern of regulators in evaluating risk in the network system. In accord to Hakken's finding [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF], the interdependencies restrict the ability to analyze across regulators. Business is regulated by different regulators thus performing complete risk assessment require bridging the regulatory boundary. This complex network of relationships accentuates the need to evaluate the effective mechanism of collaborative network of publicprivate partnership to keep up with the rapid changes in financial innovations and regulations.

Second, interdependency might lead to competition among regulators that could create mismatch between market and regulators. Globalized financial network raise challenges to the "subjective boundary of financial regulators [START_REF] Hakken | Computing and the Crisis: The Significant Role of New Information Technologies in the Current Socio-economic Meltdown[END_REF]". Complex relationships between many semiautonomous organizations in the financial market result in competition, cross jurisdictions, and power negotiations and exploitation. Network analysis is needed to model and analyze the interactions among financial market regulators in the dynamic settings.

Third, financial market actors are connected to each other in complex social structures, locally and globally. This condition accentuates the necessity to have a deep exploration of the role of social networks to assess and representing the complexity of organizational social processes among financial market actors. Additionally, future research needs to investigate the influence of social interconnection among financial market actors in facilitating and/or inhibiting effective regulatory and supervisory systems. Thus, possible sample questions within this venue are: 1. What theories of social networks and social herding can inform research into the mechanism of interrelationship of financial market regulators/actors? 2. Does the current regulatory information sharing relationship structure pose challenges for ensuring the sound and safety of the financial system? 3. How can we model and represent the complexity of organizational and social processes that are useful for developing system for effective risks assessment and oversight mechanism in the networked financial market?

Information Processing and Data Driven Decision Making

This research found two major concerns related to information processing and computing, namely: massive volume of data and overreliance on quantitative measurement. Cutting edge computer technology affords processing of large amount of structured data through computing model. However, this research indicates that analyzing structured data is insufficient to capture the actual risk inherent in the financial market. Structured data may not be adequate to provide close approximation to the real-world scenario. This research found that data and information interpretation for risks analysis and prediction of market behavior not only requires sophisticated analysis of structured data but also complementary of richer information. Several research proposed alternative approaches aim to provide close approximation to the real-world behavior by complementing the quantitative indicators with non-quantitative indicators [START_REF] Huang | A Visualization Approach for Frauds Detection in Financial Market[END_REF][START_REF] Mahajan | Mining Financial News for Major Events and Their Impacts on the Market[END_REF][START_REF] Sheng | Financial Crisis and Global Governance: A Network Analysis[END_REF]. Nonetheless, future research is needed to assess the effectiveness of analyzing unstructured data, such as narrative reports and social media, as complementary of structured data analysis.

On the other hand, in many cases the information needed by actors in financial markets, particularly regulators, are available but not accessible in a meaningful way. A massive amount of data is sometime available, but extracting meaningful information from the data requires large effort that might not be economically or technically feasible. One issue that the interviewees pointed at is the need to have mix of skills and knowledge. For instance, business unit sometime does not have adequate skill about information technology for them to understand the challenges faced by IT units. This issue relates to the adequacy of the dimensions of capability of current college graduates and also professionals working in the financial market. College graduates might have a high ability but codified in their respective fields that restrict them to do an analysis in holistic and comprehensive way.

Conclusion

The analysis identified a set of practical implications for IT professionals and avenues for future research based on the critical CTIs related challenges identified in this preliminary research effort. Four major practical implications for IT professionals emerged from the analysis of the identified challenges. These practical implications are: 1) the need to have information and data management or strategies, 2) the important of budgeting and planning of IT expenditures, 3) the growing significance of networked governance, and 4) the increasing requirement for better monitoring and surveillance to ensure compliance.

This research was undertaken to begin to systematically identify and build new understanding of the primary CTIs challenges for financial market professionals. Three primary themes of CTIs related challenges identified in this paper are: 1) ability to facilitate information sharing and integration, 2) mediate interrelationship among financial market constituents, and 3) datadriven decision making. Four practical implications as well as four possible avenues for research related to the three primary themes of challenges emerged and are presented here as well. Considered together they create an approach for framing the research and practice challenges facing the 21 st century financial market community.

Table 1 . Impact of 21 st Century Challenges for IT Theme Challenges Potential CIO/IT function Impact

 1

	Information Sharing and Integration	 Disparate legacy sys-tem  Cost of compliance  Strict Information sharing policy  Keeping up with the	 Reconciliation of the data and system  Ensuring data quality (reliability, rele-vancy, & timeliness)  Interpreting changes in regulations  Balancing regulatory change, invest-ment plan, cost of compliance, and IT
	Interorganiza-tional network	changes in regulations  Interdependency and overlaps of financial market regulators  Managing conflict of	budget.  ICTs for network governance.  ICTs for networked risk assessment.  ICTs for collaboration, coordination, and relationship-building.
		interest

"Quants" are mathematical gurus, who build mathematical models to exemplify the financial risks in the financial product innovation[START_REF] Salmon | Recipe for Disaster: The Formula That Killed Wall Street[END_REF].


Joris Hulstijn
email: j.hulstijn@tudelft.nl

Jan Van Der Jagt
email: janvanderjagt@ziggo.nl

Pieter Heijboer
email: p-heijboer@hetnet.nl

Integrity of Electronic Patient Records

Keywords: health care information systems, information security, integrity

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Electronic Patient Records are information systems for storing and retrieving information about the medical treatment of a patient. In developing such systems, countries have come up with different solutions regarding the trade-offs between budget, usability, security and acceptance. This is far from easy [START_REF] Brennan | The biggest computer programme in the world ever. How is it going[END_REF]. Also in the Netherlands there has been much controversy surrounding the development of a national Electronic Patient Dossier (EPD). In April 2011 the Dutch First Chamber of Parliament voted against the obligatory use of the national EPD, ending a project that started in 2002 and cost about 300 million euro [START_REF] Vws | Antwoorden van de minister van VWS op de vragen van het lid Leijten (SP)[END_REF]. The main reasons for rejection were the continued controversy over the security of patient records, combined with the inability of the government to convince senators of the necessity of a system at this scale. It is expected that local EPD initiatives will continue to be developed, taking over parts of the national infrastructure This controversy shows that information security is an important concern in the development of electronic patient records, because it relates to their acceptance by the public. Public opinion is mostly concerned about privacy: are the records well protected? Of the quality aspects of security (confidentiality, integrity and availability), confidentiality therefore receives most of the attention (e.g. [START_REF] Barrows | Privacy, confidentiality, and electronic medical records[END_REF], [START_REF] Agrawal | Enabling the 21st century health care information technology revolution[END_REF], [START_REF] Guido Van 't Noordende | Security in the Dutch Electronic Patient Record System[END_REF]). Less is published about integrity of patient records: can the contents be relied upon? This is an omission, because information integrity is crucial for meeting the objectives of electronic patient records, namely to facilitate reliable exchange of information and thereby reduce the number of preventable medical errors [START_REF] Vws | Wijziging van de Wet gebruik burgerservicenummer in de zorg[END_REF]. Preventing medication errors will likely save lives and reduce health care spending [START_REF] Leendertse | Hospital Admissions related to Medication[END_REF]. Also in information security in general, there has been relatively little research on integrity, compared to confidentiality. This paper aims to address this omission.

We follow Boritz [START_REF] Biba | Integrity Considerations for Secure Computer Systems[END_REF] and define integrity as representational faithfulness: does the information stored in a system correspond to reality? Integrity concerns both accuracy and completeness and therefore timeliness too, as well as validity with respect to regulations and procedures. Integrity is therefore closely related to the notion of reliability as used in accounting [START_REF] Maines | The Nature of Accounting Information Reliability[END_REF].

When security experts or auditors assess the security of an information system, they commonly test against a norm: the reference model. In this paper we report on our experiences in developing a reference model for assessing the integrity of electronic patient records [START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF]. Usually, reference models are developed on the basis of information security guidelines like ISO 27001, NIST 800-53 or COBIT 4.1. These guidelines do mention integrity, but we found them not specific enough. In particular, on the basis of Boritz's [START_REF] Biba | Integrity Considerations for Secure Computer Systems[END_REF] characteristics, we selected all control objectives in the COBIT 4.1 guidelines which are relevant to integrity. We identified 48 of them [START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF]. However, it turned out that most of these control objectives address enabling conditions, such as base level security or auditability, but do not address integrity itself. This makes such control objectives impractical as a norm: difficult to test against. What is needed is an organizing principle to structure the reference model.

Guidelines for information security define information integrity as: -… guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity‖ [START_REF] Larry | Improving Data Warehouse and Business Information Quality[END_REF]. This shows a rather defensive approach: once information is stored reliably it should be protected to keep it that way. The well known Clark and Wilson [START_REF] Clark | A comparison of commercial and military computer security policies[END_REF] model is an exponent of this view.

In this paper, we would like to argue that such a defensive view is necessary, but not sufficient. People are bound to make mistakes. Defensive measures do nothing to detect or correct errors once they have been made. Moreover, integrity may actually be served by transparency and openness. For example, the Wikipedia model of ensuring reliability of encyclopedia entries is based on openness and feedback. Therefore we propose to use offensive measures too, which aim to enhance integrity.

Summarizing, the research questions of the paper are as follows:

1. Can we develop a security reference model specifically addressing integrity, which includes measures to both maintain and improve information integrity? 2. Can the usefulness and adequacy of such a reference model be established in a case study, namely an infrastructure for exchanging electronic patient records?

The paper is structured as follows. We will first discuss the definitions (Section 2). Then we will develop a reference model containing both defensive and offensive measures (Section 3). We illustrate the usefulness and adequacy of the reference model by analyzing the security measures proposed in the design of the Dutch National Electronic Patient Dossier (EPD), focusing on medication data (Section 4).

What are the main characteristics of integrity? Accounting practice traditionally focuses on reliability, i.e. correctness (or accuracy): does the information correspond to reality, and completeness: are all relevant aspects of reality represented? [22][15]. These concerns have been taken over in information security. Thus the ‗Code of Practice' regards integrity as -the property of safeguarding the accuracy and completeness of assets‖ [START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF]. Both correctness and completeness crucially depend on timeliness: failure to update when reality is changing leads to misrepresentation.

Information is generated from raw data by processing steps like calculation, selection or aggregation. The more processing is needed, the harder it becomes to trace representational faithfulness. Therefore the validity of information, i.e. whether it has been generated according to authorized procedures, is crucial. Consider for example the exam results in a university administration. There is no reality outside university records, which is why there is an elaborate system of procedures for submitting exam results, and segregation of duties between lecturer, student and administration. Maintaining absolute integrity is impossible. In consultation with stakeholders, tolerances must be set. For example, in a hospital, inaccuracy or incompleteness of medication data has more severe effects, than mistakes in the patient's name and address. A classification of the impact of errors leads to so called integrity levels [START_REF] Biba | Integrity Considerations for Secure Computer Systems[END_REF]. A system should be designed in such a way that components with a lower integrity level cannot compromise high integrity components.

As we stated in the introduction, we distinguish two strategies. They can now be defined more precisely. The defensive strategy is aimed at keeping the current level of integrity. The offensive strategy aims to increase the current level of integrity.

Defensive Strategy

For any information system, the data definition and information structure should follow from the underlying semantics (meaning). The semantics determines which data types make sense, which data values are accepted, and specifies relational constraints between data entries (reconciliation). For example: a date of birth is always prior to the present date, or the total amount of travel expenses aggregated over projects must be equal the total amount of travel expenses aggregated over employees. Such conditions are called integrity constraints. Integrity constraints can be formalized and automatically maintained by a database management system [START_REF] Paul | Integrity control in relational database systems -an overview[END_REF]. Automated enforcement of integrity constraints requires that users may only access the data through the automated system. This principle of encapsulation prevents improper modification. When an information system meets its integrity constraints, we say it is internally consistent. There are also constraints about the relation of the data with the external world. For instance, in a hospital there is a policy that no treatment may be started without first registering the patient's identification number. However, in this case, computer systems are unable to enforce that the number actually belongs to the patient (correctness), or that all actual treatments are being registered (completeness). When also such external demands are met, for instance by workflow procedures and verification, we obtain external consistency [START_REF] Romney | Accounting Information Systems (9th)[END_REF]. The defensive strategy can be explained with reference to the influential model of Clark and Wilson [START_REF] Clark | A comparison of commercial and military computer security policies[END_REF]. An integrity policy consists of two kinds of procedures. An integrity verification procedure (IVP) verifies whether a data set is well formed, i.e., meets the applicable integrity constraints. A transformation procedure (TP) has two functions. First, for newly entered input data, it verifies whether the data meets the applicable integrity constraints. Second, for all transformations, it will guarantee that the data will remain well formed and integrity constraints are preserved (Figure 1). The process is regulated by two kinds of rules: certification and enforcement rules. Certification is done by the user of the information: in practice the security officer, system owner or data owner. Enforcement is done automatically by the computer system (encapsulation). We follow the original numbering of the article, but for ease of explanation we use a different order of presentation.

(C1) IVPs are certified to verify the relevant integrity constraints for a given data set.

If they do, the data set is called valid. (C2) TPs are certified to be valid, i.e., each applicable TP must be shown to transform a valid data set into another valid data set. To this end, for all data sets a list of TPs which are certified for that data set is maintained. (C5) TPs which deal with newly entered input data must make sure the data respect the relevant integrity constraints, or else reject the data. (E1) The system enforces that users can't alter the data directly, but only through TPs which are certified to be valid for the relevant data set (encapsulation).

These rules can ensure internal consistency. To assure a certain level of external consistency, also the following control measures must be adopted by the organization.

(E2) The system maintains authorization tables to enforce that users can only carry out a TP on a data set for which they have been authorized. (C3) Authorization tables are certified to conform to the principle of segregation of duties. The job descriptions, roles and the specification of the segregation of duties, which are used to generate the authorization tables, are validated beforehand and formally accepted by the responsible employee. (C5') Additional verification or reconciliation procedures are implemented to ensure external consistency when new data enter into the system, as part of C5.

These certification and enforcement rules only work under certain background assumptions about the audit environment, the computer system and the employees. Some of those assumptions are already made explicit by Clark and Wilson.

(E3) All users are uniquely identified and authenticated by the system. (C4) All TPs must preserve an audit trail through logging.

(E4) The maintenance of the certification and enforcement rules themselves is subject to segregation of duties. In particular, only people authorized to certify TPs or IVPs may alter the list of data sets for which they are certified, and no person who is authorized to certify TPs may have executive rights for those TPs.

In subsequent research, more background assumptions have been added, see e.g. Adams et al [START_REF] Abrams | Report of an integrity research study group[END_REF]. We briefly list them here. (E5) Automated DBMS facilities should generate an audit trail and allow recovery of transformation procedures. (C6) Change management procedures (as in ITIL) should make sure that all changes to a computer system have been certified, and the risks addressed. (C7) Basic security measures like hardening are required. (C8) Data definitions must be maintained by the data owner.

(C9) Integrity of data from an external party must be validated before being accepted. (C10) A person must be made responsible for data quality [START_REF] Larry | Improving Data Warehouse and Business Information Quality[END_REF]. (E6) The system makes sure that an employee who is authorized by another employee, may only execute TPs on data sets for which the second employee is also authorized. (C11) A system should be available for authorized employees, when needed. This avoids a ‗shadow registrations'. (C12) Back-up and recovery measures must ensure that after a calamity the system can be restored.

Offensive Strategy

Human errors are unavoidable. An error is defined as a situation in which a planned sequence of activities does not produce the intended result, where this failure cannot be attributed to external influence [21; p 9]. There are two types of errors. The first type is misunderstanding, resulting in the sequence of activities not being executed according to plan. The second type displays a wrong understanding, resulting in the creation of a plan which is incapable of achieving the intended results [21; p 17]. Both types of error undermine the defensive strategy. For instance, errors of the first type may lead to incorrect execution of procedures. Errors of the second type lead to incorrect specification of TPs. The defensive framework cannot prevent users from omitting data, or registering data which are not externally consistent. This also applies to the data needed to preserve the framework itself, such as authorization tables. Generally, there are three ways in which humans address errors [21; p 148]. First, by exercising self control, such as the correction of typing mistakes (subconscious), or checking whether the right document is attached to an email (conscious). Second, by signals from the environment before the error has been made. We distinguish warnings from blocking functions. Blocking functions force one to perform in the right way. For instance, the wrong key won't open the door. Warnings only guarantee detection. A timely warning may allow for a recovery before any great harm is done. Third, by feedback from another person. Consider the ‗four-eyes' verification procedure, in which a colleague verifies some task before it is finalized. For instance, in pharmacies, a colleague must routinely verify whether the medication matches the prescription, before it is handed to the patient.

We have taken recommendations from the literature on information quality, such as Boritz [4; p 81-85] and English [9; p 337-339]: awareness, trust, simplicity, proactive measures and automated support tools. They will now be explained in full.

Awareness. Security policies should address integrity of data and rewarding schemes. A1. Participants should understand what is meant by integrity, its impact on the organization, and how they can improve it (awareness). [START_REF] Boritz | Managing Enterprise Information Integrity: Security, Control and Audit Issues[END_REF]; p86). A2. The primary recording of data should be given more status, reflected in rewards.

Rewards to stimulate efficiency may negatively affect quality [START_REF] Boritz | Managing Enterprise Information Integrity: Security, Control and Audit Issues[END_REF];p 80).

Trust and feedback. Many enterprises are nowadays organized as chains or networks of relatively independent organizations which need to cooperate. Business processes cut across these organizational boundaries, so they require frequent exchange of information. This requires trust. Trust is needed for cooperation [START_REF] Mcknight | Initial trust formation in new organizational relationships[END_REF]. Cooperation in turn implies that people are using each others' data, and help each other to correct or improve its quality. It is well known that feedback generated by actual usage is crucial for maintaining data quality [START_REF] Orr | Data Quality and Systems Theory[END_REF].

In organizations, trust and feedback can be influenced, for instance as follows:

T1. Resolve borderline disputes and organizational barriers between departments, for instance by frequent meetings about interoperability issues [4; p 86]. T2. When specifying integrity constraints, take all known information needs into account, also those from beyond the own organization (English 1996; p 44). This avoids organizations setting up ‗shadow administrations', which do not align. T3. Initiate frequent meetings in which all stakeholders discuss data definitions, and the required integrity level. This promotes mutual trust in the information. T4. Allow employees to participate in the design of systems and processes, to make systems easier to use and thereby make it easier to record data reliably. T5. Stimulate feedback of employees on the actual usage of the information based on the data they have recorded [START_REF] Orr | Data Quality and Systems Theory[END_REF].

Trust provides a basis for cooperation and thereby for improved integrity. However, there is also a risk of too much confidence. In our experience, people may accept poor quality data just to avoid conflicts. A healthy balance between trust and skepticism regarding the quality of data of other parties, will improve integrity of information.

Simplicity. Business process reengineering may contribute to the improvement of integrity. A simpler process will reduce the chance of making an error and will make it easier to correct detected errors. A process can be simplified by reducing the number of steps or by reducing the number of people involved. S1. Stimulate that data are actually being used: -Use it or lose it!‖ [START_REF] Orr | Data Quality and Systems Theory[END_REF]. Data which are not being used will not get feedback needed to improve accuracy. S2. Record original data in one unique location, as close to the source as possible.

Avoiding intermediate processing will avoid new errors [9; p 58]. S3. Deliver information immediately to the end-user from the system itself, to avoid information getting lost or being manipulated in between by others. S4. Make sure that procedures and agreements regarding integrity are accessible and available. Make sure users can review the data definitions of the data they use.

Proactive measures. Maintaining integrity also requires proactive efforts to verify and correct errors. P1. Make sure all entered or modified data is being verified. The lack of an explicit control in a routine procedure is a common cause of errors [21;p 59]. Verification can be achieved by the so called four-eyes principle, or by a party with an ‗opposed interest': e.g. the client verifying the quality of a service, before paying.

Controls must be integrated in the workflow. P2. Instruct employees to take each contact with a customer or end-user as an opportunity to verify data. A time-stamp of the latest modification is crucial. P3. Make sure that standards and agreements about data definitions are obeyed. Data pollution caused by not following standards is hard to clean up. P4. Repeatedly verify whether routines, procedures, protocols or controls aiming to stimulate integrity are still effective. P5. Carefully analyze all integrity related complaints, so root causes can be traced. P6. Actively search for errors and defects on a regular basis. Use data mining and data analysis tools and knowledge of the semantics (reconciliation), to detect irregularities and patterns of usage which deviate from what is to be expected.

Information System Support. Information systems themselves can also play a role in the offensive strategy, by supporting users to follow procedures. I1. Introduce additional records to a data collection to be able to determine integrity and repair data when needed. Examples are serial numbers, time stamps of the latest update, or the name of person who made the latest update. I2. Introduce functionality to support users in assessing the current level of integrity.

Examples are control totals, intuitively designed forms, or the use of colors to distinguish different risk categories. For example, in a pharmacy prescriptions for ‗dangerous' drugs can be printed on pink rather than white paper. I3. Implement opportunities for eliciting feedback in the information system, in order to relay errors to the source, and allow corrections to be made. I4. Implement warnings or signals about the current status of the integrity into the information system. I5. Record source documents (e.g. paper medicine prescriptions) electronically and make them available when access is necessary for validation.

These measures can be implemented in a Workflow Management System (WfMS).

In addition, there are many best practices regarding information systems management, such as incident management and problem management (ITIL).

I6. Set up the complaints department or the helpdesk in such a way that it gives insight in common causes of integrity related incidents (incident management). I7. Set up technical departments in such a way that they analyze common underlying root causes of incidents, and give systematic solutions (problem management).

This concludes our overview of the measures to maintain and improve integrity. These measures can be used as a reference model in an information security assessment, focusing on integrity. In our case study we discuss one such audit.

Case Study: Dutch national Electronic Patient Dossier

In this section we discuss the information integrity measures proposed in the design of the Dutch national Electronic Patient Dossier (EPD), focusing specifically on the application for exchanging medication data, the Electronic Medication Dossier (EMD). Although the national EPD has been rejected by parliament, its design does remain a representative instance of a system for electronic patient records. The purpose of this initial case study is to test the usefulness and adequacy of the reference model for assessing security measures specifically focusing on integrity, in particular the distinction between defensive and offensive measures. Proper validation would involve many more case studies, also in other domains, and should contain comparisons with other security reference models.

Research Approach

Data for the case study were collected by means of semi-structured interviews with representatives of the major stakeholders to analyze the decision making process around the Dutch national EPD, focusing on integrity aspects. We spoke with representatives of several patient organizations, physicians, pharmacies, project managers, health informatics experts and software providers. In addition, we studied the proposed architecture and security measures by means of publicly accessible data. On the basis of this we made an overview of the security measures taken or proposed in the infrastructure design. These security measures were compared with those suggested by the reference model, and compared with the concerns raised by stakeholders in the interviews. The results were validated with two security experts.

Case Description

The Dutch national EDP is being developed by NICTIZ, a subsidiary of the Dutch Ministry of Health. An electronic patient dossier (EPD) is defined in the context of this project as a collection of electronic data related to the medical treatment of a patient. An EPD is maintained by care providers for the benefit of other care providers. It differs from a Personal Health Record (PHR), which is maintained by the patient. The Dutch national EPD has two functionalities: (1) data exchange and communication between care providers related to the current joint treatment of a patient, and (2) retrieving historical patient data, recorded as a result of other current and prior treatments, to improve the current treatment of a patient .

This means that the Dutch national EPD is not unique. Many kinds of EPDs are already being used at local level, by general practitioners, pharmacies and in hospitals. The national solution was supposed to improve upon these local initiatives, because of improved scope, security, and privacy protection. Note however that these advantages are related to security, not usability or content. Content must be provided by the health professionals themselves. The main characteristics of the EPD are:

-Virtual Dossier. All patient data remain stored in the original source systems. At a central level only a reference index is being developed, which allows access to particular patient data upon request. The EPD only provides a virtual dossier. -Closed Network. Access to the EPD is only possible through a closed network, the so called AORTA (see below). All messages are being encrypted and communication over the network takes place according the HL7 standard.

-Identification and authentication. Each care practitioner needs a special identification pass to log onto AORTA. This pass contains encryption keys for authentication and secure message exchange. -Unique patient identification. Patient's records must be stored under the patient's unique citizen service number (BSN), which allows data about from different sources to be identified, and combined.

In principle, a national infrastructure set up along these lines could host several EPD services. Even at the end of the project, only two of those services were operational: the medication dossier, and the dossier for transfer of records among general practitioners, for instance after a stand-in or weekend service. In this paper we focus on the medication dossier.

The network infrastructure for information exchange between care providers is called AORTA. Each health care provider (general practitioner, pharmacy, hospital) can connect through the so called National Switchboard (LSP), mediated by so called Healthcare Information Brokers. A requirement is that the existing system has been classified as a -well maintained healthcare system‖ (GBZ). Connection of a wellmaintained healthcare system to the national infrastructure is realized through data communication networks maintained by certified Healthcare-related Service Providers (ZSP). Hospitals typically provide their own ICT services.

Previous attempts to link medical data lacked a unique way of identifying patients. The existing social security number was ‗upgraded' to citizen service number (BSN) and is now used as identification throughout the healthcare sector. The number appears on passports and identity cards, to allow authentication. The wide usage of the BSN greatly enhances integrity of the EPD: making a correct link between the patient and his or her dossier (external consistency) has become a lot easier.

Within each electronic patient dossier, NICTIZ distinguishes the following types of data, each with different requirements concerning privacy and storage period: personal data (name, address, residence), logistic data (appointments, reservations), medical data (diagnoses, lab results, x-ray images, medication), financial data (insurance, invoices) [START_REF] Nictiz | EPD Documentation[END_REF]. Clearly, these categories require different integrity levels.

The crucial data structure of the EPD is the reference index. This index keeps track of which data records about a patient are available at which source. The reference index is maintained through four basic functions: entering new data, modifying data, requesting data and protecting data. Protected data will not be exchanged over the national infrastructure. Data can be protected when a care practitioner has decided to not (yet) provide access on the basis of his or her professional secrecy, or when the patient has indicated that he does not want data to be published, for privacy reasons.

Here we see the contradictory demands of integrity and confidentiality, because this feature will harm completeness of records, and hence integrity.

Application: Electronic Medication Records

We focus on the electronic medication dossier (EMD). The functionality of this dossier is to support the medication therapy process, in particular for care outside of the hospital, shown in Figure 2. The process consists of five steps which are typically performed in a loop, until the patient has recovered. Note that although the physician is in charge and coordinates the process, all consecutive steps are performed by different actors. This may lead to problems of transfer of information and distribution of responsibilities. Only the patient is a constant factor in the process. This means that when the patient is less alert, communication problems may arise.

The first three steps involve a verification of medication safety; these steps could benefit from an EMD to reduce preventable errors. For instance, when a physician has an overview of all the drugs recently taken by a patient, she may be able to detect possibly harmful combinations. The system could also provide a warning in case of dangerous combinations, or in case of a dosage which differs from common usage. Similarly, the pharmacy could use a system like this to warn patients for medication interference, or simply refuse to provide the drugs in case of danger. As a matter of fact such warnings are already given on the basis of the local pharmacy sales data. The main rationale behind the EMD functionality is a finding of the HARM study [START_REF] Leendertse | Hospital Admissions related to Medication[END_REF], which states that out of a total of 41.000 medication-related hospital admissions each year in the Netherlands, that is about 2.4 % of all admissions, about 19.000 are preventable. The objective of the EMD is to reduce the number of such medication related incidents. The study also identified three specific risk areas: (i) Elderly patients are more likely to face medication safety problems. (ii) Some particular types of medicine have an increased likelihood of problems. (iii) Therapy loyalty, the condition of the patient and cognition are important factors.

To deal with these risk areas, a full scale national EMD may not be necessary. Other more targeted measures may be just as effective. For example, for elderly patients a physician in the role of so called care orchestrator could help to make transfers between care providers more smoothly. In fact many medication errors are related to the transition of hospital to home. However, hospitals and hospital pharmacies are not involved in the current phase of the project. For those people using the specific risky types of medicine, a paper or plastic EMD with RFID carried by the patient him or herself may be more effective. Finally, therapy loyalty and the conditions of the patient remain the responsibility of patient and physician anyway.

The medication safety functionality of the EMD was not ready at the time of the research. Despite the efforts the developers, there will always be limitations to automated medication safety verification. We list a few. First, there are fundamental technical difficulties with aligning brand names with the chemicals actually provided. A similar problem relates to communication of dosage. Currently there is no standard naming or dosing convention. Second, there are reasons the EMD may never be completely accurate or remain incomplete. Prescription and actual usage of a medication by the patient may not align, for example because the patient does not know how to administer the medicine well. The patient might have used medication which is available without prescription. Relevant data such as lab results are not provided. And finally, the medication history may be incomplete, because some EMD sources may have been temporarily unavailable, or the patient could have used his right to protect his data. For these reasons, an EMD could at best only support medication safety verification by a human (physician at prescription; pharmacist at provision; nurse or patient at administering) who must be trained to work with possible incomplete data.

Interview Results

Interviews with stakeholders revealed that there are diverging views on the EMD. Pharmacists generally welcome the initiative. Patient organizations do welcome the idea, but have doubts about protection of privacy. General practitioners generally do not trust the system, and are reluctant to use it. The main concern is that they have no control over the accuracy and completeness of the data being entered at another source. Part of this results from their training. Doctors are trained to trust only what they see in front of them. Doctors often do use local EMD initiatives, in which they are in a position to know the other participants (physicians, pharmacists), which would allow them to telephone and ask for clarification, when needed.

Testing against the Reference Model

The previous description highlights the design principles and main security measures proposed in the design of the national EPD. In a larger study, resembling an audit of the set-up of the security measures, these design principles were compared against the reference model. For details we refer to Van der Jagt and Heijboer [START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF].

Summarizing the outcomes, we could say that the Dutch National EPD does satisfy most of the defensive measures to preserve integrity. See also Van 't Noordende [START_REF] Guido Van 't Noordende | Security in the Dutch Electronic Patient Record System[END_REF] who made a survey of the security measures. In particular we mention: -the certification of information systems of care providers, before being allowed on the AORTA infrastructure. This is an example of authorization (E2), -the obligatory use of a citizen service number for unique identification of patient and record. This measure helps to ensure external consistency (C5') , -personal identification for care practitioners (E3) to enforce authorizations (E3). However, regarding the offensive measures, it appears the project has not done enough. Some user groups, in particular general practitioners, generally do not trust the reliability of the data in the system and are reluctant to use it (T3-T5). One reason is the limited functionality (S1). Moreover, electronic patient records will by nature always be incomplete and inaccurate, because patients do not always take the medicine being prescribed in the dosage being described. Physicians must therefore verify medication usage with their patients, reducing usability of the system (T2). Another important issue is trust in the procedures of other care providers, to ensure reliability of data (T1). One of the reasons is that a natural feedback-loop concerning potential errors, as would exist in a local situation by telephone, is absent (T5). Moreover, due to privacy concerns, doctors or patients can block publication of some records. It is impossible to see that some data is missing. This harms the known completeness of data, and therefore the usefulness in practice (T2).

Usefulness and Adequacy of the Reference Model

A measurement instrument such as a reference model, is useful and adequate, when its distinctions help to bring out and explain aspects of a case which are also deemed relevant by stakeholders. Our interviews showed that stakeholders, in particular general practitioners, were concerned with trust and usability of the system. The reference model, especially the chapter on trust, did reveal these doubts as potential weaknesses of the design. Similar worries also motivated the rejection in parliament. Concerning the distinction between defensive and offensive measures, we found that the defensive measures were relatively easy to assess, being specific and easily identifiable in the design specifications. The offensive measures were harder to locate. They are more about a design philosophy. This is in line with findings about assessing soft controls and organizational culture in the context of a security assessment [START_REF] Veiga | A framework and assessment instrument for information security culture[END_REF].

Conclusions

Integrity of information is crucial, in particular in healthcare. In this paper we have developed an information security reference model specifically for integrity, and applied it to electronic patient records. We addressed two research questions. 1. Can we develop a security reference model specifically addressing integrity, which includes measures to both maintain and improve information integrity? 2. Can the usefulness and adequacy of such a reference model be established in a case study, namely an infrastructure for exchanging electronic patient records? With regard to question (1), we have indeed developed a reference model, centering around the distinction between defensive measures, to preserve a given integrity level, and what we have called offensive measures, to create an environment and stimulate behavior which will increase the given integrity level.

We argue that defensive measures are necessary, but not sufficient. Humans are bound to make mistakes. Therefore one needs systematic ways of detecting and correcting errors. Feedback from the user will increase trust that errors will not go unnoticed. Especially in modern networked information systems, an important aspect of trust are the measures to ensure the integrity of data obtained from others.

With regard to question (2), our case study of the Dutch national EPD shows that most of the defensive measures have been covered in the design of the infrastructure. However, interviews show that key users do not trust the integrity of the data provided by the system, because they have no control over the provenance. They prefer local EPD initiatives in which they know participants and can trust their work. The case also highlights the trade-off between confidentiality and integrity: measures to withhold data for privacy reasons will harm completeness and reduce integrity.

This illustrates that the reference model, as developed by Van der Jagt and Heijboer [START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF], is useful and adequate for assessing integrity of patient records. Useful, because relevant stakeholder doubts about the design of the EPD were indeed brought out by the model (trust, provenance). As a matter of fact, these may have contributed to rejection of the national EPD by parliament, in addition to worries about privacy of patient records. Adequate, because the concepts in the model capture distinct aspects of reality. This is in particular true for the defensive measures concerning identification and authentication, but also for the offensive principle to capture data as close to the source as possible (S2), a key design feature of the EPD.

Figure 1 .

 1 Figure 1. Integrity policies according to Clark and Wilson [8]. Arrows depict information flow and dashed lines depict control.

Figure 2 .

 2 Figure 2. Medication Therapy Process, with potential benefit of an EMD indicated

The research in this paper was conducted as part of the graduate thesis project of Jan van der Jagt and Pieter Heijboer at the IT Auditing department of VU University, Amsterdam[START_REF] Van Der Jagt | Integriteit van Patientgegevens binnen het Landelijk EPD[END_REF].