BMC Genomics 2006, 7:93 http://www.biomedcentral.com/1471-2164/7/93 patient's specific document, or a piece of a patient's docu- ment. Authorized users accessing the system via the PingTalk API will view the existence and content of only authorized data thanks to the permission filtering of the GenePING server. Note also that the document filtering capability described earlier is responsible for obfuscating the pres- ence of certain granular datapoints (e.g. SNPs) from users authorized to read some of these datapoints but not oth- ers. Internal individuals who surreptitiously access raw PING storage are thwarted by the combination of encrypted content and obfuscated block names. Without the appro- priate cryptographic key material, they cannot make sense of the stored data beyond the aggregate size of all stored records on the system. Limited capabilities as a security feature It is often forgotten that the more features a system has, the more security issues it must handle. In particular, one major threat posed by internal operators of a health-care system is the capability to perform aggregate data queries, e.g. a query that determines all patients with a particular mutation. Importantly, such a feature for aggregate query- ing is not part of the GenePING scope. Thus, GenePING is designed such that aggregate opera- tions are not offered at the API level. In addition, even with the cryptographic key material, it would be difficult to perform these aggregate queries, given that GenePING's index structure is, itself, encrypted. Navigating the data is efficient only when accessing a particular document of a particular patient's record. With a limited API and an internal structure that specifi- cally makes aggregate queries difficult, GenePING is more secure from such threats. Conclusion GenePING's core mission is to securely store personal health information and efficiently share it among author- ized health care providers. It may also serve to enable the creation of cohorts of genomic "information altruists" [23] who are willing to share some but not all their clini- cal and genomic personal characteristics. The system is accessible rapidly enough to provide emergency care, yet securely enough to protect patients' privacy in reasonably practical scenarios. With the rise of genome data in clini- cal decision making, services like GenePING will become a necessity. Availability & requirements Project name: GenePING Project home page: http://ping.chip.org/genepinghtml Operating system(s): platform independent. GenePING has been tested on Linux, Windows, and Mac OS X. Programming language: Java 1.4. Other requirements: requires free/open-source Java tools JAXB 1.0.2 and Tomcat 4. License: GNU LGPL Any restrictions on use by non-academics: None. Abbreviations • PING: Personal Internetworked Notary and Guardian MAC: Message Authentication Code. HMAC: Hash-function Message Authentication Code. AES: Advanced Encryption Standard. CBC: Cipher-Block Chaining mode. Authors' contributions IK and BA designed the GenePING architecture. BA imple- mented all GenePING extensions to PING. Acknowledgements Supported by the National Library of Medicine through contracts N01-LM- 3-3515 and N01-LM-9-3536. References 1. Kaback MM: Population-based genetic screening for reproduc- tive counseling: the Tay-Sachs disease model. European Journal of Pediatrics 2000, 159(15):S192-S195. 2. National Institutes Of Health Consensus Development Conference Statement on Genetic Testing for Cystic Fibrosis: Genetic Testing for Cystic Fibrosis. Arch Intern Med 1999, 159(141529-1539 [http:/ /archinte.ama-assn.org/cgi/content/abstract/159/14/1529]. 3. Sebastiani P, Ramoni MF, Nolan V, Baldwin CT, Steinberg MH: Genetic dissection and prognostic modeling of overt stroke in sickle cell anemia. Nat Genet 2005, 37(4):435-440. 4. Cortes J: Natural history and staging of chronic myelogenous leukemia. Hematol Oncol Clin North Am 2004, 18(3):569-584. 5. van 't Veer LJ, Dai H, van de Vijver MJ, He YD, Hart AAM, Mao M, Peterse HL, van der Kooy K, Marton MJ, Witteveen AT, Schreiber GJ, Kerkhoven RM, Roberts C, Linsley PS, Bernards R, Friend SH: Gene expression profiling predicts clinical outcome of breast can- cer. Nature 2002, 415(6871):530-536. 6. Alizadeh AA, Eisen MB, Davis RE, Ma C, Lossos IS, Rosenwald A, Boldrick JC, Sabet H, Tran T, Yu X, Powell JI, Yang L, Marti GE, Moore T, Hudson JJ, Lu L, Lewis DB, Tibshirani R, Sherlock G, Chan WC, Greiner TC, Weisenburger DD, Armitage JO, Warnke R, Levy R, Wilson W, Grever MR, Byrd JC, Botstein D, Brown PO, Staudt LM: Distinct types of diffuse large B-cell lymphoma identified by gene expression profiling. Nature 2000, 403(6769):503-511. 7. Pomeroy SL, Tamayo P, Gaasenbeek M, Sturla LM, Angelo M, McLaughlin ME, Kim JYH, Goumnerova LC, Black PM, Lau C, Allen JC, Zagzag D, Olson JM, Curran T, Wetmore C, Biegel JA, Poggio T, Mukherjee S, Rifkin R, Califano A, Stolovitzky G, Louis DN, Mesirov JP, Lander ES, Golub TR: Prediction of central nervous system Page 9 of 10 (page number not for citation purposes)