BMC Genomics 2006, 7:93 http://www.biomedcentral.com/1471-2164/7/93 FGiegnuerPeIN5G permission granting GenePING permission granting. Once this filtered document is created, a patient can grant read permission on this new document to his doctor. cation procedure.) It appears that all of these issues are generic to the entire PING system, and that genome data does not particularly emphasize these threats. 2. authorized user: Consider an authorized user of the GenePING service. Such a user should have access only to the information he is explicitly expected to have, either because the data is his personal health record to begin with, or because the health record owner has explicitly granted permission to this user, who might be a health care provider of the data owner. Of particular relevance is the threat posed by revealing the absence or presence of data. Specifically, the presence or absence of a particular medical datapoint is, in fact, a datapoint itself (e.g. the presence of an HIV test result in a patient's record was once used by certain insurance com- panies as an indicator of at-risk behavior.) In the context of genomic data, this is particularly relevant: as genotyp- ing progressively enters the clinical scene, first with tar- geted genotypes of certain SNPs or mutations, then with full genotypes for some patients, it becomes important to hide the existence of a genotype document from a non- authorized user, and to hide the existence of datapoints outside those specifically authorized. 3. internal individual: Consider an individual who has some authorized role with the GenePING server, or some access to the hardware and software of GenePING for some period of time. Such an individual is effectively an "authorized user," as above, with no explicit permissions. We must be concerned that a malicious internal individ- ual may steal the GenePING server's hard drive, or copy some raw files to external storage for later analysis. Much Page 7 of 10 (page number not for citation purposes)