BMC Genomics 2006, 7:93 http://www.biomedcentral.com/1471-2164/7/93 profiles can be left to the proper organizations, e.g. patient advocacy groups or the FDA. A patient can then apply a privacy profile to any genotype lab document in GenePING (Figure 4), effectively creating a new Filtered Document within his record (Figure 5), which can then be shared with the appropriate health care provider. Upon reading a patient's record, a health care provider will only see this new document containing only the filtered data, not the original, complete genotype doc- ument (Figure 6). The fact that the document is the result of a filter is also invisible to anyone other than the patient himself. Results & discussion It is impossible to build a perfectly secure system. Thus, it is important to understand exactly what the system should be built to protect, what situations it can handle, and what situations are out of scope. We defined a threat model to analyze the GenePING privacy requirements and ensure that the level of security provided by our imple- mentation is reasonable. Threats We identified three types of individuals who might be involved in violating security properties of GenePING: 1. external individual: Consider an individual who has no authorized role in the system and no affiliation with the GenePING server. Such an individual might try to access the server and impersonate an authorized user, eavesdrop on client-server communication on the public Internet, or actively exploit a bug in the GenePING server to extract data in unexpected ways (e.g. errors in authenti- FGiegnuerPeIN4G filtering a document GenePING filtering a document. A patient can choose to create a filtered version of a genotype dataset, according to one of a preset list of privacy profiles. Page 6 of 10 (page number not for citation purposes)