# Multilevel Privacy Assurance Evaluation of Healthcare Metadata
## 3 Multilevel Privacy Assurance Evaluation: Results and Evaluation
### At Individual Level: Results and Evaluation
#### 3.1.2 Evaluation  
Privacy as (Subjective) Value Object: Generally, it is a well-ingrained notion that e3-value modeling better demonstrates the physical/tangible value transactions. The idea is that the e3-value modeling better wholly demonstrates tangible/physical value objects instead of qualitative value transactions such as privacy, security, transparency, autonomy, and confidentiality. As the latter are all respective terms and depend mainly upon the purposes and requirements of the stakeholders. The e3-value model represents privacy from a subjective value to a (subjective) value object as it satisfies all four attributes [68] to become a value object. The model explores privacy preservation as per respective subdomains privacy-preserving means. Finally, privacy transforms from an intrinsic value to a (subjective) value object that requires assurance for patients' value care. In this wake, the privacy by policy and PbD serve as privacy-preserving measures when a patient comes in contact with a healthcare provider. The metadata privacy preservation initiates with the patients' PII collection after the intake of patients' Informed Consent (IC). Here, using the padlock chain model of e3-value modeling, patients' privacy is received as a (subjective) value object along with other tangible value activities such as quality healthcare. Quality healthcare is time- and cost-effective treatment of patients after the intake of their IC, while privacy is verified as a subjective transaction that varies according to each value actor's ontological requirements/priorities. Other tangible transactions (services) are physical. By contrast, privacy is perceivable as a (subjective) value object as it satisfies four attributes of being a value object in the padlock chain model. Below are the attributes with respective logic that proves privacy to be a (subjective) value object:  
1. Business goal: Service-Dominant Logic preaches that patients' autonomous decision making and their right over the control of their PII sharing must be prioritized;
2. Proof of Performance (POP): healthcare providers give their proof of performance to local oversight and regulatory authorities, such as IGJ and NZA, for patients' privacy preservation;
3. Accreditation: The healthcare providers are accreditated by standard authorities such as ISO and NEN;
4. Exchanged as a resource: privacy is exchanged as a resource from healthcare providers to patients and concerned authorities alike. Currently, privacy satisfies the above attributes to be reckoned as a value object but only subjectively--subjective, because the privacy assurance evaluation by accrediting and regulatory bodies is still nominal that relies on named indicators. Nominal evaluation allows indicator-based qualitative assessment and lags in ordinal, interval, and ratio -based measurements. Ordinal, interval, and ratio-based measurements include evaluation measures that characterize evaluation measures that assert the set order of priority, proportion, and quantitative measurements of named indicators. For quantitative evaluation, the healthcare providers' implementation, enforcement, and transparency (privacy by design) should be evaluated at the backdrop of the ISMS indicators, i.e., availability, integrity, confidentiality, and accountability. Informed Consent (IC): To transform the former, subjective healthcare metadata handling by healthcare providers into an objective pan-European one, the EU introduced General Data Protection Regulation, GDPR, article 7. In this wake, a transition of IC is perceivable that ranges from pre-GDPR time to post-GDPR time to GDPR-future expectations-oriented time. In the pre-GDPR era, accuracy and context preservation of the healthcare metadata was of prime significance for better data evaluations. Information security, the openness of healthcare metadata, and ethical issues relating to it were already realized across academia and industry alike. First-hand explicit IC was already in the norm in major parts of the EU.