# Multilevel Privacy Assurance Evaluation of Healthcare Metadata
## 3 Multilevel Privacy Assurance Evaluation: Results and Evaluation
### At Inter- and Intra-Organizational Level
#### 3.2.1 Evaluation
The number of patients and respective data sharing time are demonstrated along each arrow. Furthermore, the process model with sharing time stamps is given; see Figure 5. In the given legend, the subhospital departments with pseudo-identifiers are shown with activities share in percentage. The periods of care data sharing amongst horizontally distributed caregivers and their frequency are noted (with activities' median and least time stamps). The experiments suggest that the succeeding data sharing is performed either instantly or after a short period from one suborganization to the other. PM experiments explained that no privacy-preserving actions could practically have occurred in such brief time frames. Figure 5: (**a**) Sepsis process model (using Disco tool): patients’ un-anonymized care metadata share amongst horizontally distributed caregivers; (**b**) Legend for Sepsis process model. ProM Lite: In Figure 6, the dotted chart algorithm from the ProM Lite tool is used on the Sepsis event log. The dotted chart depicts the undergoing of activities with a further detailed description of time stamps. On the x-axis, we see the time duration of the Sepsis tests and data share amongst horizontally distributed organizations within the hospital. Whereas on the y axis, we see the trace of events of each patient. A similar color depicts a similar Sepsis test (activity). In the legend, each color is manifested with a respective activity in the graph; see Figure 6. The PM experiments suggested that the diagnosis consumes the maximum time for patients' data to move from one suborganizational department to another. Whereas the majority of times, the transfer of patients' data was performed either instantly or within 48 hours, as in Figure 6. This explained that no privacy-preserving measures could have occurred in this short while. Furthermore, in ProM Lite, the social network algorithm discovers information regarding working (medical/administrative) staff in an event log. We could not reveal the social network in the Sepsis event log using ProM. The absence of a social network suggested that either the staff disagreed with sharing their PII publicly or it was intentionally withheld for privacy's sake. However, the Dotted Chart substantiated our first finding of Disco. Later, the IT expert also verified that while sharing patients' PII with vertically distributed organizations, healthcare providers restrict the information share of their employees for privacy's sake. Expert Opinion: An IT expert working in a local Dutch hospital was shown the PM experiments and results and was asked whether caregivers share un-anonymized (and pseudonymized) care data amongst horizontally distributed caregivers. Furthermore, do they remove the PII of medical and administrative staff? We also asked to confirm whether the results are generalizable to the vertically distributed Dutch caregivers or not. The IT expert validated all our findings. Significantly, the REA ontology verified the underlying economic factors behind patients' un-anonymized metadata share amongst Dutch caregivers, of better data utility. Figure 6: Privacy assurance evaluation at intra-organizational level (Sepsis event log using the Dotted Chart algorithm from the ProM Lite).