# Data Protection and Privacy of the Internet of Healthcare Things (IoHTs)
## 4 Healthcare Data Protection Legislation and Framework
### Data Protection Issues/Aspects Not Covered in Healthcare Laws  
There are various issues and aspects of IoHT that are not covered in the already discussed legislative initiatives. Big Data Issues Integrating healthcare data notably raises security and privacy issues. Patient information is processed at different levels of security in data centers. In America, most organizations have HIPAA certification, but this does not guarantee a patient's record safety because HIPAA is more inclined towards ensuring security policies rather than implementation. Moreover, the transmission of large data sets from different locations poses an extra burden on processing and storage. Conventional security solutions are inadequate for large and inherently changing data sets. With the emergence of cloud healthcare solutions, security demands are becoming more complex and there are no specified policies written in existing healthcare data protection laws [77]. Data Governance related to the governance of healthcare data should be the initial step in managing healthcare data. It is due to the need of moving the healthcare industry towards a value-based business model. It demands common data representation that encircles different security standards (e.g., ICD, CPT, and LOINC) [78]. Currently, data generated in the healthcare industry is diverse and would demand a proper governance model. There are no policies for healthcare data standardization and normalization for proper data governance. Privacy-preserving analytics in the healthcare industry is grasping IoT devices to monitor and transmit vitals to healthcare clouds. Therefore, it needs to process and analyze data in an ad-hoc decentralized manner. However, the execution of resource-exhausting operations with privacy preservation is becoming a challenge. As new healthcare data \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Regulation** & \begin{tabular}{c} **Country/** \\ **Region** \\ \end{tabular} & \begin{tabular}{c} **Device** \\ **Layer** \\ \end{tabular} & \begin{tabular}{c} **Protocol** \\ **Layer** \\ \end{tabular} & \begin{tabular}{c} **Intermediate** \\ **Layer** \\ \end{tabular} & \
\begin{tabular}{c} **Management** \\ **Layer** \\ \end{tabular} &
\begin{tabular}{c} **Feedback** \\ **Layer** \\ \end{tabular} \\ \hline HIPAA & America & Yes & Yes & No & Yes & No \\ PIPEDA & Canada & Yes & No & No & No & No \\ EURO & EU & Yes & No & No & No & No \\ HEALTH & GDPR & EU & Yes & Yes & No & No & No \\ The Privacy Act & Australia & Yes & Yes & No & No & No \\ SHIEP & KSA & Yes & Yes & No & Yes & No \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of Healthcare Regulations. analytics are becoming popular, healthcare data privacy laws need revision, and new laws should be drafted to illustrate all processes involved in the usage of patients' private data. Identification of the Relevant Privacy Violation privacy in IoT-based devices can be violated at many stages. Firstly, it is violated by collecting data by third parties. Secondly, the usage and distribution of private data, and thirdly, the data is combined with other data. The third possibility is not known by the users who are using IoT-based medical devices to process and generate data. By combining newly generated information with existing data about a patient or health activity, it raises the high commercial value for many data-hungry organizations and commercial firms. Most of the data is often generated by automated medical devices, therefore, a higher trust level should be maintained for this data than on manually entered human data. This is important because medical insurance companies are monitoring the health conditions of their customers with the help of medical devices to ascertain the specific risks associated with their customer's health. These devices are also tracking users' geo-locations and such data must be protected through adequate device safety measures as well as legislative limitations on data usage.