# Data Protection and Privacy of the Internet of Healthcare Things (IoHTs)
## 4 Healthcare Data Protection Legislation and Framework
### IoHT Governance Challenges
#### 4.3.5 Other Considerations  
Apart from the above-mentioned challenges, there are several local issues worth consideration for the adoption of IoHT governance initiatives. * Awareness: There is a lack of awareness among the users of healthcare systems about the importance of the security of healthcare data;
* System Management Staff: Most of the time healthcare data is processed and forwarded by system management staff in healthcare institutes. They work on intermediate devices like data servers and gateway devices. The staff is not qualified enough to understand the complexities of data privacy and legal aspects. They are unaware of the latest threats because their primary tasks are network configurations and the availability of data at the endpoints. Mostly, they do not update healthcare systems and leave them unpatched until an issue is raised. They have little exposure to awareness programs and practices for data security and privacy;
* Doctors and Healthcare staff: One of the critical facts is not knowing much about the security and privacy laws of healthcare data by the healthcare staff and emergency response teams in hospitals. Specifically, the doctor uses personal devices such as cell phones or laptops to view the data, therefore, these personal devices also need to be secure. Moreover, they are not even familiar with the consequences of healthcare data leakage. There is no proper framework implemented that enforces healthcare staff to follow rules and policies to share and process patients' healthcare data legally and securely;
* Patients: These are the central entities in the healthcare system. However, they are less attractive to attackers due to having less information i.e., about themselves only. They are conscious about their privacy and all these legalities are there to protect their healthcare privacy. However, they do not have any idea about how their data is shared with other organizations and what their rights are regarding their healthcare data. If their data is shared without conferring with them, it begs the question of what the legal liberties are that can be taken by concerned organizations about data sharing;
* Enforcement Difficulties: There is no enforcement authority or body established that helps to enforce data privacy laws in the healthcare sector. All the healthcare institutes should be obliged to follow instructions by some authority. The authority should implement healthcare laws;
* Low Budget: In developing countries, the medical budget is very limited. The trend of using IoHT devices is emerging in big cities. Mostly, there is no central system or facility provided to facilitate data privacy in developing countries. A very low or limited budget is allocated for new and innovative technologies in the healthcare sector. Therefore, the authorities consider that there is no need to enforce data privacy policies if the usage of such devices is limited;
* Lack of Qualified Staff: The IT staff does not configure/enable security functions in IoHT due to inadequate qualifications and expertise. The main reason behind it is the lack of security training programs for medical staff. They are only interested in the functional requirements of medical devices but do not take care of non-functional requirements of a medical device like communication security and data privacy;
* No Internal Auditing: There is no IoHT audit like IT audit, conducted in healthcare organizations and hospitals. If any organization is processing healthcare data, then it is unlikely to make checks and balance the healthcare data. The internal audit ensures what data is being processed by which organization for what purposes. The auditing activities reduce the risk of data leakage and unauthorized usage;
* No Special Enforcement Authority: One of the difficulties in the enforcement of data privacy laws and regulations is the absence of special enforcement authorities in the healthcare sector. Formation and implementation of data privacy laws should be the primary responsibilities of the authority.