Personal information management systems: a user-centric privacy utopia?

Heleen Janssen,Jennifer Cobbe,Jatinder Singh

DOI: https://doi.org/10.14763/2020.4.1536

2020-12-18

Internet Policy Review

Abstract:PDSs aim to empower users over their data. We explain their limits, and describe why decentralising data processing does not imply decentralisation of power.

What problem does this paper attempt to address?

On the Efficiency of Decentralized File Storage for Personal Information Management Systems

Mirko Zichichi,Stefano Ferretti,Gabriele D'Angelo

DOI: https://doi.org/10.48550/arXiv.2007.03505

2020-07-07

Abstract:This paper presents an architecture, based on Distributed Ledger Technologies (DLTs) and Decentralized File Storage (DFS) systems, to support the use of Personal Information Management Systems (PIMS). DLT and DFS are used to manage data sensed by mobile users equipped with devices with sensing capability. DLTs guarantee the immutability, traceability and verifiability of references to personal data, that are stored in DFS. In fact, the inclusion of data digests in the DLT makes it possible to obtain an unalterable reference and a tamper-proof log, while remaining compliant with the regulations on personal data, i.e. GDPR. We provide an experimental evaluation on the feasibility of the use of DFS. Three different scenarios have been studied: i) a proprietary IPFS approach with a dedicated node interfacing with the data producers, ii) a public IPFS service and iii) Sia Skynet. Results show that through proper configuration of the system infrastructure, it is viable to build a decentralized Personal Data Storage (PDS).

Cryptography and Security,Distributed, Parallel, and Cluster Computing,Information Retrieval,Networking and Internet Architecture,Performance
Private Data System Enabling Self-Sovereign Storage Managed by Executable Choreographies

Sinica Alboaie,Doina Cosovan

DOI: https://doi.org/10.48550/arXiv.1708.09332

2017-06-26

Distributed, Parallel, and Cluster Computing

Abstract:With the increased use of Internet, governments and large companies store and share massive amounts of personal data in such a way that leaves no space for transparency. When a user needs to achieve a simple task like applying for college or a driving license, he needs to visit a lot of institutions and organizations, thus leaving a lot of private data in many places. The same happens when using the Internet. These privacy issues raised by the centralized architectures along with the recent developments in the area of serverless applications demand a decentralized private data layer under user control. We introduce the Private Data System (PDS), a distributed approach which enables self-sovereign storage and sharing of private data. The system is composed of nodes spread across the entire Internet managing local key-value databases. The communication between nodes is achieved through executable choreographies, which are capable of preventing information leakage when executing across different organizations with different regulations in place. The user has full control over his private data and is able to share and revoke access to organizations at any time. Even more, the updates are propagated instantly to all the parties which have access to the data thanks to the system design. Specifically, the processing organizations may retrieve and process the shared information, but are not allowed under any circumstances to store it on long term. PDS offers an alternative to systems that aim to ensure self-sovereignty of specific types of data through blockchain inspired techniques but face various problems, such as low performance. Both approaches propose a distributed database, but with different characteristics. While the blockchain-based systems are built to solve consensus problems, PDS's purpose is to solve the self-sovereignty aspects raised by the privacy laws, rules and principles.
A Critical Look at Decentralized Personal Data Architectures

Arvind Narayanan,Vincent Toubiana,Solon Barocas,Helen Nissenbaum,Dan Boneh

DOI: https://doi.org/10.48550/arXiv.1202.4503

2012-02-21

Abstract:While the Internet was conceived as a decentralized network, the most widely used web applications today tend toward centralization. Control increasingly rests with centralized service providers who, as a consequence, have also amassed unprecedented amounts of data about the behaviors and personalities of individuals. Developers, regulators, and consumer advocates have looked to alternative decentralized architectures as the natural response to threats posed by these centralized services. The result has been a great variety of solutions that include personal data stores (PDS), infomediaries, Vendor Relationship Management (VRM) systems, and federated and distributed social networks. And yet, for all these efforts, decentralized personal data architectures have seen little adoption. This position paper attempts to account for these failures, challenging the accepted wisdom in the web community on the feasibility and desirability of these approaches. We start with a historical discussion of the development of various categories of decentralized personal data architectures. Then we survey the main ideas to illustrate the common themes among these efforts. We tease apart the design characteristics of these systems from the social values that they (are intended to) promote. We use this understanding to point out numerous drawbacks of the decentralization paradigm, some inherent and others incidental. We end with recommendations for designers of these systems for working towards goals that are achievable, but perhaps more limited in scope and ambition.

Computers and Society
Personal information self-management: A survey of technologies supporting administrative services

Paul Marillonnet,Maryline Laurent,Mikaël Ates

DOI: https://doi.org/10.48550/arXiv.2109.12968

2021-09-27

Computers and Society

Abstract:This paper presents a survey of technologies for personal data self-management interfacing with administrative and territorial public service providers. It classifies a selection of scientific technologies into four categories of solutions: Personal Data Store (PDS), Identity Manager (IdM), Anonymous Certificate System and Access Control Delegation Architecture. Each category, along with its technological approach, is analyzed thanks to eighteen identified functional criteria that encompass architectural and communication aspects, as well as user data lifecycle considerations. The originality of the survey is multifold. First, as far as we know, there is no such thorough survey covering such a panel of a dozen of existing solutions. Second, it is the first survey addressing Personally Identifiable Information (PII) management for both administrative and private service providers. Third, this paper achieves a functional comparison of solutions of very different technical natures. The outcome of this paper is the clear identification of functional gaps of each solution. As a result, this paper establishes the research directions to follow in order to fill these functional gaps.
DSPM: A Platform for Personal Data Share and Privacy Protect Based on Metadata

Xiangqian Dong,Bing Guo,Xuliang Duan,Yuncheng Shen,Hong Zhang,Yan Shen

DOI: https://doi.org/10.1109/ICESS.2016.10

2016-01-01

Abstract:Personal data represents a post-industrial opportunity. In order to release the huge potential of personal data and enhance the rights of possession, use, and disposal, a highly reliable, secure and available infrastructure is required. Regarding the personal data market, current solutions focus on data discovery and passive privacy protection. What's worse is that the data owner loses the right of control. In this paper, we present a prototype of DSPM: an efficient platform we devise to balance the data sharing and privacy protect, enhance the probability of data discovery and the ability of the individual to control the data. It is shown that DSPM is align with the initiative aims of establishing a user-centric framework for identifying the opportunities, risks and collaborative responses in the use of personal data.
Towards a decentralized data privacy protocol for self-sovereignty in the digital world

Rodrigo Falcão,Arghavan Hosseinzadeh

2024-04-19

Abstract:A typical user interacts with many digital services nowadays, providing these services with their data. As of now, the management of privacy preferences is service-centric: Users must manage their privacy preferences according to the rules of each service provider, meaning that every provider offers its unique mechanisms for users to control their privacy settings. However, managing privacy preferences holistically (i.e., across multiple digital services) is just impractical. In this vision paper, we propose a paradigm shift towards an enriched user-centric approach for cross-service privacy preferences management: the realization of a decentralized data privacy protocol.

Cryptography and Security,Software Engineering
Motivating Users to Manage Privacy Concerns in Cyber-Physical Settings—A Design Science Approach Considering Self-Determination Theory

Sabrina Oppl,Christian Stary

DOI: https://doi.org/10.3390/su14020900

IF: 3.9

2022-01-13

Sustainability

Abstract:Connectivity is key to the latest technologies propagating into everyday life. Cyber-Physical Systems (CPS) and Internet-of-Things (IoT) applications enable users, machines, and technologically enriched objects (‘Things’) to sense, communicate, and interact with their environment. Albeit making human beings’ lives more comfortable, these systems collect huge quantities of data that may affect human privacy and their digital sovereignty. Engaging in control over individuals by digital means, the data and the artefacts that process privacy-relevant data can be addressed by Self-Determination Theory (SDT) and its established instruments. In this paper, we discuss how the theory and its methodological knowledge can be considered for user-centric privacy management. We set the stage for studying motivational factors to improve user engagement in identifying privacy needs and preserving privacy when utilizing or aiming to adapt CPS or IoT applications according to their privacy needs. SDT considers user autonomy, self-perceived competence, and social relatedness relevant for human engagement. Embodying these factors into a Design Science-based CPS development framework could help to motivate users to articulate privacy needs and adopt cyber-physical technologies for personal task accomplishment.

environmental sciences,environmental studies,green & sustainable science & technology
From Data Disclosure to Privacy Nudges: A Privacy-aware and User-centric Personal Data Management Framework

Yang Lu,Shujun Li,Athina Ioannou,Iis Tussyadiah

DOI: https://doi.org/10.48550/arXiv.1909.09942

2019-09-22

Cryptography and Security

Abstract:Although there are privacy-enhancing tools designed to protect users' online privacy, it is surprising to see a lack of user-centric solutions allowing privacy control based on the joint assessment of privacy risks and benefits, due to data disclosure to multiple platforms. In this paper, we propose a conceptual framework to fill the gap: aiming at the user-centric privacy protection, we show the framework can not only assess privacy risks in using online services but also the added values earned from data disclosure. Through following a human-in-the-loop approach, it is expected the framework provides a personalized solution via preference learning, continuous privacy assessment, behavior monitoring and nudging. Finally, we describe a case study towards "leisure travelers" and several future areas to be studied in the ongoing project.
Designing Privacy for You : A User Centric Approach For Privacy

Awanthika Senarath,Nalin A. G. Arachchilage,Jill Slay,Nalin A.G. Arachchilage

DOI: https://doi.org/10.48550/arXiv.1703.09847

IF: 6.4588

2017-03-29

Human-Computer Interaction

Abstract:Privacy directly concerns the user as the data owner (data- subject) and hence privacy in systems should be implemented in a manner which concerns the user (user-centered). There are many concepts and guidelines that support development of privacy and embedding privacy into systems. However, none of them approaches privacy in a user- centered manner. Through this research we propose a framework that would enable developers and designers to grasp privacy in a user-centered manner and implement it along with the software development life cycle.
Self-Sovereign Management Scheme of Personal Health Record with Personal Data Store and Decentralized Identifier

Tong Min Kim,Taehoon Ko,Byoung Woo Hwang,Hyung Goo Paek,Wan Yeon Lee

DOI: https://doi.org/10.1016/j.csbj.2024.11.036

IF: 6.155

2024-12-01

Computational and Structural Biotechnology Journal

Abstract:Conventional personal health record (PHR) management systems are centralized, making them vulnerable to privacy breaches and single points of failure. Despite progress in standardizing healthcare data with the FHIR format, hospitals often lack efficient platforms for transferring PHRs, leading to redundant tests and delayed treatments. To address these challenges, we propose a decentralized PHR management system leveraging Personal Data Stores (PDS) and Decentralized Identifiers (DIDs) in line with the Web 3.0 model. Our system features secure interoperability and personal identification masking. Interoperability is achieved through DID digital certificates for verifying PDS addresses and a dynamic access key (AK) system to minimize credential exposure. Data de-identification, including anonymization and encryption, ensures privacy and prevents unauthorized access. We developed a prototype using the Solid open-source library and Hyperledger Aries protocol. Testing showed efficient performance, with DID validations and AK generation under one second, and data operations for 500 MB-sized PHRs completing in two seconds. De-identification processes were both effective and timely. The system demonstrated the ability to manage PHRs securely, empower users with control over their healthcare data, facilitate seamless and secure data transfer between patients and medical entities, and prevent exposure of sensitive information. This approach advances decentralized PHR management, supporting improved healthcare outcomes and patient experiences in the digital era. Graphical abstract Download: Download high-res image (123KB) Download: Download full-size image

biochemistry & molecular biology
A Systematic Review on Privacy-Aware IoT Personal Data Stores

George P. Pinto,Praveen Kumar Donta,Schahram Dustdar,Cássio Prazeres

DOI: https://doi.org/10.3390/s24072197

IF: 3.9

2024-03-30

Sensors

Abstract:Data from the Internet of Things (IoT) enables the design of new business models and services that improve user experience and satisfaction. These data serve as important information sources for many domains, including disaster management, biosurveillance, smart cities, and smart health, among others. However, this scenario involves the collection of personal data, raising new challenges related to data privacy protection. Therefore, we aim to provide state-of-the-art information regarding privacy issues in the context of IoT, with a particular focus on findings that utilize the Personal Data Store (PDS) as a viable solution for these concerns. To achieve this, we conduct a systematic mapping review to identify, evaluate, and interpret the relevant literature on privacy issues and PDS-based solutions in the IoT context. Our analysis is guided by three well-defined research questions, and we systematically selected 49 studies published until 2023 from an initial pool of 176 papers. We analyze and discuss the most common privacy issues highlighted by the authors and position the role of PDS technologies as a solution to privacy issues in the IoT context. As a result, our findings reveal that only a small number of works (approximately 20%) were dedicated to presenting solutions for privacy issues. Most works (almost 82%) were published between 2018 and 2023, demonstrating an increased interest in the theme in recent years. Additionally, only two works used PDS-based solutions to deal with privacy issues in the IoT context.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation
Towards a Personalized Privacy Management Framework

Jianning Geng,Lin Liu,Barrett R. Bryant

DOI: https://doi.org/10.1145/1809100.1809109

2010-01-01

Abstract:Privacy policies which are stated by the service provider are intended to convey to the users the information how their personal data will be protected. Thus, letting the user understand the privacy policy and trust the service provider is a crucial task. This paper proposes a personalized privacy management framework with which users can participate in the privacy management. Existing privacy policies are analyzed and improved. Within this framework, the privacy policy can not only be regulated, but also can be easily understood by users at a glance.
Personal Data Gentrification

Juan Luis Herrera,Javier Berrocal,Jose Garcia-Alonso,Juan Manuel Murillo,Hsiao-Yuan Chen,Christine Julien,Niko Mäkitalo,Tommi Mikkonen

DOI: https://doi.org/10.48550/arXiv.2103.17109

2021-03-31

Computers and Society

Abstract:We live in an era in which the most valued services are not paid for in money, but in personal data. Every day, service providers collect the personal information of billions of individuals, information that sustain their infrastructure by marketing profiles labeled with this information to personal data consumers, such as advertisers. Not all uses of this personal data are for marketing; data consumers can also include, for instance, public health authorities tracking pandemics. In either case, individuals have undergone a process of Personal Data Gentrification, as data ownership has shifted from individuals to service providers and data consumers, as if the data is worth nothing to the individuals; these new owners then harness the data to obtain large profits. Current privacy-enhancing technologies are beginning to allow individuals to control and share less information. However, not sharing individuals' personal information at all could lead to Personal Data Blight, in which the potential of personal data in applications that benefit all of society remains forever latent. In this paper, we propose Personal Data Enfranchisement as a middle ground, empowering individuals to control the sharing of their personal information to shift the business flows of personal information. Based on these insights, we propose a model to gradually and incrementally make a shift from our current situation towards one of Personal Data Enfranchisement. Finally, we present a roadmap and some challenges towards achieving this bold vision.
Pervasive User Data Collection from Cyberspace: Privacy Concerns and Countermeasures

Yinhao Jiang,Mir Ali Rezazadeh Baee,Leonie Ruth Simpson,Praveen Gauravaram,Josef Pieprzyk,Tanveer Zia,Zhen Zhao,Zung Le

DOI: https://doi.org/10.3390/cryptography8010005

2024-01-31

Cryptography

Abstract:The increasing use of technologies, particularly computing and communication paradigms, has significantly influenced our daily lives. Interconnecting devices and networks provides convenient platforms for information exchange and facilitates pervasive user data collection. This new environment presents serious privacy challenges. User activities can be continuously monitored in both digital and physical realms. Gathered data can be aggregated and analysed, revealing aspects of user behaviour that may not be apparent from a single data point. The very items that facilitate connectivity simultaneously increase the risk of privacy breaches. The data gathered to provide services can also be used for monitoring and surveillance. This paper discerns three novel categories of privacy concerns relating to pervasive user data collection: privacy and user activity in cyberspace, privacy in personal cyber–physical systems, and privacy in proactive user-driven data collection. We emphasise the primary challenges, ranging from identity tracking in browsing histories to intricate issues in opportunistic networks, situating each within practical, real-world scenarios. Furthermore, we assess the effectiveness of current countermeasures, investigating their strengths and limitations. This paper explores the challenges in preserving privacy in user interactions with dynamic interconnected systems and suggests countermeasures to mitigate identified privacy risks.
The Security Implications of Data Subject Rights

Jatinder Singh,Jennifer Cobbe

DOI: https://doi.org/10.1109/MSEC.2019.2914614

2019-05-30

Abstract:Data protection regulations give individuals rights to obtain the information that entities have on them. However, providing such information can also reveal aspects of the underlying technical infrastructure and organisational processes. This article explores the security implications this raises, and highlights the need to consider such in rights fulfillment processes. To appear in IEEE Security & Privacy

Computers and Society,Cryptography and Security
"My Privacy for their Security": Employees' Privacy Perspectives and Expectations when using Enterprise Security Software

Jonah Stegman,Patrick J. Trottier,Caroline Hillier,Hassan Khan,Mohammad Mannan

DOI: https://doi.org/10.48550/arXiv.2209.11878

2022-09-23

Cryptography and Security

Abstract:Employees are often required to use Enterprise Security Software ("ESS") on corporate and personal devices. ESS products collect users' activity data including users' location, applications used, and websites visited - operating from employees' device to the cloud. To the best of our knowledge, the privacy implications of this data collection have yet to be explored. We conduct an online survey (n=258) and a semi-structured interview (n=22) with ESS users to understand their privacy perceptions, the challenges they face when using ESS, and the ways they try to overcome those challenges. We found that while many participants reported receiving no information about what data their ESS collected, those who received some information often underestimated what was collected. Employees reported lack of communication about various data collection aspects including: the entities with access to the data and the scope of the data collected. We use the interviews to uncover several sources of misconceptions among the participants. Our findings show that while employees understand the need for data collection for security, the lack of communication and ambiguous data collection practices result in the erosion of employees' trust on the ESS and employers. We obtain suggestions from participants on how to mitigate these misconceptions and collect feedback on our design mockups of a privacy notice and privacy indicators for ESS. Our work will benefit researchers, employers, and ESS developers to protect users' privacy in the growing ESS market.
Personal data store ecosystems in health and social care

Laura Carmichael,Wendy Hall,Michael Boniface

DOI: https://doi.org/10.3389/fpubh.2024.1348044

IF: 5.2

2024-02-08

Frontiers in Public Health

Abstract:This paper considers how the development of personal data store ecosystems in health and social care may offer one person-centered approach to improving the ways in which individual generated and gathered data—e.g., from wearables and other personal monitoring and tracking devices—can be used for wellbeing, individual care, and research. Personal data stores aim to provide safe and secure digital spaces that enable people to self-manage, use, and share personal data with others in a way that aligns with their individual needs and preferences. A key motivation for personal data stores is to give an individual more access and meaningful control over their personal data, and greater visibility over how it is used by others. This commentary discusses meanings and motivations behind the personal data store concept—examples are provided to illustrate the opportunities such ecosystems can offer in health and social care, and associated research and implementation challenges are also examined.

public, environmental & occupational health
"Those blimmin Ts and Cs": a mixed methods analysis of how people manage personal information, privacy, and impressions

Anouk Mols,Jorge Pereira Campos,João Fernando Ferreira Gonçalves

DOI: https://doi.org/10.1080/07370024.2024.2325340

IF: 6.4588

2024-03-23

Human-Computer Interaction

Abstract:Interconnected and smart technologies complicate personal information management (PIM) because users delegate the storing, organizing, and retrieving of personal information to smart and mobile service providers. Meta-level PIM activities are required to maintain the privacy and security of personal information. This study provides insights into how users of location tracking, mobile apps, and smart home technologies perceive PIM and privacy. We turn to the privacy as contextual integrity (CI) and impression management (IM) literatures to explore informational norms and interpersonal dynamics in PIM. This study is based on a mixed methods design to analyze focus groups and interviews with 106 British and Dutch respondents. Combining unsupervised Latent Dirichlet allocation (LDA) topic modeling and thematic analysis, we reveal discursive patterns in respondent accounts of technology use and provide an in-depth interpretation of these patterns. Our findings indicate that PIM practices are associated with the perceived appropriateness of information flows, anthropomorphic interpretations of technologies, and interpersonal surveillance. Thus, impressions are managed toward social actors as well as technology providers. We contribute to PIM research with a demonstration of how PIM in mobile, smart, and location-based technology use cannot be separated from contextual factors and strategies to manage impressions of habits and behaviors.

computer science, theory & methods, cybernetics
Privacy as a Service in Digital Health

Xiang Su,Jarkko Hyysalo,Mika Rautiainen,Jukka Riekki,Jaakko Sauvola,Altti Ilari Maarala,Harri Honko

DOI: https://doi.org/10.48550/arXiv.1605.00833

2016-05-03

Abstract:Privacy is a key challenge for continued digitalization of health. The forthcoming European General Data Protection Regulation (GDPR) is transforming this challenge into regulatory directives. User consent provisioning and coordinating across data services will be the keys in addressing this challenge. We suggest a privacy-driven architecture that provides tools for providing user consent as a service. This enables managing and reusing private health information between a large amount of data sources, individuals and services, even when they are not known beforehand. The proposed architecture integrates data security and semantic descriptions into a trust query framework to provide the required interoperability and co-operation support for future health services. This approach provides benefits for all stakeholders through safer data management, cost and process savings, multi-provider services, and services based on emerging new business models.

Computers and Society,Cryptography and Security
Security Engineering of Patient-Centered Health Care Information Systems in Peer-to-Peer Environments: Systematic Review

Imrana Abdullahi Yari,Tobias Dehling,Felix Kluge,Juergen Geck,Ali Sunyaev,Bjoern Eskofier

DOI: https://doi.org/10.2196/24460

2021-11-15

Abstract:Background: Patient-centered health care information systems (PHSs) enable patients to take control and become knowledgeable about their own health, preferably in a secure environment. Current and emerging PHSs use either a centralized database, peer-to-peer (P2P) technology, or distributed ledger technology for PHS deployment. The evolving COVID-19 decentralized Bluetooth-based tracing systems are examples of disease-centric P2P PHSs. Although using P2P technology for the provision of PHSs can be flexible, scalable, resilient to a single point of failure, and inexpensive for patients, the use of health information on P2P networks poses major security issues as users must manage information security largely by themselves. Objective: This study aims to identify the inherent security issues for PHS deployment in P2P networks and how they can be overcome. In addition, this study reviews different P2P architectures and proposes a suitable architecture for P2P PHS deployment. Methods: A systematic literature review was conducted following PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) reporting guidelines. Thematic analysis was used for data analysis. We searched the following databases: IEEE Digital Library, PubMed, Science Direct, ACM Digital Library, Scopus, and Semantic Scholar. The search was conducted on articles published between 2008 and 2020. The Common Vulnerability Scoring System was used as a guide for rating security issues. Results: Our findings are consolidated into 8 key security issues associated with PHS implementation and deployment on P2P networks and 7 factors promoting them. Moreover, we propose a suitable architecture for P2P PHSs and guidelines for the provision of PHSs while maintaining information security. Conclusions: Despite the clear advantages of P2P PHSs, the absence of centralized controls and inconsistent views of the network on some P2P systems have profound adverse impacts in terms of security. The security issues identified in this study need to be addressed to increase patients' intention to use PHSs on P2P networks by making them safe to use.

Personal information management systems: a user-centric privacy utopia?

On the Efficiency of Decentralized File Storage for Personal Information Management Systems

Private Data System Enabling Self-Sovereign Storage Managed by Executable Choreographies

A Critical Look at Decentralized Personal Data Architectures

Personal information self-management: A survey of technologies supporting administrative services

DSPM: A Platform for Personal Data Share and Privacy Protect Based on Metadata

Towards a decentralized data privacy protocol for self-sovereignty in the digital world

Motivating Users to Manage Privacy Concerns in Cyber-Physical Settings—A Design Science Approach Considering Self-Determination Theory

From Data Disclosure to Privacy Nudges: A Privacy-aware and User-centric Personal Data Management Framework

Designing Privacy for You : A User Centric Approach For Privacy

Self-Sovereign Management Scheme of Personal Health Record with Personal Data Store and Decentralized Identifier

A Systematic Review on Privacy-Aware IoT Personal Data Stores

Towards a Personalized Privacy Management Framework

Personal Data Gentrification

Pervasive User Data Collection from Cyberspace: Privacy Concerns and Countermeasures

The Security Implications of Data Subject Rights

"My Privacy for their Security": Employees' Privacy Perspectives and Expectations when using Enterprise Security Software

Personal data store ecosystems in health and social care

"Those blimmin Ts and Cs": a mixed methods analysis of how people manage personal information, privacy, and impressions

Privacy as a Service in Digital Health

Security Engineering of Patient-Centered Health Care Information Systems in Peer-to-Peer Environments: Systematic Review