Access Control to patients' medical information in Hospital Information Systems (HIS) is a challenge in modern Patient-Centered (PC) healthcare. Fine-Grained Access Control (FGAC) in particular has been identified as one of the security requirements in these systems. In FGAC, only parts of medical information that are relevant and required by healthcare providers are accessed at the point of care. This cannot be achieved without a holistic view of a medical condition through a Patient-Centered Fine-Grained Access Control (PCFGAC), in which patient-centricity is considered. This research proposes using Business Process Management (BPM) to achieve PCFGAC in order to provide a real-time access control based on a "need-to-know" principle. Through a prototype that uses BPM, security requirements of PCFGAC were met. These include: authority control, informed decision support, fine-grained access control, and dynamic policies support. Thus, a contribution to the knowledge and practice has been introduced.

In the digital era, most of our highly sensitive documents are stored in computers. These documents are in a great threat unless protected using appropriate measures. Despite their several imperfections, passwords are becoming the de-facto mechanism for securing documents stored in local directories or on the websites. In this scheme users protect their documents using passwords. In order for such scheme to work, the passwords must be stored in the file system either in plain or hashed form so that they can be used as references when information is requested. This paper proposes innovative password-based protection system. Although the proposed system uses passwords for document protection, it proposes a completely different way of using and managing these passwords. Our system protects a stored document in terms of both the document itself and the password. Both the document’s content and the password are used along with random noises to generate security code that serves as a reference when the document is requested. The security code is neither reversible nor reproducible without a full knowledge of the password and the content of the document. The users of our system keep their passwords and provide them only when they first store the document and when they later request document retrieval. The passwords are never stored neither in their plain nor hashed forms. Experiments with our prototype implementation showed that our protection scheme is effective and passed important security tests.