A Knowledge-Constrained Access Control Model for Protecting Patient Privacy in Hospital Information Systems

Abstract

Current access control mechanisms of the hospital information system can hardly identify the real access intention of system users. A relaxed access control increases the risk of compromise of patient privacy. To reduce unnecessary access of patient information by hospital staff, this paper proposes a knowledge-constrained role-based access control (KC-RBAC) model in which a variety of medical domain knowledge is considered in access control. Based on the proposed Purpose Tree and knowledge-involved algorithms, the model can dynamically define the boundary of access to the patient information according to the context, which helps to protect patient privacy by controlling access. Compared with the role-based access control model, KC-RBAC can effectively protect patient information according to the results of the experiments.

Evolution of access control models for protection of patient details: a survey

“…But points have been raised that even the knowledge about the medical domain should be taken into consideration. Knowledge and information can be taken from sources like ICD-10 and SNOMED CT which contain information about diseases, their relations and other various biomedical knowledge [10] [13]. Therefore for the protection of patient privacy current models still need enhancement by integrating the knowledge of the medical domain in the present RBAC Model [10] [13].…”

“…This combines the RBAC model but gives authority to roles according to their knowledge on the medical domain like clinical pathways etc. The model consists of the following modules: General model, Knowledge model and the Purpose Tree [10] [13]. The General Model consists the RBAC Model with an extension to the Knowledge Module.…”

“…It is the one that decides whether to give the user access or not on the basis of the information it derives from SNOMED CT along with ICD-10. The Purpose Tree (PT) Module is another major component that elucidates the purpose as to why the user is visiting and asking for access of data based on the hierarchical tree structure [13].…”

Establishing Intent Groups for the Intent-Based Access Control Framework

“…E. O. Boadu and G. K. Armah in [4] applied the RBAC model to the Hospital Management System for reducing the administration burden and to control the accessing of patient records and other hospital resources based on the defined roles and their permissions. Researchers in [5] considered domain knowledge and purpose of requesting user for accessing the patient record as constraints in current RBAC model to privacy of patient records. B. Tay and A. Mourad in [6] added ML techniques to assess the RBAC access policies enforces in the system, assess the authorization levels based on the user performance and work history to update the policies dynamically.…”

Methodology and mechanisms for federation of heterogeneous metadata sources and ontology development in emerging collaborative environment

“…Common metadata standards, as bottom-up specific data knowledge, allow that data to be transferred and interpreted easily among stakeholders so as to solve the problem of data interoperability on the knowledge level. Metadata describing data usually has the following components: metadata related to data provision, such as who it is associated with when it is uploaded; metadata related to data usage, that is, what the users are allowed to do with it (Zhang et al , 2018); and metadata describing the semantic association among data itself. This paper intends to address the new challenges of the third component metadata knowledge interoperation and federation research.…”