Patient-centric authorization framework for sharing electronic health records

Abstract

In modern healthcare environments, a fundamental requirement for achieving continuity of care is the seamless access to distributed patient health records in an integrated and unified manner, directly at the point of care. However, Electronic Health Records (EHRs) contain a significant amount of sensitive information, and allowing data to be accessible at many different sources increases concerns related to patient privacy and data theft. Access control solutions must guarantee that only authorized users have access to such critical records for legitimate purposes, and access control policies from distributed EHR sources must be accurately reflected and enforced accordingly in the integrated EHRs.In this paper, we propose a unified access control scheme that supports patient-centric selective sharing of virtual composite EHRs using different levels of granularity, accommodating data aggregation and various privacy protection requirements. We also articulate and handle the policy anomalies that might occur in the composition of discrete access control policies from multiple data sources.

Multiparty Authorization Framework for Data Sharing in Online Social Networks

“…Other related work include general conflict resolution mechanisms for access control [12,15,16,17,18,20] and learn-based generation of privacy policies for OSNs [11,22,23]. All of those related work are orthogonal to our work.…”

“…Since some strategies, such as specificity-overrides and recency-overrides are nondeterministic, and deny-overrides strategy is too restricted in general for conflict resolution, it is desirable to combine these strategies together to achieve a more effective conflict resolution. Thus, a strategy chain can be constructed to address this issue, which has been discussed in our previous work [17,18].…”

A Model for the Governance of Federated Healthcare Information Systems

“…And, to the best of my knowledge, this challenge has not been met by the various recent attempts-such as [5,12,23,19]-to implement a governance mechanism for NHIN. Meeting this challenge is the objective of this paper.…”

“…By and large, even the more recent attempts at the governance of EHR exchange within an NHIN-like network, such as [5,12,23,19], seem unconcerned about the characteristics of an NHIN identified in Section 1. In particular, none of them supports a conformance hierarchy of policies.…”

“…Yet, some researchers complain about certain limitations of conventional AC mechanisms. For example, [12] complains about the inflexibility of RBAC, and its lack of state; and [9] points out the need to ensure proper reporting, which requires proactive capabilities such as the concept of obligations in LGI. Finally, in areas closely related to the governance of NHIN, Joshi et al [13] state that "secure interoperability between institutions poses a major challenge which has not been met so far," referring to just one of the qualities we are concerned with.…”