Accessing electronic health records in critical incidents using context-aware attribute-based access control

Abstract

In emergency situations, different actors involved in first aid services should be authorized to retrieve information from the patient’s Electronic Health Records (EHRs). The research objectives of this work involve the development and implementation of methods to characterise emergency situations requiring extraordinary access to healthcare data. The aim is to implement such methods based on contextual information pertaining to specific patients and emergency situations and also leveraging personalisation aspects which enable the efficient access control on sensitive data during emergencies. The Attribute Based Access Control paradigm is used in order to grant access to EHRs based on contextual information. We introduce an ABAC approach using personalized context handlers, in which raw contextual information can be uplifted in order to recognize critical situations and grant access to healthcare data. Results indicate that context-aware ABAC is a very effective method for detecting critical situations that require emergency access to personal health records. In comparison to RBAC implementations of emergency access control to EHRs, the proposed ABAC implementation leverages contextual information pertaining to the specific patient and emergency situations. Contextual information increases the capability of ABAC to recognize critical situations and grant access to healthcare data.

Context-Based, Predictive Access Control to Electronic Health Records

“…For example, for the health metrics of SBP current = 123 mmHg, DBP current = 72 mmHg and HR current = 94 bpm, as presented in the current values of the patient with ID 17, shown in Figure 3, we deduce the following respective criticalities of: (i) criticality (SBP current = 123 mmHg) = 33%, (ii) criticality(DBP current = 72 mmHg) = 38.61% and (iii) criticality(HR current = 94 bpm) = 63.6%. In this particular example, neither case is critical, because, as stated in our work [7], for a case to be critical, it should meet the maximum criticality percentage, which is 67% according to the specific fuzzy inferencing process. Therefore, after having calculated if the current case is critical or not, we proceed to the calculation of the criticality for next two hours.…”

“…In this study, we extend our previous work on context-aware access policies [7] by considering, apart from the patient's current health situation, the prognosis of the patient's future health status. The proposed methodology delivers an access control mechanism which relies on Attribute-based Access Control (ABAC).…”

“…In our earlier work [7], we developed context handlers governed by fuzzy rules to identify critical situations. A fuzzy context handler uses fuzzy rules that associate contextual attributes with fuzzy values and generates as output an assessment of the criticality of the incident.…”

“…For example, as In a general case, we can have the n health metrics m 1 − m n . After having defined the fuzzy sets, the fuzzy rules per fuzzy variable are defined based on our previous work [7]. An example of a fuzzy rule regarding the SBP is "If SBP is Low then Criticality is High".…”

“…Our research takes advantages of recent developments in Artificial Intelligence in solving complex technical problems, see, e.g., in engineering [4], image processing [5] and e-commerce [6]. We develop an intelligent access control mechanism, which, based on a prediction model and a personalized fuzzy context handler [7], examines recent health metrics of a patient and outputs the patient's health criticality assessment, which, in turn, controls access to the EHRs system.…”