Achieving Patient-Centered Fine-Grained Access Control in Hospital Information Systems - Using Business Process Management Systems

Abstract

Access Control to patients' medical information in Hospital Information Systems (HIS) is a challenge in modern Patient-Centered (PC) healthcare. Fine-Grained Access Control (FGAC) in particular has been identified as one of the security requirements in these systems. In FGAC, only parts of medical information that are relevant and required by healthcare providers are accessed at the point of care. This cannot be achieved without a holistic view of a medical condition through a Patient-Centered Fine-Grained Access Control (PCFGAC), in which patient-centricity is considered. This research proposes using Business Process Management (BPM) to achieve PCFGAC in order to provide a real-time access control based on a "need-to-know" principle. Through a prototype that uses BPM, security requirements of PCFGAC were met. These include: authority control, informed decision support, fine-grained access control, and dynamic policies support. Thus, a contribution to the knowledge and practice has been introduced.

Business Process Management for optimizing clinical processes: A systematic literature review

“…42,[45][46][47][48][49][50][51][52][53][54] The third author (D.R) with a tiebreaking vote decided the inclusion of six of them in the final selection. 49,50,[54][55][56][57][58][59][60][61][62][63][64][65][66][67][68][69][70] (see Table 2). In Figure 2, a diagram of the selection procedure is described.…”

“…Most of them introduced qualitative improvements such as the redesign or standardization of the processes through BPMN. 49,50,54,57,58,60,61,62,64,66,70 The BPMN notation language allows us to define different diagrams that model the clinical process in a workflow format, which can be combined according to the needs of the process. Besides, BPMN is independent of the methodology implemented for the modeling of processes and allows them to be modeled in a unified and standardized way allowing the understanding between all the people involved.…”

“…57,58,60,61,65,67,69,70 In addition, BPMS include an integration module that allows interoperating with other disparate health information systems, generally electronic health record systems. 55,56,58,61,62,64,65,67,70 In other cases, this BPMS behaved as decision support systems to help clinicians in decision making 58,61,62,64,70 along with additional functionalities such as satisfy security requirements in the healthcare domain. 64 Table 3 quantifies the specific goals achieved in the selected papers.…”

“…55,56,58,61,62,64,65,67,70 In other cases, this BPMS behaved as decision support systems to help clinicians in decision making 58,61,62,64,70 along with additional functionalities such as satisfy security requirements in the healthcare domain. 64 Table 3 quantifies the specific goals achieved in the selected papers.…”

Secure and Effective Consent System

“…However, some researchers have proposed security technologies without considering these specificities; the research area of 'patient-controlled (or centered) EHR system' assumes that data owner is the patient and the management/decision on disclosing the data to others is also up to the patient (Szolovits 1994, Eom 2016, Omotosho 2017, Vimalachandran 2017, Seol 2018, Ming 2018, AlThqafi 2016. In (Eom 2016), even a doctor or service provider cannot access the patient's information without patient's consent even if the information was written or produced by the doctor or medical staffs.…”