Standardized access control mechanisms for protecting ISO 13606-based electronic health record systems

Calvillo-Arbizu, Jorge; Roman-Martinez, Isabel; Roa-Romero, Laura M.

doi:10.1109/bhi.2014.6864421

Cited by 7 publications

(7 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Medical records in the EHR are sensitive data and require security mechanisms to protect their privacy from attackers. In addition, the different levels and privileges of healthcare providers make the development of security mechanisms and authorisation models very difficult [4]. Moreover, applying privacy to medical records (EHR) requires the use of access models in the authorisation of users.…”

Section: Discussionmentioning

confidence: 99%

“…This standard has many of the features that qualify it for use on the Internet, such as combining policy, combining algorithm, attribute, multiple subjects, policy distribution, implementation independency and obligations [23,28,29]. This technique is based on the specific policies first and then on many modules such as policy enforcement point (PEP), policy decision point (PDP), policy administration point (PAP), policy information point (PIP), and policy retrieval point (PRP) to evaluate the request for access [4], as shown in Figure 3 (PEP sends and receives requests and accesses responses to the repository; PDP evaluates the decision; PAP creates policies based on users’ attributes; PIP retrieves users’ attributes; and PRP retrieves the users’ data from the repository). The result of the decision (permit, deny, not applicable, indeterminate) is sent to the subject via PEP [23].…”

Section: Overview Of Security and Privacy Techniques In Ehr Systemsmentioning

confidence: 99%

“…The security of medical records in the electronic health record (EHR) system has been a major focus of health and academic institutions, since the efficiency and quality of patients’ data management [1,3] by using the World Wide Web. EHR systems include identifications and patients’ data that require authorisation privileges to determine access control for authorised users [4]. Accurate medical data is essential for diagnosing diseases and determining the condition of patients during their online transfer from patient to healthcare provider [5,6].…”

Section: Introductionmentioning

confidence: 99%

“…The use of patients’ data for various purposes, such as consultations, access by a relative or caregiver, research, and emergency (secondary or indirect use) is a major challenge for authorisation systems; for example, the researcher should not exceed the limits of privacy granted to him/her [4]. In an emergency, when the patients’ doctor is unavailable or the patient does not have the capacity to give consent to another doctor, the patient’s privacy is seriously compromised [9].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

PAX: Using Pseudonymization and Anonymization to Protect Patients’ Identities and Data in the Healthcare System

Al-Zubaidie

Zhang

2019

IJERPH

View full text Add to dashboard Cite

Electronic health record (EHR) systems are extremely useful for managing patients' data and are widely disseminated in the health sector. The main problem with these systems is how to maintain the privacy of sensitive patient information. Due to not fully protecting the records from unauthorised users, EHR systems fail to provide privacy for protected health information. Weak security measures also allow authorised users to exceed their specific privileges to access medical records. Thus, some of the systems are not a trustworthy source and are undesirable for patients and healthcare providers. Therefore, an authorisation system that provides privacy when accessing patients' data is required to address these security issues. Specifically, security and privacy precautions should be raised for specific categories of users, doctor advisors, physician researchers, emergency doctors, and patients' relatives. Presently, these users can break into the electronic systems and even violate patients' privacy because of the privileges granted to them or the inadequate security and privacy mechanisms of these systems. To address the security and privacy problems associated with specific users, we develop the Pseudonymization and Anonymization with the XACML (PAX) modular system, which depends on client and server applications. It provides a security solution to the privacy issues and the problem of safe-access decisions for patients' data in the EHR. The~results of theoretical and experimental security analysis prove that PAX provides security features in preserving the privacy of healthcare users and is safe against known attacks.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Overview Of Security and Privacy Techniques In Ehr Systemsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

PAX: Using Pseudonymization and Anonymization to Protect Patients’ Identities and Data in the Healthcare System

Al-Zubaidie

Zhang

2019

IJERPH

View full text Add to dashboard Cite

show abstract

“…In the meantime, very little effort is spent describing how to log in to a remote server to retrieve the policy model in the first place. Nevertheless, work has been done to realise an access control model based on the standard [34].…”

Section: Loginmentioning

confidence: 99%

An Electronic Healthcare Record Server Implemented in PostgreSQL

Austin

Sun

Lim

et al. 2015

Journal of Healthcare Engineering

View full text Add to dashboard Cite

This paper describes the implementation of an Electronic Healthcare Record server inside a PostgreSQL relational database without dependency on any further middleware infrastructure. The five-part international standard for communicating healthcare records (ISO EN 13606) is used as the information basis for the design of the server. We describe some of the features that this standard demands that are provided by the server, and other areas where assumptions about the durability of communications or the presence of middleware lead to a poor fit. Finally, we discuss the use of the server in two real-world scenarios including a commercial application.

show abstract

Access control solutions in electronic health record systems: A systematic review

Cobrado,

Sharief,

Regahal

et al. 2024

Informatics in Medicine Unlocked

View full text Add to dashboard Cite

Standardized access control mechanisms for protecting ISO 13606-based electronic health record systems

Cited by 7 publications

References 6 publications

PAX: Using Pseudonymization and Anonymization to Protect Patients’ Identities and Data in the Healthcare System

PAX: Using Pseudonymization and Anonymization to Protect Patients’ Identities and Data in the Healthcare System

An Electronic Healthcare Record Server Implemented in PostgreSQL

Access control solutions in electronic health record systems: A systematic review

Contact Info

Product

Resources

About