Situation-Based Access Control: Privacy management via modeling of patient data access scenarios

Journal of Biomedical Informatics

Volumn 41, Issue 6, 2008, Pages 1028-1040

  Peleg, Mor ^a   Beimel, Dizza ^b   Dori, Dov ^b   Denekamp, Yaron ^c  

^a UNIVERSITY OF HAIFA   (Israel)

^b TECHNION ISRAEL INSTITUTE OF TECHNOLOGY   (Israel)

^c CARMEL MEDICAL CENTER   (Israel)

Author keywords

Access control; Conceptual model; Object Process Methodology; Ontology; Privacy preservation

Indexed keywords

HOSPITAL DATA PROCESSING; ONTOLOGY; RECORDS MANAGEMENT; SECURITY SYSTEMS;

CENTRAL PROBLEMS; CONCEPTUAL MODEL; CONCEPTUAL MODELS; DATA ACCESSES; DO-MAINS; ELECTRONIC HEALTH RECORDS; MEDICAL DOMAINS; OBJECT-PROCESS METHODOLOGY; PATIENT DATUMS; PRIVACY MANAGEMENTS; PRIVACY PRESERVATION; QUALITATIVE STUDIES; ROLE-BASED ACCESS CONTROLS; SENSITIVE DATUMS;

ACCESS CONTROL;

ARTICLE; ELECTRONIC MEDICAL RECORD; MEDICAL INFORMATICS; MEDICAL INFORMATION SYSTEM; MODEL; PATIENT CODING; PRIORITY JOURNAL; PRIVACY;

ACCESS TO INFORMATION; HUMANS; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; MODELS, THEORETICAL; PRIVACY;

EID: 55549122324     PISSN: 15320464     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jbi.2008.03.014     Document Type: Article

References (26)

1. Jones K.S. Privacy: What's different now?. Interdiscip Sci Rev 28 4 (2003) 287-292
2. Morgan R. Community Attitudes to Privacy: Office of the Australian Federal Privacy Commissioner; 2001.
3. Schauer F. Free speech and the social construction of privacy. Social Res 68 1 (2001) 221-232
4. Shapiro B., and Baker C.R. Information technology and the social construction of information privacy. J Account Public Policy 20 4-5 (2001) 295-322
5. Federrath H. Privacy enhanced technologies: methods-markets-misuse. Trust, privacy and security in digital business, LNCS; 2005. p. 1-9.
6. US Department of Health and Human Services. Summary of the HIPAA privacy rule, ; 2003 [last accessed on 1/24/2008].
7. Workgroup for Electronic Data Interchange. HIPAA Glossary, ; 2001. [last accessed on 1/24/2008].
8. McMurry A.J., Gilbert C.A., Reis B.Y., Chueh H.C., Kohane I.S., and Mandl K.D. A self-scaling, distributed information architecture for public health, research, and clinical care. J Am Med Inform Assoc 14 14 (2007) 527-533
9. Welch C.A. Sacred secrets-the privacy of medical records. N Engl J Med 345 (2001) 371-372
10. Ravera L., Colombo I., Tedeschi M., and Ravera A. Security and privacy at the private multispecialty hospital istituto clinico humanitas: strategy and reality. Intl J Med Inform 73 3 (2004) 321-324
11. Sweeney L. K-anonymity: a model for protecting privacy. Intl J Uncertainty Fuzziness, Knowledge Syst 10 5 (2002) 557-570
12. Sandhu R.S., Coyne E.J., and Youman C.E. Role-based access control models. IEEE Comput 29 2 (1996) 38-47
13. Sandhu R. The NIST Model for role-based access control: toward a unified standard. In: Proceedings of the fifth ACM workshop on role-based access control; 2000. p. 47-63.
14. Shabo A. The implications of electronic health records for personalized medicine. Pers Med 2 3 (2005) 251-258
15. Health Level Seven. HL7 Standards, ; 2007 [last accessed on 1/24/2008].
16. Committee European Normalisation. Health Informatics-Electronic healthcare record communication-Part 1: Extended architecture, ENV13606-1, CEN/TC251 Health Informatics Technical Committee; 2000. Available from .
17. DICOM. Digital imaging and communications in medicine website, ; 2000 [lastaccessed1/24/2008].
18. BBBIJoMI. Authorization and access control for electronic health record systems. Intl J Med Inform 2004;73(3):251-257.
19. France R. Security of health care records in Belgium application in a university hospital. Intl J Med Inform 73 3 (2004) 235-238
20. Haaka M., Wolffa A.C., Brandnera R., Dringsb P., Wannenmacherc M., and Wetter T. Data security and protection in cross-institutional electronic patient records. Intl J Med Inform 70 2-3 (2003) 117-130
21. Motta G., and Furuie S. A contextual role-based access control authorization model for electronic patient record. IEEE Trans Inform Technol Biomed 7 3 (2003) 202-207
22. Myers M.D. Qualitative research in information systems. MIS Q 21 2 (1997) 241-242
23. Pope C., van Royen P., and Baker R. Qualitative methods in research on healthcare quality. Qual Safety Health Care 11 2 (2002) 148-152
24. Dori D. Object-Process Methodology-a holistic systems paradigm (2002), Springer-Verlag, Berlin, Heidelberg, New York
25. Dori D, Reinhartz-Berger I, Strum A. Developing complex systems with object-process methodology using OPCAT. ER, 2003. p. 570-572.
26. Patel V.L., Kaufman D.R., and Arocha J.F. Emerging paradigms of cognition in medical decision-making. J Biomed Inform 35 1 (2002) 52-75