RUBAC: Proposed Access Control for Flexible Utility–Privacy Model in Healthcare
摘要
With the rapid advancement of healthcare analytics, the need of security of privacy of health data is extremely needed. Electronic health record (abbreviated as EHR) is a communication tool which supports the services such as early prediction of disease, clinical decision support system, and personalized healthcare through intelligent mechanism such as artificial intelligence, and machine and deep learning. With the advent of the ICT and availability of big data in the healthcare systems, the privacy concerns are raised. Developing an access control model EHR is one of the solutions to preserve the privacy and confidentiality of the data. There are umpteen number of access control models such as RBAC and MAC have been invented. The said models are security focused meaning their primary focus is to provide security to health data which differs from safeguarding privacy of personal information in health records. Although tremendous amount of work has been done around access control models for preserving privacy, there a still a space for improvement in terms of effective access of data through better access control model. In addition, most of the access control models for past are static and do not consider the case wherein the privacy–utility of the EHR changes according to the requirement of healthcare organizations. This paper presents a risk- and utility-based access control (henceforth called RUBAC) model for flexible privacy–utility situation in healthcare. The proposed privacy-enabled model consists of three major entities, viz. risk and utility factors (X-axis), data access scenarios (Y-axis) and roles (Z-axis). All the entities are flexible. The model is evaluated against uses case and the 25 criteria given in [