title: Security middleware infrastructure for DICOM images in health information systems.
abstract: In health care, it is mandatory to maintain the privacy and confidentiality of medical data. To achieve this, a fine-grained access control and an access log for accessing medical images are two important aspects that need to be considered in health care systems. Fine-grained access control provides access to medical data only to authorized persons based on priority, location, and content. A log captures each attempt to access medical data. This article describes an overall middleware infrastructure required for secure access to Digital Imaging and Communication in Medicine (DICOM) images, with an emphasis on access control and log maintenance. We introduce a hybrid access control model that combines the properties of two existing models. A trust relationship between hospitals is used to make the hybrid access control model scalable across hospitals. We also discuss events that have to be logged and where the log has to be maintained. A prototype of security middleware infrastructure is implemented.
authors.affiliation: Department of Computer Science, University of Manitoba, 561 Machray Hall, Winnipeg, Manitoba R3T 2N2, Canada. Vijay@cs.umanitoba.ca
authors.forename: Vijay N V
authors.initials: VN
authors.lastname: Kallepalli
authors.forename: Sylvanus A
authors.initials: SA
authors.lastname: Ehikioya
authors.forename: Sergio
authors.initials: S
authors.lastname: Camorlinga
authors.forename: Jose A
authors.initials: JA
authors.lastname: Rueda
mesh_terms: D022126:Access to Information / Q000331:legislation & jurisprudence; D002170:Canada; D003195:Computer Communication Networks / Q000331:legislation & jurisprudence; D016494:Computer Security / Q000331:legislation & jurisprudence; D003219:Confidentiality / Q000331:legislation & jurisprudence; D003628:Database Management Systems / Q000331:legislation & jurisprudence; D019983:Guideline Adherence / Q000331:legislation & jurisprudence; D020408:Health Insurance Portability and Accountability Act / Q000331:legislation & jurisprudence; D006751:Hospital Information Systems / Q000331:legislation & jurisprudence; D006801:Humans; D016347:Medical Records Systems, Computerized / Q000331:legislation & jurisprudence; D011873:Radiology Information Systems / Q000331:legislation & jurisprudence; D012815:Signal Processing, Computer-Assisted; D014481:United States