title: Access control in healthcare: the methodology from legislation to practice.
abstract: Translating legislation and regulations into access control systems in healthcare is, in practice, not a straightforward task. Excessive regulation can create barriers to appropriate patient treatment. The main objective of this paper is to present a new methodology that can define, from legislation to practice, an access control policy as well as a RBAC model, in order to comprise generic legislation and regulation issues together with the access control needs from the ends users of a healthcare information system. The methodology includes the use of document analysis as well as grounded theory and mixed methods research. This methodology can be easily applied within a healthcare practice or any other domain with similar requirements. It helps to bridge the gap between legislation and end users' needs, while integrating information security into the healthcare processes in a more meaningful way.
authors.affiliation: School of Computing, University of Kent, Canterbury, UK.
authors.forename: Ana
authors.initials: A
authors.lastname: Ferreira
authors.forename: Ricardo
authors.initials: R
authors.lastname: Correia
authors.forename: David
authors.initials: D
authors.lastname: Chadwick
authors.forename: Luis
authors.initials: L
authors.lastname: Antunes
mesh_terms: D016494:Computer Security / Q000331:legislation & jurisprudence* / Q000639:trends; D003219:Confidentiality / Q000331:legislation & jurisprudence* / Q000639:trends; D057286:Electronic Health Records / Q000331:legislation & jurisprudence* / Q000639:trends; D006297:Health Services Accessibility / Q000331:legislation & jurisprudence* / Q000639:trends; D011174:Portugal; D010818:Practice Patterns, Physicians' / Q000331:legislation & jurisprudence* / Q000639:trends