Access control in healthcare: the methodology from legislation to practice.
Translating legislation and regulations into access control systems in healthcare is, in practice, not a straightforward task. Excessive regulation can create barriers to appropriate patient treatment. The main objective of this paper is to present a new methodology that can define, from legislation to practice, an access control policy as well as a RBAC model, in order to comprise generic legislation and regulation issues together with the access control needs from the ends users of a healthcare information system. The methodology includes the use of document analysis as well as grounded theory and mixed methods research. This methodology can be easily applied within a healthcare practice or any other domain with similar requirements. It helps to bridge the gap between legislation and end users' needs, while integrating information security into the healthcare processes in a more meaningful way.
Ferreira
Ana
A
School of Computing, University of Kent, Canterbury, UK.
Correia
Ricardo
R
Chadwick
David
D
Antunes
Luis
L
D016494:Computer Security / Q000331:legislation & jurisprudence* / Q000639:trends; D003219:Confidentiality / Q000331:legislation & jurisprudence* / Q000639:trends; D057286:Electronic Health Records / Q000331:legislation & jurisprudence* / Q000639:trends; D006297:Health Services Accessibility / Q000331:legislation & jurisprudence* / Q000639:trends; D011174:Portugal; D010818:Practice Patterns, Physicians' / Q000331:legislation & jurisprudence* / Q000639:trends