title: Role prediction using Electronic Medical Record system audits.
abstract: Electronic Medical Records (EMRs) provide convenient access to patient data for parties who should have it, but, unless managed properly, may also provide it to those who should not. Distinguishing the two is a core security challenge for EMRs. Strategies proposed to address these problems include Role Based Access Control (RBAC), which assigns collections of privileges called roles to users, and Experience Based Access Management (EBAM), which analyzes audit logs to determine access rights. In this paper, we integrate RBAC and EBAM through an algorithm, called Roll-Up, to manage roles effectively. In doing so, we introduce the concept of "role prediction" to identify roles from audit data. We apply the algorithm to three months of logs from Northwestern Memorial Hospital's Cerner system with approximately 8000 users and 140 roles. We demonstrate that existing roles can be predicted with 50% accuracy and intelligent grouping of roles through Roll-Up can facilitate 65% accuracy.
authors.affiliation: Dept. of Electrical Engineering & Computer Science, Vanderbilt University, Nashville, TN, USA.
authors.forename: Wen
authors.initials: W
authors.lastname: Zhang
authors.forename: Carl A
authors.initials: CA
authors.lastname: Gunter
authors.forename: David
authors.initials: D
authors.lastname: Liebovitz
authors.forename: Jian
authors.initials: J
authors.lastname: Tian
authors.forename: Bradley
authors.initials: B
authors.lastname: Malin
mesh_terms: D000465:Algorithms; D016494:Computer Security; D057286:Electronic Health Records; D006801:Humans; D008485:Medical Audit; D016347:Medical Records Systems, Computerized