title: A Framework for Context Sensitive Risk-Based Access Control in Medical Information Systems.
abstract: Since the access control environment has changed and the threat of insider information leakage has come to the fore, studies on risk-based access control models that decide access permissions dynamically have been conducted vigorously. Medical information systems should protect sensitive data such as medical information from insider threat and enable dynamic access control depending on the context such as life-threatening emergencies. In this paper, we suggest an approach and framework for context sensitive risk-based access control suitable for medical information systems. This approach categorizes context information, estimating and applying risk through context- and treatment-based permission profiling and specifications by expanding the eXtensible Access Control Markup Language (XACML) to apply risk. The proposed framework supports quick responses to medical situations and prevents unnecessary insider data access through dynamic access authorization decisions in accordance with the severity of the context and treatment.
authors.affiliation: Computer Science and Engineering, Sogang University, Seoul 121-742, Republic of Korea.
authors.forename: Donghee
authors.initials: D
authors.lastname: Choi
authors.affiliation: Agency for Defense Development, Daejeon 305-600, Republic of Korea.
authors.forename: Dohoon
authors.initials: D
authors.lastname: Kim
authors.affiliation: Computer Science and Engineering, Sogang University, Seoul 121-742, Republic of Korea.
authors.forename: Seog
authors.initials: S
authors.lastname: Park
mesh_terms: D022126:Access to Information; D019295:Computational Biology; D016494:Computer Security; D003219:Confidentiality; D066275:Health Information Exchange; D063005:Health Information Systems; D006801:Humans; D016347:Medical Records Systems, Computerized; D012306:Risk; D012984:Software