title: Distributed clinical data sharing via dynamic access-control policy transformation.
abstract: BACKGROUND
  Data sharing in electronic health record (EHR) systems is important for improving the quality of healthcare delivery. Data sharing, however, has raised some security and privacy concerns because healthcare data could be potentially accessible by a variety of users, which could lead to privacy exposure of patients. Without addressing this issue, large-scale adoption and sharing of EHR data are impractical. The traditional solution to the problem is via encryption. Although encryption can be applied to access control, it is not applicable for complex EHR systems that require multiple domains (e.g. public and private clouds) with various access requirements.
  
  
  OBJECTIVE
  This study was carried out to address the security and privacy issues of EHR data sharing with our novel access-control mechanism, which captures the scenario of the hybrid clouds and need of access-control policy transformation, to provide secure and privacy-preserving data sharing among different healthcare enterprises.
  
  
  METHODS
  We introduce an access-control mechanism with some cryptographic building blocks and present a novel approach for secure EHR data sharing and access-control policy transformation in EHR systems for hybrid clouds.
  
  
  RESULTS
  We propose a useful data sharing system for healthcare providers to handle various EHR users who have various access privileges in different cloud environments. A systematic study has been conducted on data sharing in EHR systems to provide a solution to the security and privacy issues.
  
  
  CONCLUSIONS
  In conclusion, we introduce an access-control method for privacy protection of EHRs and EHR policy transformation that allows an EHR access-control policy to be transformed from a private cloud to a public cloud. This method has never been studied previously in the literature. Furthermore, we provide a protocol to demonstrate policy transformation as an application scenario.
authors.affiliation: Centre for Computer and Information Security Research, School of Computing and Information Technology, University of Wollongong, NSW, Australia. Electronic address: fr683@uowmail.edu.au.
authors.forename: Fatemeh
authors.initials: F
authors.lastname: Rezaeibagha
authors.affiliation: Centre for Computer and Information Security Research, School of Computing and Information Technology, University of Wollongong, NSW, Australia.
authors.forename: Yi
authors.initials: Y
authors.lastname: Mu
mesh_terms: D022126:Access to Information; D000465:Algorithms; D016494:Computer Security / Q000592:standards*; D003219:Confidentiality; D057286:Electronic Health Records / Q000331:legislation & jurisprudence* / Q000458:organization & administration / Q000592:standards*; D006291:Health Policy; D006801:Humans; D033181:Information Dissemination / Q000331:legislation & jurisprudence*; D016247:Information Storage and Retrieval; D020407:Internet; D018907:Privacy
keywords: Access control; Data sharing; EHR; Encryption; Privacy; Security