title: Access control and privilege management in electronic health record: a systematic literature review.
abstract: This study presents a systematic literature review of access control for electronic health record systems to protect patient's privacy. Articles from 2006 to 2016 were extracted from the ACM Digital Library, IEEE Xplore Digital Library, Science Direct, MEDLINE, and MetaPress using broad eligibility criteria, and chosen for inclusion based on analysis of ISO22600. Cryptographic standards and methods were left outside the scope of this review. Three broad classes of models are being actively investigated and developed: access control for electronic health records, access control for interoperability, and access control for risk analysis. Traditional role-based access control models are extended with spatial, temporal, probabilistic, dynamic, and semantic aspects to capture contextual information and provide granular access control. Maintenance of audit trails and facilities for overriding normal roles to allow full access in emergency cases are common features. Access privilege frameworks utilizing ontology-based knowledge representation for defining the rules have attracted considerable interest, due to the higher level of abstraction that makes it possible to model domain knowledge and validate access requests efficiently.
authors.affiliation: Asia Pacific University of Technology and Innovation, Technology Park Malaysia, Bukit Jalil, 57000, Kuala Lumpur, Malaysia. manoj@apu.edu.my.
authors.forename: Manoj
authors.identifier: http://orcid.org/0000-0002-1599-965X
authors.initials: M
authors.lastname: Jayabalan
authors.affiliation: Asia Pacific University of Technology and Innovation, Technology Park Malaysia, Bukit Jalil, 57000, Kuala Lumpur, Malaysia.
authors.forename: Thomas
authors.initials: T
authors.lastname: O'Daniel
mesh_terms: D016494:Computer Security; D003219:Confidentiality; D057286:Electronic Health Records / Q000458:organization & administration*; D004630:Emergencies; D066275:Health Information Exchange; D006801:Humans; D057766:Policy
keywords: Access control; Electronic health records; IS022600; Privacy; Systematic review