A Clark-Wilson and ANSI role-based access control model. (15th June 2020)

• Record Type: Journal Article
• Authors: Tsegaye, Tamir; Flowerday, Stephen
• Is Part Of: Information and computer security. Volume 28:Number 3(2020)
• Page Start: 373
• Page End: 395
• Publication Date: 2020-06-15
• Subjects: Access control -- Role-based access control -- Attribute-based access control -- Clark-Wilson -- Security -- Privacy -- Electronic health record; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-08-2019-0100
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: An electronic health record (EHR) enables clinicians to access and share patient information electronically and has the ultimate goal of improving the delivery of healthcare. However, this can create security and privacy risks to patient information. This paper aims to present a model for securing the EHR based on role-based access control (RBAC), attribute-based access control (ABAC) and the Clark-Wilson model. Design/methodology/approach: A systematic literature review was conducted which resulted in the collection of secondary data that was used as the content analysis sample. Using the MAXQDA software program, the secondary data was analysed quantitatively using content analysis, resulting in 2, 856 tags, which informed the discussion. An expert review was conducted to evaluate the proposed model using an evaluation framework. Findings: The study found that a combination of RBAC, ABAC and the Clark-Wilson model may be used to secure the EHR. While RBAC is applicable to healthcare, as roles are linked to an organisation's structure, its lack of dynamic authorisation is addressed by ABAC. Additionally, key concepts of the Clark-Wilson model such as well-formed transactions, authentication, separation of duties and auditing can be used to secure the EHR. Originality/value: Although previous studies have been based on a combination of RBAC and ABAC, this study also uses key concepts of the Clark-Wilson model for securing the EHR. Countries implementing the EHR can use the model proposed by this study to help secure the EHR while also providing EHR access in a medical emergency.