Audit-Based Access Control for Electronic Health Records

M.A.C. Dekker; S. Etalle

doi:10.1016/j.entcs.2006.08.028

Audit-Based Access Control for Electronic Health Records

M.A.C. Dekker, S. Etalle

Research output: Contribution to journal › Conference article › Academic › peer-review

38 Citations (Scopus)

71 Downloads (Pure)

Abstract

Traditional access control mechanisms aim to prevent illegal actions a-priori occurrence, i.e.before granting a request for a document. There are scenarios however where the security decision can not be made on the fly. For these settings we developed a language and a framework for a-posteriori access control. In this paper we show how the framework can be used in a practical scenario. In particular, we work out the example of an Electronic Health Record (EHR) system, we outline the full architecture needed for audit-based access control and we discuss the requirements and limitations of this approach concerning the underlying infrastructure and its users.

Original language	English
Pages (from-to)	221-236
Number of pages	15
Journal	Electronic notes in theoretical computer science
Volume	168
DOIs	https://doi.org/10.1016/j.entcs.2006.08.028
Publication status	Published - Sept 2006
Event	2nd International Workshop on Views on Designing Complex Architectures, VODCA 2006 - Bertinoro, Italy Duration: 16 Sept 2006 → 17 Sept 2006 Conference number: 2

Keywords

SCS-Cybersecurity
Distributed access control
Audit
Accountability
Electronic Health Record (EHR) systems

Access to Document

10.1016/j.entcs.2006.08.028Licence: CC BY-NC-ND

Dekker2007audit-basedFinal published version, 327 KBLicence: CC BY-NC-ND

38 Citations
1 Report

Audit-Based Access Control for Electronic Health Records
Dekker, M. A. C. & Etalle, S., 1 Jul 2006, Enschede: Centre for Telematics and Information Technology (CTIT). 16 p. (CTIT Technical Report Series; no. 06-49)
Research output: Book/Report › Report › Professional

Open Access
File

Cite this

@article{ec6d9f1a3296477f8d67e9e573081635,

title = "Audit-Based Access Control for Electronic Health Records",

abstract = "Traditional access control mechanisms aim to prevent illegal actions a-priori occurrence, i.e.before granting a request for a document. There are scenarios however where the security decision can not be made on the fly. For these settings we developed a language and a framework for a-posteriori access control. In this paper we show how the framework can be used in a practical scenario. In particular, we work out the example of an Electronic Health Record (EHR) system, we outline the full architecture needed for audit-based access control and we discuss the requirements and limitations of this approach concerning the underlying infrastructure and its users.",

keywords = "SCS-Cybersecurity, Distributed access control, Audit, Accountability, Electronic Health Record (EHR) systems",

author = "M.A.C. Dekker and S. Etalle",

year = "2006",

month = sep,

doi = "10.1016/j.entcs.2006.08.028",

language = "English",

volume = "168",

pages = "221--236",

journal = "Electronic notes in theoretical computer science",

issn = "1571-0661",

publisher = "Elsevier",

note = "2nd International Workshop on Views on Designing Complex Architectures, VODCA 2006, VODCA ; Conference date: 16-09-2006 Through 17-09-2006",

}

TY - JOUR

T1 - Audit-Based Access Control for Electronic Health Records

AU - Dekker, M.A.C.

AU - Etalle, S.

N1 - Conference code: 2

PY - 2006/9

Y1 - 2006/9

N2 - Traditional access control mechanisms aim to prevent illegal actions a-priori occurrence, i.e.before granting a request for a document. There are scenarios however where the security decision can not be made on the fly. For these settings we developed a language and a framework for a-posteriori access control. In this paper we show how the framework can be used in a practical scenario. In particular, we work out the example of an Electronic Health Record (EHR) system, we outline the full architecture needed for audit-based access control and we discuss the requirements and limitations of this approach concerning the underlying infrastructure and its users.

AB - Traditional access control mechanisms aim to prevent illegal actions a-priori occurrence, i.e.before granting a request for a document. There are scenarios however where the security decision can not be made on the fly. For these settings we developed a language and a framework for a-posteriori access control. In this paper we show how the framework can be used in a practical scenario. In particular, we work out the example of an Electronic Health Record (EHR) system, we outline the full architecture needed for audit-based access control and we discuss the requirements and limitations of this approach concerning the underlying infrastructure and its users.

KW - SCS-Cybersecurity

KW - Distributed access control

KW - Audit

KW - Accountability

KW - Electronic Health Record (EHR) systems

U2 - 10.1016/j.entcs.2006.08.028

DO - 10.1016/j.entcs.2006.08.028

M3 - Conference article

SN - 1571-0661

VL - 168

SP - 221

EP - 236

JO - Electronic notes in theoretical computer science

JF - Electronic notes in theoretical computer science

T2 - 2nd International Workshop on Views on Designing Complex Architectures, VODCA 2006

Y2 - 16 September 2006 through 17 September 2006

ER -

Audit-Based Access Control for Electronic Health Records

Abstract

Keywords

Access to Document

Fingerprint

Research output

Audit-Based Access Control for Electronic Health Records

Cite this