Skip to main content

Advertisement

SpringerLink
Log in

The Secure Authorization Model for Healthcare Information System

  • Original Paper
  • Published:
Journal of Medical Systems Aims and scope Submit manuscript

Abstract

Exploring healthcare system for assisting medical services or transmitting patients’ personal health information in web application has been widely investigated. Information and communication technologies have been applied to the medical services and healthcare area for a number of years to resolve problems in medical management. In the healthcare system, not all users are allowed to access all the information. Several authorization models for restricting users to access specific information at specific permissions have been proposed. However, as the number of users and the amount of information grows, the difficulties for administrating user authorization will increase. The critical problem limits the widespread usage of the healthcare system. This paper proposes an approach for role-based and extends it to deal with the information for authorizations in the healthcare system. We propose the role-based authorization model which supports authorizations for different kinds of objects, and a new authorization domain. Based on this model, we discuss the issues and requirements of security in the healthcare systems. The security issues for services shared between different healthcare industries will also be discussed.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

References

  1. Haux, R., Health information systems - past, present, future. Int. J. Med. Inform. 75:268–281, 2006.

    Article  Google Scholar 

  2. Shaikh, A., Memon, M., Misbahuddin, M., and Memon, N., The role of service oriented architecture in telemedicine healthcare system. Presented at the Complex, Intelligent and Software Intensive Systems, IEEE, 2009.

  3. HIMSS, definition of an electronic health record, http://www.himss.org/ASP/topics_ehr.asp.

  4. Katehakis, D. G., Sfakianakis, S. G., Kavlentakis, G., Anthoulakis, D. N., and Tsiknakis, M., Delivering a lifelong integrated electronic health record based on a service oriented architecture. IEEE Trans. Inf. Technol. Biomed. 11(6):639–650, 2007.

    Article  Google Scholar 

  5. Anderson R. J., Security in clinical information systems. London: British Medical Association; 1996.

  6. Sandhu, R., Coyne, E. J., Feinstein, H. L., and Youman, C. E., Role based access control models. IEEE Comput. 29(2):38–48, 1996.

    Article  Google Scholar 

  7. Bertino, E., Bonatti, P. A., and Ferrari, E., TRBAC: a temporal role-based access control model. ACM Trans. Inf. Syst. Secur. 4(3):191–233, 2001.

    Google Scholar 

  8. Ferraiolo, D., Cugini, J., and Kuhn, D. R., Role based access control: features and motivations. 11th Annual Computer Security Applications Proceedings, IEEE Computer Society Press, 1995.

  9. Zhang, L., Ahn, G. J., and Chu, B. T., A role-based delegation framework for healthcare information systems. Seventh ACM Symposium on Access Control Models and Technologies, Monterey, pp. 125–134, 2002.

    Google Scholar 

  10. Han, R. F., and Wang, H. X., Research of task-role-based access control model. Comput. Eng. Des. 28(4):800–802, 2007.

    MathSciNet  Google Scholar 

  11. Tari, Z., and Chan, S. W., A role-based access control for intranet security. IEEE Internet Comput., 1(5):24–34, 1997.

    Google Scholar 

  12. Evered, M., and Bogeholz, S., A case study in access control requirements for a health information system, ACSW Frontiers '04 Proceedings of the second workshop on Australasian information security, Data Mining and Web Intelligence, and Software Internationalisation - Volume 32 pp. 53–61.

  13. Meingast, M., Roosta, T., and Sastry, S., Security and privacy issues with health care information technology. Proceedings of the 28th IEEE EMBS Annual International Conference, New York City, USA, Aug 30–Sept 3, pp.5453–5458, 2006.

  14. Martino, L. D., Ni, Q., Lin, D., and Bertino, E., Multi-domain and Privacy-aware Role Based Access Control in eHealth. Proceedings of 2nd International Conference on Pervasive Computing Technologies for Healthcare, pp.131–134, 2008.

  15. Li, W., and Hoang, D., A New Security Scheme for E-health System. Proceedings of CTS ’09 Proceedings of the 2009 International Symposium on Collaborative Technologies and Systems, pp.361–366, 2009.

  16. Hai-bo, S., and Fan, H., An Attribute-Based Access Control Model for Web Services. In the Seventh International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT’06), pp. 74–79, 2006.

  17. Qing-hai, B., and Ying, Z., Study on the access control model in information security. Presented at the Cross Strait Quad-Regional Radio Science and Wireless Technology Conference (CSQRWC), 2011.

Download references

Acknowledgments

This project was supported by the National Science Council of Taiwan (Grant No: NSC99-2221-E-320-005).

Author information

Authors and Affiliations

  1. Institute of Medical Science, Tzu Chi University, Hualien, Taiwan, Republic of China

    Wen-Shin Hsu

  2. Department of Medical Informatics, Tzu Chi University, Hualien, Taiwan, Republic of China

    Jiann-I Pan

Authors
  1. Wen-Shin Hsu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jiann-I Pan
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jiann-I Pan.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Hsu, WS., Pan, JI. The Secure Authorization Model for Healthcare Information System. J Med Syst 37, 9974 (2013). https://doi.org/10.1007/s10916-013-9974-z

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1007/s10916-013-9974-z

Keywords

Search

Navigation