ACWP Motivation

IHE White Paper on Access Control

Motivation

Privacy and Data Security

• medical data is classified as personal data and therefore demands for protection with respect to confidentiality
• various legal restrictions apply to the use of medical data. These regulations have different motivation:
  • protecting the patient's privacy and right to self-determination (e. g. HIPPA in the US and the European privacy directive)
  • ensuring the integrity and proper handling of health data (e. g. regulations for the handling of radiologic data)
  • enforcing the prevention of risks (e. g. law suits) within organizations (e. g. KonTraG in Germany)
• these regulations can bee seen (and implemented) as sets of rules (policies) that have to be considered whenever patient data is processed either within a medical organization or whithin a network of medical organizations
• the authority for these policies is distributed among the stakeholders (e. g. patient, medical staff, governmental organizations) and policies come with forms (e. g. written consent, laws and regulations, medical treatment contracts, job profiles), but the responsibility for their proper enforcement is always with the organizations that hold and process the data
• therefore: Each organization that holds and/or processes medical data has to think about restricting access to this data with respect to the policies that hold for this data

Needs-to-Know Principle

• the objective of access control is to enable every medical staff member to perform all data processing operations that he needs to do in order to fill his role within the medical treatment process - but no more!
• the organization of labour and separation of duty within a medical organization or a healthcare network determines who is allowed to perform what (medical) activities within which contexts (e. g. for what purpuses)
• Permissions for the processing of medical data are derived from the permitted activities of a role within a certain context. Following the needs-to-know principle these permissions reflect the operations on medical data which are part of the activity.
• Access control should always follow the needs-to-know principle. Therefore the objective is that the set of permitted operations of a user always contains the permissions that are required to fill the current job role.
• The needs-to-know principle couples permissions with the organization of labour. Therefore the permissions granted by an access control system that follows the needs-to-know principle are always as compliant with legal regulations and privacy restrictions as the underlying organization of work. If the orhganization of work within a medical organization or within amedical network violates legal regulations or a patient's consent, the access control system will implicitly do so as well.
• The needs-to-know principle has impact on the design of an access control system, because it differentiates between restrictions on the assignment of people to activities and restrictions on the accessability of medical data within certain activities. In an ideal access control system a patient consent should always focus on the first (e. g. by opting-in or -out certain people, job roles, or organizations from performing a medical activity) while resource protection should focus on the second (e. g. by stating clear rules which activities require which permissions).

Authors Note: We will come back to this during the discussion of the various access control paradigms, because this statement implies a strong relationship between patient consents and discretionary access control

---

Discussion

place issues to be discussed among the editorial team here...

Change Requests

place your change requests here...