A Contextual Model to Integrate Healthcare Workflows and Access Control Policies

A Contextual Model to Integrate Healthcare Workflows and Access Control Policies

Sandeep Kumar Lakkaraju, Dianxiang Xu, Yong Wang
Copyright: © 2018 |Pages: 22
DOI: 10.4018/978-1-5225-5460-8.ch005
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

In a complex healthcare world, health information technology integrated workflows play a crucial role in improving healthcare workflow efficiency. Healthcare organizations often allow various stakeholders to access sensitive data across organizational boundaries. This increases the need to secure and restrict access to this sensitive data. In a complex environment like healthcare, the need for access to data highly depends on context, and many of the traditional access control mechanisms cannot accommodate “context.” In this process, there is need for healthcare organizations to look for more efficient access control mechanisms which work in accordance with workflows and accommodates “context” as a critical element. As a solution to this problem, this chapter presents a model to integrate workflows and access control policies and thereby identifying workflow activities that are not being protected by access control policies and improving the workflow activities and/or existing access control policies using SARE (subject, action, resource, and environment) elements.
Chapter Preview
Top

Introduction

The wide adoption of information technology across healthcare organizations has increased the need for developing efficient workflows. Literature shows that healthcare organizations should develop efficient workflows by integrating health information technology (HIT) in their workflows to have more success rate in adopting HIT in their organizations (Bowens, Frye, & Jones, 2010). Effective care delivery is possible through workflows with competent activities (Campbell, Sittig, Ash, Guappone, & Dykstra, 2006). Nevertheless, security and privacy of healthcare information have become major challenges for healthcare organizations (Akinyele et al., 2011; Alhaqbani & Fidge, 2007; Ozair, et al., 2015). In particular, effective access control mechanisms are needed to protect sensitive information from being exposed to unauthorized personnel.

Workflows

Workflows are used to describe the pattern of tasks to be executed by users to achieve business objectives. According to Welch (2014), “Efficient clinical workflow saves time, saves money, and saves lives. And in today’s industry, workflow can have a significant effect on reimbursement”. Workflows can be very complicated, especially in a complex environment like healthcare which may involve various subjects trying to perform actions on certain resources in multiple environments, thus requires controlling the access of resources by subjects. For a subject to perform an action on a resource in an environment, that subject should be authorized to perform the intended action. In this research, Business Process Modeling Notation (BPMN) has been used to develop workflows. BPMN is visualization for business process workflows (Respício & Domingos, 2015). The various elements of BPMN are given in Figure 1. We use four types of elements, defined as follows: Events that can be start or finish, distinguishable by size of circles; Activities (Tasks) have an “id” (A1; A2 etc.) and possibly user icons on the upper right corner of the rectangle, and groups indicate a group of activities; Gateways are diamond-shaped, with multiple input channels; Conditional gateways are plain diamonds with only one output channel that is based on the evaluation of a condition; Parallel gateways have diamonds with a ‘+’ sign inside. They have multiple input/output channels indicating that control flows on those channels in parallel; Sequences (flows) link tasks together, and associations are used to associate activities with flow objects; some of the extra events used are also shown in Figure 1 representing Binding of Duties (BOD) policy and Separation of Duty (SOD) policy, and a release event.

Figure 1.

Workflow elements

978-1-5225-5460-8.ch005.f01

According to Agency for Healthcare Research and Quality (AHRQ, 2017), “Workflow is the sequence of physical and mental tasks performed by various people within and between work environments. It can occur at several levels (one person, between people, across organizations) and can occur sequentially or simultaneously”. These workflows have to be executed in a secure way, which is made possible through access control.

Complete Chapter List

Search this Book:
Reset