Analysis of Healthcare Workflows in Accordance with Access Control Policies

Analysis of Healthcare Workflows in Accordance with Access Control Policies

Sandeep Lakaraju, Dianxiang Xu, Yong Wang
Copyright: © 2020 |Pages: 23
DOI: 10.4018/978-1-7998-1204-3.ch069
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

Healthcare information systems deal with sensitive data across complex workflows. They often allow various stakeholders from different environments to access data across organizational boundaries. This elevates the risk of exposing sensitive healthcare information to unauthorized personnel, leading ‘controlling access to resources' a major concern. To prevent unwanted access to sensitive information, healthcare organizations need to adopt effective workflows and access control mechanisms. Many healthcare organizations are not yet considering or do not know how to accommodate the ‘context' element as a crucial element in their workflows and access control policies. The authors envision the future of healthcare where ‘context' will be considered as a crucial element. They can accommodate context through a new element ‘environment' in workflows, and can accommodate context in policies through well-known attribute based access control mechanism (ABAC). This research mainly addresses these problems by proposing a model to integrate workflows and access control policies and thereby identifying workflow activities that are not being protected by access control policies and improving the workflow activities and/or existing access control policies using SARE (Subject, Action, Resource, and environment) elements.
Chapter Preview
Top

Introduction

The wide adoption of information technology across healthcare organizations has increased the need for developing efficient workflows. Literature has shown that healthcare organizations with efficient workflows have more success rate in adopting healthcare information technology (HIT) into their organizations (Sittig, Krall, Kaalaas-Sittig, & Ash, 2005). Effective care delivery is possible through workflows with competent activities (Campbell, Sittig, Ash, Guappone, & Dykstra, 2006). Nevertheless, security and privacy of healthcare information have become major challenges for healthcare organizations (Akinyele et al., 2011; Alhaqbani & Fidge, 2007). In particular, effective access control mechanisms are needed to protect sensitive information from being exposed to unauthorized personnel.

Workflows

Workflows are used to describe the pattern of tasks to be executed by users to achieve business objectives. According to Welch (2014), “Efficient clinical workflow saves time, saves money, and saves lives. And in today’s industry, workflow can have a significant effect on reimbursement”. Workflows can be very complicated, especially in a complex environment like healthcare which may involve various subjects trying to perform actions on certain resources in multiple environments, thus requires controlling the access of resources by subjects. For a subject to perform an action on a resource in an environment, that subject should be authorized to perform the intended action. In this research, Business Process Modeling Notation (BPMN) has been used to develop workflows. BPMN (Business Process Modeling Notation) is visualization for business process workflows (Giaglis, 2001). The various elements of BPMN are given in Figure 1. We use four types of elements, defined as follows: Events that can be start or finish, distinguishable by size of circles; Activities (Tasks) have an “id” (A1; A2 etc.) and possibly user icons on the upper right corner of the rectangle, and groups indicate a group of activities; Gateways are diamond shaped, with multiple input channels; Conditional gateways are plain diamonds with only one output channel that is based on the evaluation of a condition; Parallel gateways have diamonds with a ‘+’ sign inside. They have multiple input/output channels indicating that control flows on those channels in parallel; Sequences (flows) link tasks together, and associations are used to associate activities with flow objects; some of the extra events used are also shown in the Figure 1 representing Binding of Duties (BOD) policy and Separation of Duty (SOD) policy, and a release event.

Figure 1.

Workflow elements

978-1-7998-1204-3.ch069.f01

A workflow involves execution of a series of certain activities which help in achieving a goal (Chaari, Biennier, Amar, & Favrel, 2004). These workflows have to be executed in a secure way, which is made possible through access control.

Access Control

Inter-organizational systems allow users to access and share data beyond organizational boundaries and therefore needs proper authorization mechanisms to protect sensitive information from being exposed to unauthorized personnel. An access control policy defines the conditions to which access to resources can be granted and to whom (Ferreira, Cruz-Correia, Antunes, & Chadwick, 2007). With the increasing complexity of information systems, access control methods have evolved from Mandatory Access Control (MAC), Discretionary Access Control (DAC), Task Based Access Control (TBAC), Context Based Access Control (CBAC), Role-Based Access Control (RBAC), to Attribute-Based Access Control (ABAC) (Xu & Zhang, 2014).

Complete Chapter List

Search this Book:
Reset