Lakkaraju, Sandeep Kumar

English

Healthcare information systems deal with sensitive data across complex workflows. They often allow various stakeholders from different environments to access data across organizational boundaries. This elevates the risk of exposing sensitive healthcare information to unauthorized personnel, leading ‘controlling access to resources’ a major concern. To prevent unwanted access to sensitive information, healthcare organizations need to adopt effective workflows and access control mechanisms. It is well-known that aligning security policies with business objectives is a challenging task. As of now, many healthcare organizations are mainly using role based access control. It is important for them to develop workflows and properly assign roles to tasks without the policies causing obstructions. Also many healthcare organizations are not yet considering or do not know how to accommodate the ‘context’ element as a crucial element in their workflows and access control policies. We envision the future of healthcare where ‘context’ will be considered as a crucial element. We can accommodate context through a new element ‘environment’ in workflows, and can accommodate context in policies through well-known attribute based access control mechanism (ABAC). As of now, it is hard to identify what policies are being applied on a particular workflow activity, and also it is hard to identify if all of the access policies are being used and which of those policies are not being used. This dissertation mainly addresses these problems by developing two methodologies one for each scenario: (i) analyzing workflow instances for obstructions due to static and dynamic authorization policies through a new algorithm that allows organizations to properly assign users to tasks without the policies causing obstructions, and (ii) identifying workflow activities that are not being protected by access control policies and improving the workflow activities and/or existing access control policies through integrating workflow activities and attribute based access control policies using SARE (Subject, Action, Resource, and environment) elements

Beadle Scholar at Dakota State University

Analysis of Healthcare Workflows in Accordance with Access Control Policies

https://scholar.dsu.edu/cgi/viewcontent.cgi?article=1294&amp;context=theses

Analysis of Healthcare Workflows in Accordance with Access Control Policies

Abstract

Similar works

Full text

Available Versions

Beadle Scholar at Dakota State University