Combining task-and-role-based access control with multi-constraints for a medical workflow system - Mallare, Ivy Joy G.
We investigate the effects of combining Task-based and Role-based access control models for a medical workflow system. Although Role-based Access Control (RBAC) models provide a generalized approach to access control,it can not cope with the growing complexity of modern health care systems that require dynamic authorizations. Task-based access control (TBAC) can help address the need for dynamic authorizations but TBAC alone can not address healthcare access control requirements. Roles and tasks together can form a much flexible access control than roles or tasks alone. We studied the integration of TBAC and RBAC for a workflow system. Moreover, we applied multiple constraints on users, roles, and tasks. We created a prototype in OpenMRS, an open source electronic medical records system. Finally, we designed the evaluation of the system's usability based on the National Institute of Standards and Technology criteria. Our evaluation shows that our design is more secured than the usual access control of other electronic medical records systems(EMR). The testers are unanimous in concluding that our model is highly beneficial for the security of a medical application like an EMR.