Context And Role Based Dynamic Access Control In Distributed Healthcare Information Systems

This research was aimed at devising a means by which access control in health care information systems could be improved by developing and implementing an access control model that extends the core RBAC-principle. Designed in the form of an experimental research, it was based on the medical record-keeping practices of the University of Abuja Teaching Hospital (UATH), Nigeria and was carried out in four phases. The first was understudying the health information system of the hospital while the next was building a computerized database for the health records of the hospital. The third stage was creating and infusing a database access control system based on context, using a dynamic Role-Based Access Control system. The fourth phase was to network the servers from the clinical departments (where patients’ health records are generated) into an intranet such that access can be gained from within the hospital by authorized officials only after they have been authenticated. Findings show that there exist contextual information and dynamic properties in healthcare settings which can be ranked according to relevance and usefulness and utilized in significantly improving existing access control models used in healthcare systems. It was also found that involving end-users in the requirements-capturing process will provide information that may increase the knowledge to be utilized in designing a better access control model. It has thus become necessary for researchers in the field of database access control to continue to identify and consider more key security elements of computer systems in building efficient access control systems. In addition, access control models should be developed into web-based systems that would allow organizational resources to be accessed from anywhere, anytime in a distributed multi-domain environment.