Towards Human-Centric Visual Access Control for Clinical Data Management

We propose a novel human-centric, visual, and context-aware access control (AC) system for distributed clinical data management and health information systems. Human-centricity in this context means that medical staff should be able to configure AC rules, both in a timesaving and reliable manner. Since medical data often includes (meta-) information about a patient, it is essential that an AC system includes the patient into the AC process. To cater for the strong security needs in the medical domain, both the AC policy creation by medical staff as well as the patient-interaction feature need to be taken into account. While traditional AC systems offer sufficient security in theory, they lack in comfort and flexibility and as a result find no widespread acceptance with non tech-savvy users. Distributed medical institutions could enormously benefit from the opportunity of dynamic AC configuration at an end-user level while adhering to legal, ethical or other privacy requirements. Hence, this paper presents a human-centric visual AC model for medical data, addressing usability, information security and patient interaction.