RBAC-Matrix-based EMR right management system to improve HIPAA compliance.

Area of Science:

• Health Informatics
• Information Security
• Computer Science

Background:

• Current Role-Based Access Control (RBAC) systems struggle with detailed access declarations in large medical institutions.
• Increasingly stringent regulations like HIPAA and PIPEDA necessitate greater patient control over Electronic Medical Records (EMR).

Purpose of the Study:

• To propose RBAC-Matrix, an extended RBAC system for managing EMR security.
• To enable patients to actively participate in defining access rights for their medical records.
• To enhance EMR protection and ensure compliance with privacy regulations.

Main Methods:

• Developed RBAC-Matrix, an RBAC extension for matrix organizations in healthcare.
• Utilized eXtensible Rights Markup Language (XrML) files for access control declarations associated with each EMR.
• Implemented a two-stage authorization process (master & servant) for file-based behavior.
• Defined distinct roles: Document Creator (DC) and Document Right Setting (DRS).

Main Results:

• RBAC-Matrix successfully extends RBAC to matrix organizational structures.
• XrML files enable detailed, file-based authorization declarations.
• The two-stage design enhances EMR protection.
• Patient co-signing of access rights by the DRS ensures compliance with HIPAA.

Conclusions:

• RBAC-Matrix provides a robust solution for EMR security and digital rights management.
• The system empowers patients by involving them in access control decisions.
• RBAC-Matrix facilitates compliance with healthcare data privacy regulations.