(IJACSA) International Journal of Advanced Computer Science and Applications,

Vol. 11, No. 2, 2020

Understanding Attribute-based Access Control for

Modelling and Analysing Healthcare Professionals’
Security Practices

Livinus Obiora Nweke1 Prosper Yeng2

Information Security and Communication Technology Information Security and Communication Technology
Norwegian University of Science and Technology (NTNU) Norwegian University of Science and Technology (NTNU)
Gjøvik, Norway Gjøvik, Norway

Stephen D. Wolthusen3 Bian Yang4

School of Mathematics and Information Security Information Security and Communication Technology
Royal Holloway, University of London Norwegian University of Science and Technology (NTNU)
Egham, United Kingdom Gjøvik, Norway
Information Security and Communication and Technology
Norwegain University of Science and Technology (NTNU)
Gjøvik, Norway

Abstract—In recent years, there has been an increase in the Traditionally, medical records are paper-based but tremen-
application of attribute-based access control (ABAC) in electronic dous progresses in information and communication technology
health (e-health) systems. E-health systems are used to store a have led to a shift from paper-based medical records to
patient’s electronic version of medical records. These records electronic version of the medical records. Like the traditional
are usually classified according to their usage i.e., electronic paper-based medical record, electronic version of the medical
health record (EHR) and personal health record (PHR). EHRs
are electronic medical records held by the healthcare providers,
record is a collection of medical history of an individual.
while PHRs are electronic medical records held by the patients However, unlike the traditional paper-based medical records,
themselves. Both EHRs and PHRs are critical assets that require the electronic version is stored in electronic format following
access control mechanism to regulate the manner in which they the required standards.
are accessed. ABAC has demonstrated to be an efficient and
effective approach for providing fine grained access control to The electronic version of medical records is usually clas-
these critical assets. In this paper, we conduct a survey of the sified according to their usage i.e., electronic health record
existing literature on the application of ABAC in e-health systems (EHR) and personal health record (PHR). Whilst EHRs are
to understand the suitability of ABAC for e-health systems and electronic medical records of an individual held by the health-
the possibility of using ABAC access logs for observing, modelling care providers; PHRs are referred to as electronic medical
and analysing security practices of healthcare professionals. We records of an individual held by the individual themselves.
categorize the existing works according to the application of Although EHRs can be shared across different healthcare
ABAC in PHR and EHR. We then present a discussion on the providers, PHRs have shown to be an effective approach
lessons learned and outline future challenges. This can serve as for individuals to share their electronic medical records with
a basis for selecting and further advancing the use of ABAC in
e-health systems.
different healthcare providers, family and friends.

Keywords—Attribute-Based Access Control (ABAC); e-health Sharing of electronic medical records raises security and
systems; Personal Health Record (PHR); Electronic Health Record privacy concerns for both EHR and PHR. For EHR, healthcare
(EHR) providers are required by regulatory bodies to ensure that
the security and privacy of the electronic medical records
I. I NTRODUCTION are maintained. In the case of PHR, an individual would
want to ensure that only authorized entities have access to
There has been a growing interest in the application of their electronic medical records. Several approaches have been
ABAC in e-health systems. This is evident by the increasing proposed to address the security and privacy concerns raised by
number of publications and on-going research activities in EHR and PHR. The approach that have received wide-spread
that direction. According to Gartner report [1] it is predicted acceptance is ABAC.
that 70% of enterprises will adopt ABAC mechanism as the
most dominant access control mechanism for the protection ABAC aims to provide fine-grained access to a resource
of critical assets. In the healthcare industry, e-health systems or an object based on the attributes of the subject and that
interact with critical assets like electronic medical records, of the object; in addition to the environmental conditions. A
and ABAC has been shown to offer a promising approach to subject refers to an entity such as a person, process or device
securing these critical assets. that wishes to access a resource or an object. A resource or an
www.ijacsa.thesai.org 683 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

object is a system-related entity containing information such HIPAA is applicable to all types of Covered Entity or Busi-
as records, that a subject desires to access. The environmental ness Associate that processes PHI. Covered Entity is a health
conditions are the operational contexts such as the time and care provider, a health plan or a health care clearing house who,
location of access. Hence, in ABAC, the attributes of the in its normal activities, creates, maintains or transmits PHI
subject and the requested object as well as the environmental [5]. Business Associate is a person or business that provide
condition determines the set of operations that can be executed a service - or performs certain function or activity for - a
on the requested object. covered entity when that service, function or activity involves
the business associate having access to PHI maintained by the
A wide range of applications of ABAC in e-health systems covered entity [5]. Usually, a business associate is required
have been proposed in the literature and examined in individual to sign business associate agreement with the Covered Entity
studies. However, a comprehensive survey of these techniques stating what PHI they can access, how it would be used and
that can serve as a basis for selecting and further advancing that it will be returned or destroyed once the task it is needed
the use of ABAC in e-health systems is still missing in the for is completed [5]. Also, while the PHI is in the custody
literature. Abbbas and Khan in [2] presented a review on the of the business associate, the business associate has the same
state of the art in privacy preserving techniques for e-health HIPAA compliance obligations as a Covered Entity.
cloud based systems. The authors in [3], [4] provided a survey
on the security and privacy issues in e-health cloud based The two types of rules specified by HIPAA are the privacy
systems. To the best of our knowledge, there is no survey rule and security rule. The privacy rule protects all PHI held or
on the application of ABAC in e-health systems. transmitted by a covered entity or its business associate, in any
form or media, whether electronic, paper or oral [5]. Under the
In this paper, we present a survey on the application security rule, covered entities are required to evaluate risks and
of ABAC in e-health systems. We categorize the different vulnerabilities in their environments and to implement security
applications of ABAC in e-health systems according to those controls to address those risks and vulnerabilities [6]. There
use in PHR and those apply in EHR. We present a comparison are three parts to the security rule: administrative safeguards,
of the different approaches employ in the existing works. Then, which is in the form of policies and procedures that brings the
using some of the key features of the existing approaches, we privacy rule and security rule together; technical safeguards
present a discussion on their differences. Also, we describe the refer to the technology that is used to protect PHI and provide
lessons learned from the survey and outline future challenge. access to the data; and physical safeguards, which has to do
Lastly, the concept of modelling and analysing healthcare with physical access to PHI regardless of its location [6].
professionals’ security practices is discussed.
An international standard that defines the requirements for
The rest of this paper is organised as follows. Section
e-health systems is the ISO/IEC 27799 [7]. The ISO/IEC
II presents an overview of the security and privacy require-
27799 provides special recommendations on security needs in
ments for e-health systems. Also, the dominant access control
the healthcare sector, taking into account the unique nature
mechanisms deploy in e-health systems are explored, and the
of its operating environment. It applies ISO/IEC 27002 to the
justification for wide-spread acceptance of ABAC in e-health
healthcare domain with appropriate security controls towards
systems is described. Section III presents a literature survey
enhancing the protection of PHI. The development of ISO/IEC
of the existing works on the application of ABAC in e-health
27799 took into consideration, personal data protection leg-
systems. Section IV discusses the lessons learned from the
islations, privacy and security best practices, individual and
survey and outline future challenge. In addition a discussion
organizational accountability, meeting the security needs iden-
on modelling and analysing healthcare professionals’ security
tified in common healthcare situations, and operating electronic
practices is presented. Section V concludes the paper.
health information systems in an adequately secured healthcare
environment. Also, ISO/IEC 27799 aims to protect information
II. BACKGROUND such as PHI, pseudonymized data derived from PHI, clinical
or medical knowledge related or not related to any patient,
In this section, we provide an overview of the security and data on health professionals, staff and volunteers, audit trail
privacy requirements for e-health systems. We also examine data produced by health information systems, including access
the commonly used access control measures for e-health sys- control data and other security related system configuration
tems and why ABAC mechanism is the most preferred access data, for health information systems.
control mechanism for e-health systems.
Other important standards for e-health systems include
A. Requirements of E-Health Systems OpenEHR [8], the health level 7 clinical document architecture
(CDA) [9], and the continuity of care document (CCD) [9].
Several standards and laws have been proposed to specify The OpenEHR is an open standard that specifies the man-
the security and privacy requirements for e-health systems. The agement and storage, retrieval and exchange of health data
most popular of these standards and laws is the American in EHRs. Also, openEHR defines specifications for clinical
standard health insurance portability and accountability act information models, EHR Extracts, demographics, data types
(HIPAA) [5]. HIPAA is mainly concern about the privacy and and various kinds of service interfaces [8]. The HL7 CDA
security of patient health information (PHI). With the migra- is a document markup standard that specifies the structure
tion of PHI from paper-based to electronic format, HIPAA and semantics of clinical documents for the purpose of fa-
was upgraded to health information technology for economic cilitating exchange between healthcare providers and patients
and clinical health (HITECH) to address privacy and security [9]. A clinical document is defined by HL7 CDA as having
concerns posed by such migration. the following features: persistence, stewardship, potential for
www.ijacsa.thesai.org 684 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

authentication, context, wholeness, and human readability [9]. attributes. This eliminates the need of having to register a
And CCD is a joint effort of HL7 International and American user into the system before providing access; instead, access
society for testing and materials (ASTM) to enable interop- is granted based on the attributes of the user and that of the
erability of clinical data [9]. It allows physicians to send requested resource. Thus, ABAC mechanisms would provide
electronic medical information to other providers without loss appropriate level of access to healthcare records even for any
of meaning and as such, improves the overall patient care. extraordinary actions that need to be taken during emergency
situations.
In general, the requirements that are of interest to this
survey are the recommended technical safeguards for e-health For emergency situations, ABAC ensures that the authenti-
systems. These technical safeguards aim to provide secure, cation mechanism of emergency accesses can be configured
reliable, access to PHR or EHR; where and when it is to include more control variables such as attributes of the
requested. The requirements include the following [5]: user, environment and resources to reduce risk of privacy and
security breaches. For instance, the resource and environmental
• Implement a means of access control attributes such as the patient status and location could indicate
• Introduce a mechanism to authenticate PHR and EHR emergency care or intensive-care services. Hence, any accesses
other than the specified attributes would be restricted, to reduce
• Implement tools for encryption and decryption the risk of exploitation. Therefore, ABAC policies enables
flexible configurations for users to override their conventional
• Introduce activity logs and audit controls
access restrictions in a controlled and justifiable manner in
emergency access scenarios.
B. Access Control Mechanisms
ABAC have shown to be an effective and efficient mech-
One of the security controls necessary to meet the security anism for providing fine-grained access to PHRs and EHRs
and privacy requirements for e-health systems is the imple- given the dynamic nature of today’s e-health environment.
mentation of access control mechanisms. These are measures Also, it can be combined with different cryptographic schemes
that can be used to regulate access to a given resource. to provide secure and anonymous sharing of PHRs and EHRs
Earlier implementation of access control mechanisms in e- among healthcare providers and patients. So many research
health systems employ role-based access control (RBAC) [2]. efforts are on-going in developing appropriate ABAC model
RBAC restricts access to a resource based on the user’s role. for e-health systems. The next section provides a survey of
The use of a role based access control suffers some drawbacks some of these efforts to further support the assertion that
as the definition of roles is static and it lacks flexibility and ABAC is a much better access control mechanism for e-health
responsiveness. Every user needs to be enrolled in advance in systems.
the system. For example, in an emergency situation where the
patient is outside the local domain where the patient health III. L ITERATURE S URVEY
information held, a doctor not registered within the local
domain of the patient will not be able to access the patient’s In this section, we present a survey of the existing liter-
health information. Therefore, the efficacy of role-based access ature on the application of ABAC in e-health systems. We
control is limited because it cannot handle situations where categorize the existing work according to the type of patient’s
unregistered personnel requires access to the system as in the electronic version of medical records considered. Already we
case of emergency that we described. have observed that the electronic version of a patient health
record is usually classified according to those held by the
Emergency access such as self-authorization and break the patient themselves (PHR) and those held by the healthcare
glass (BTG) are basic requirements in healthcare systems. Self- providers (EHR). We use this understanding to present the
authorization is a provision in the access control mechanism different applications of ABAC in e-health systems.
that allows healthcare professionals to access the minimum and
necessary healthcare records for therapeutic purposes during
A. Application of ABAC in Personal Health Record (PHR)
emergency situations. Similarly, BTG mechanism is used when
conventional access control mechanisms are inadequate to PHR offers a flexible and convenient way for storing
access minimum and necessary healthcare information for ther- and sharing a patient’s electronic version of medical records.
apeutic measures [10], [11]. Considering that RBAC policies It empowers the patients by giving them control over their
rely on permissions that does not often change [12], installing medical record and deciding with whom to share those records.
emergency access mechanisms on static roles may pose a high However, the current trend in the storage of PHR has shown
security threat. For instance, an adversary who might have that cloud platforms are very popular way of storing PHR.
unlawfully acquired health professionals’ credentials under This raises questions of security and privacy of PHR as there
RBAC, could easily compromise healthcare records by using have been wide spread concerns that PHR stored in the cloud
the emergency access control windows since there are no other may be exposed to unauthorized parties. Several approaches
control variables to authentic the accesses of the malicious that use ABAC in PHR have been proposed in the literature
user. to address these concerns.
A flexible access control mechanism that provides fine A typical use case scenario of the application of ABAC
grained access control to a resource is ABAC. Like RBAC, in PHR is shown in Figure 1. Li et al [13] describe a unified
ABAC employs a policy driven approach. However, in ABAC, fine-grained access control for PHR in cloud computing. In
access to a resource is granted based on the attributes of this system, the patient utilizes the cloud storage platform for
the subjects and the objects together with the environmental storing the encrypted version their PHRs. The policy manager
www.ijacsa.thesai.org 685 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

facilitates the encryption of the patient’s PHRs. Also, the in this work includes both the original PPCD-type and an
medical staff is able to download the encrypted PHRs from additional new entry table to provide for password-based
the cloud and use their private keys to decrypt the PHRs. A and private key access. The authors employ Password Key
trusted attribute authority is used for all patients and medical Derivation function as the privacy preserving technique and
staff to authenticate and verify their attributes. the method also supports access revocation. Ray et al in [18]
apply attribute based access control for preserving the privacy
of PHR. The authors show how the privacy of PHR can
be expressed and enforced through the use of an attribute
based access control supported by extensible access control
markup language (XACML). In this paper, the XACML is
used to model the different types of policies and expressing
the patient’s privacy preference for subsequent enforcement by
the attribute based access policies.
There are constraints imposed on cloud based PHR
schemes that use ABE. An approach to address these con-
straints is proposed in [19]. The method adopted in this
work involves the use of multi-authority system architecture,
unlike existing methods that utilize single trusted authority. In
Fig. 1. Use Case Scenario of ABAC in PHR addition, a proxy re-encryption scheme is deployed to ensure
that only authorized users are able to decrypt the required PHR
[13] files. A more recent work by Li et al [13] present a unified
fine-grained access control for PHR in cloud environment. The
One of the earliest approaches in the use of ABAC to
proposed approach is able to store PHR for multiple patients.
provide security and privacy for PHR stored in the cloud is
It consists of ABE layer and symmetric layer. Whilst the ABE
presented in [14]. The authors used a variant of attribute-
layer facilitates a multi-privilege access control for PHR from
based encryption (ABE) referred to as broadcast ciphertext
multiple patients; in the symmetric layer, symmetric keys that
policy ABE (bABE) which extends the functionality of ABE to
match medical workers’ access privileges and the keys with
include user revocation. An ABE uses a public key encryption
higher privilege can override keys with lower privilege but not
system, where each user’s key is labelled with a set of
the other way around. Also, the authors use ciphertext policy
attributes, and the ciphertext is linked with an access policy.
ABE as the privacy preserving technique for the proposed
The private key of the user can decrypt the ciphertext only if
method.
the attribute set of the user’s key matches the access policy
associated with the ciphertext. Furthermore, the approach
B. Application of ABAC in Electronic Health Record (EHR)
presented assumes trusted cloud provider and the use of a
trusted authority to issue the relevant private keys. EHR is handled by healthcare providers and also, it pro-
vides them with the opportunity of sharing those records
Li et al in [15] propose a patient-centric framework and
among different healthcare providers. EHR is usually stored
approach which exploits ABE techniques to provide fine-
on-premise under the administrative control of the healthcare
grained access control to PHR in cloud environment. In the
provider but recent trends have shown a gradual shift from on-
proposed model, the system is divided into several security
premise storage of EHR to cloud. This further increases the
domains according to the different users’ data access require-
risk of exposing EHR to unauthorized parties. However, ABAC
ments. ABE is deployed to cryptographically enforce patient
has demonstrated to be a promising approach to mitigating
centric PHR access. In additional, the PHR is assumed to be
the risk of exposing EHR to unauthorized parties. Different
stored on a semi-trusted service provider and the proposed
methods that employ ABAC in EHR have been discussed in
framework supports access revocation. Another patient-centric
existing works.
cloud-based secured PHR system is presented in [16]. The
proposed system enables secure storage of PHR data on a The system architecture as shown in Figure 2, depicts a
semi-trusted cloud service provider and allows the patient to use case scenario of the application of ABAC in EHR. Joshi
selectively share their PHR data with wide range of users. The et al [20] in this work provide users access to the system using
authors reduced key management complexity for both owners Access Broker Unit. The Access Broker Unit consists of the
and users by dividing the users into two security domains, organizational Knowledge Base, the Rule Based Engine and
namely: public domain and personal domain. Also, they show the Policy Unit. The Organization Knowledge Base stores all
that PHR owners can encrypt PHR data for the public domain the details of the users in the form of an ontology - the EHR
using ciphertext-policy ABE scheme, while the PHR data for Ontology. The Policy Unit stores all the access policies. And
the personal domain can be encrypted using anonymous multi- the Rule Based Engine uses the user and document attributes
receiver identity encryption scheme. from the ontology for implementing the access control policies.
The authors use ABE for encryption, and the Key Generation
A fine-grained access of interactive, PHR, that extends
Unit generates the private keys required for the ABE. Then,
a secure composite document format i.e., Publicly Posted
the encrypted data are stored in the cloud, which hosts, the
Composite Documents (PPCD) is described in [17]. PPCD
EHR Ontology.
is a SQLite-based serialization which is developed for busi-
ness workflows and is able to contain multiple documents Pussewalage and Oleshchuk in [21] propose an ABAC
of different sensitivity and formatting. The method proposed scheme for secure sharing of EHR. The scheme uses selective
www.ijacsa.thesai.org 686 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

credentials which ensure that users can anonymously prove

the ownership of a set of attributes to a verifier and by so
doing, obtain access to the protected resources. The method
involves randomization of the users credential along with its
signature before being disclosed to a verifier. Similarly, Micha-
las and Weingarten in [27] describe the use of HealthShare, a
secure approach for sharing EHR between multiple organiza-
tions hosting patient’s data in different cloud environments.
In the proposed method, a revocable key-policy ABE is
used to ensure that access by a malicious or compromised
user/organization can easily be revoked without generating new
encryption keys.
Fig. 2. Use Case Scenario of ABAC in EHR
IV. D ISCUSSION
[20] In this section, we present a comparison of the different
approaches used in the existing works. We then use some of the
key features of the existing approaches to present a discussion
disclosure that meets the security requirement of EHR. An on their differences. Also, we describe the lessons learned from
access requester supplies a valid set of attributes that satisfies the survey and outline future challenge. Lastly, the concept
the underlying policy of the requested object using attribute of modelling and analysing healthcare professionals’ security
and private key commitments. The proposed approach is said practices is discussed.
to be collision resistant; such that it is impossible to collude
attributes of more than one user to gain access to EHR. This
A. Comparison of the Different Approaches
is achieved by giving a unique identifier to every user and
including it to every attribute key owned by the respective A detailed summary of the existing works on the applica-
users. In addition, the proposed method supports on demand tion of ABAC in e-health systems that we have presented in
user revocation and it is applicable to on-premise storage this work is shown in Table I. Some of the key features of the
platform. existing approaches are employed to discuss the differences in
the approaches. Also, we describe the lessons learned from the
Several standards have been developed to facilitate inter-
survey and outline future challenge.
operability of EHR. The most recent effort in that direction is
the Fast Health Interoperability Resources (FHIR) [22], which 1) Privacy Preserving Techniques: refer to approaches that
specifies requirements for fast and efficient storage/retrieval may be exploited to provide confidentiality of PHR and EHR.
of EHR. The authors in [23] exploit ABAC to create owner- It involves the encryption of the health data to be stored using
centric methodology for granting access to EHR. They fo- cryptographic methodologies such that only an individual that
cussed on FHIR and suggested ways to allow incremental and possess the decryption key can have access to the health data.
batch release of EHR stored using FHIR to any requesting It can be observed from Table I that whilst the existing works
party, based on access policies defined by the resource-owners. employ different privacy preserving techniques, ABE and its
variants appears to be the most popular approach.
Cloud based storage are currently being adopted by health-
care providers for storing EHR. Joshi et al. in [20] develop ABE is a type of public key encryption where the private
an ABAC mechanism for cloud-based EHR that uses ABE key and the ciphertext are related with a set of attributes or an
to securely store EHR at field level. The developed system access policy over the attributes of the users. There are two
extracts the user and EHR filed attribute from a HIPAA main variants of ABE, and they are: ciphertext-policy ABE
complaint knowledge graph which facilitates easy querying [28] and key-policy ABE [29]. A combination of ciphertext
and faster data access operation. Also, in [24] the authors with access policy specifying the attributes of legitimate users
propose ABAC which uses Hidden Vector Encryption system is employ in ciphertext-policy ABE, while key-policy ABE
to encrypt EHR in cloud environment. The approach presented uses a set of attributes and private keys associated with the
is able to protect EHR from insider attacks as EHR can only be access policy to specify which ciphertexts the key holder can
view by those that are able to supply the appropriate attributes. access. Li et al. in [13] argue that ciphertext-policy ABE is
Seol et al in [25] present a cloud-based EHR model that more flexible and appropriate for PHR than key-policy ABE
performs ABAC using XACML. The combination of XML in practice. This is evident from the summary in Table I as
encryption and XML digital signatures are used as security most application of ABAC in PHR use ciphertext-policy ABE
and privacy preserving technique. for privacy protection.
There are situations where EHR is shared among different Another privacy preserving technique that is used in the
providers. It is possible for an adversary to infer the health existing works is XACL. XAMCL defines a declarative fine-
condition of a patient by observing the frequency in which the grained, ABAC control policy language which describes how
EHR is accessed by a particular healthcare provider. This type to evaluate access requests according to rules stated in access
of situation violates the privacy of the patient. The authors policies [30]. The authors in [18] use XAMCL to show how a
in [26] propose an efficient multi-show unlinkable access patient’s privacy preferences could be expressed and enforced
for collaborative e-health environment that exploits attribute- in PHR. XAMCL is deploy in [23] as the privacy preserving
based credential scheme. They utilize anonymous attribute technique for EHR. The authors utilize XAMCL for providing
www.ijacsa.thesai.org 687 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

TABLE I. S UMMARY OF E XISTING W ORKS ON A PPLICATION OF ABAC IN E-H EALTH S YSTEMS

Work Type of Health Privacy Preserving Access Revocation Storage Platform Adversarial Model
Record Considered Technique Used Assumption
[15] PHR ABE Supported Cloud Semi-trusted
Service Provider
[16] PHR Ciphertext-Policy Not Specified Not Specified Semi-trusted
ABE Service Provider
[18] PHR XACML Not Specified Not Specified Not Specified
[20] EHR Ciphertext-Policy Not Specified Cloud Not Specified
ABE
[27] EHR Key-Policy ABE Supported Cloud Trusted Service
Provider
[25] EHR XACML with Not Specified Cloud Not Specified
XML Encryption
and XML Digital
Signatures
[13] PHR Ciphertext-Policy Not Specified Cloud Semi-trusted
ABE Service Provider
[17] PHR Password Key Supported Cloud Not Specified
Derivation Function
[26] EHR U-Prove Not Specified On-Premise Trusted Service
Provider
[21] EHR Not Specified Supported On-Premise Trusted Service
Provider
[24] EHR Hidden Vector En- Not Specified Cloud Not Specified
cryption
[19] PHR Proxy Re- Supported Cloud Semi-trusted
encryption Service Provider
[14] PHR Ciphertext-Policy Supported Cloud Trusted Service
ABE Provider
[23] EHR XACML Not Specified On-Premise Trusted Service
Provider

fine-grained authorization and access to FHIR resources. Seol encrypting and signing the PHR with a set of newly generated
et al in [25] employ XACML with XML encryption and XML keys. For the paper in [14], each user has a user-index which
digital signatures as additional measure for ensuring that the facilitates direct revocation of user access to an encrypted data.
privacy and security of EHR are preserved. This eliminates the need for re-encrypting the data or refresh-
ing the system parameters to implement access revocation.
Other privacy preserving techniques used in the existing Also, Michalas and Weingarten [27] present an algorithm that
works surveyed include: the use of password key derivation EHR owner can use to revoke access for the unique key that
function, U-Prove, hidden vector encryption and proxy re- is generated for a particular user. Like the approach in [14],
encryption. Balinsky and Mohammad [17] use password key the EHR owner does not have to decrypt and then re-encrypt
function to provide end-to-end encryption and show that it file with a fresh key.
ensures no central authority is needed when accessing plaintext
data or decryption keys. Authors in [26] argue that enforcing 3) Storage Platform Used: refers to method used in storing
anonymously as well as multi-session unlinkable access for the PHRs or EHRs. The traditional approach for EHRs has
users in e-health is very pertinent. They use the standard U- been on-premise, but recent trends have shown a gradual shift
prove credential scheme and formally prove its multi-show to cloud environment. This is due to flexibility and cost-
unlinkability property. The paper in [24] use hidden vector effectiveness that cloud storage environment offers. In the case
encryption to encrypt and embed access control policies within of PHRs, cloud storage has been the prevalent methodology
the encrypted data. This approach completely removes the for storage because it is infeasible for a single individual to
need for two separate security controls. Also Pussewalage and bear the cost of setting up storage resources for storing PHRs.
Oleshchuk [19] apply a proxy re-encryption scheme to ensure Hence, patients that would like to be responsible for their
that only authorized users are able to decrypt PHR files. medical health records rely of cloud storage platforms for
2) Access Revocation: is another important feature of the storing their health information.
existing works surveyed. Although not all the works specified
the presence of access revocation, it is an essential charac- 4) Adversarial Model Assumption: has to do with the
teristic of ABAC in e-health as it enables the disabling of assumptions made by the different models about the nature of
a user’s access to PHR or EHR. Several methods have been the storage platform used in storing PHRs and EHRs. These
adopted in order to provide efficient access revocation. The assumptions are necessary when developing formal proof that
authors in [15] implement access revocation by re-encrypting the proposed approach is feasible and meets all the legal and
the ciphertexts and updating the users’ private keys. For the ethical requirements for storing PHRs and EHRs. The adver-
papers in [19], [21], the attribute authority is responsible for sarial model assumption considered in most of the existing
the access revocation process. papers surveyed either assumes trusted service provider or
semi-trusted provider. Although these are reasonable assump-
The remaining papers surveyed in this work adopted direct tions, it would also be insightful to consider untrusted service
access revocation. The authors in [17] present direct access providers. This would guarantee that the stringent privacy and
revocation where the owner of PHR can revoke access by re- security requirements for PHR and EHR are met.
www.ijacsa.thesai.org 688 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

5) Lessons Learned and Future Challenge: Indeed, e- for the log analysis taking into consideration the environment
health systems require a flexible and fine-grained access con- attributes, the resource attributes and the attributes of the
trol mechanism for secured access to PHRs and EHRs. ABAC objects in emergency access scenarios. For instance, the log
has shown to be an efficient and effective approach to meeting analysis algorithm should be able to determine if the patient
the security and privacy requirements of e-health systems. status was classified under emergency within the given period.
We have presented a survey of the different applications of Also, the location of the patient such as the type of hospital
ABAC in e-health systems. By classifying the existing works ward could support in decision making. Thus, if the patient was
according to the types of health records considered, we are able admitted in the intensive-care unit (ICU) or emergency ward,
to investigate what have been done so far in the literature. the environmental attributes could provide such knowledge.
Since RBAC does not include these control variables, more
We observe that there has been an increasing adoption resources may have to be invested in designing such algorithms
of PHR for storing patient health records. This gives the for efficient log analysis.
patient greater control of their health record, allowing them to
share it with different healthcare providers, family and friends. In the case of ABAC logs, analysing the logs would likely
Also, we notice that ciphertext-policy ABE is the predominant require less resource to design the algorithm for such analysis
privacy preserving technique used for PHR as it enables the to be efficient and effective. ABAC mechanism as we already
patient to revoke access easily to any user they no longer want observed, contain more control variables and as such the logs
to have access to their PHR. In addition, cloud storage platform of ABAC would also contain those variables. These control
is used in all the surveyed works for storing PHR. variables in ABAC logs are desirable variables for the design
of an efficient algorithm for log analysis, unlike RBAC that
The storing of EHR as observed in this survey is shifting
uses the role attribute as the main control variable. Therefore,
from the traditional on-premise to cloud environment. This
given that ABAC logs include the control variables needed for
can be attributed to the flexibility and cost-effectiveness of
the design of an efficient algorithm for the analysis of access
the cloud storage platform. Further, there is an increasing
logs, fewer resources are likely to be deployed in the design
collaboration between different healthcare providers which
such algorithms.
have led to different approaches proposed for facilitating such
collaborations without compromising the privacy of the patient.
V. C ONCLUSION
All the survey works either assumes that the service
provider is trusted or semi-trusted. In the future, approaches In summary, we have presented a survey of the existing
that consider untrusted service provides needs to be examined. works on the application of ABAC in e-health systems. We
Recent data breaches involving cloud providers and insider classified the existing works according to the application of
threats further buttress the need to investigate ABAC mech- ABAC in PHR and EHR. Our survey showed that cloud based
anism for e-health systems that assumes untrusted service storage of PHR and EHR is very popular and that ciphertext-
providers. Such stringent assumption would ensure that in the policy ABE is the commonly used for providing security
case that the third party providers are compromised, the privacy and privacy guarantees in the storage of PHR in the cloud
of the patient is still preserved. environment. Moreover, we presented a comparison of the
different approaches employed in the existing works and used
B. Towards Modelling and Analysing Healthcare Profession- some key characteristics of the existing approaches to present
als’ Security Practices a discussion on their differences. The lessons learned from
the survey are described and future challenge that needs to
Logging of healthcare professionals’ accesses is required in be investigated is outlined. Lastly, a discussion on modelling
the code of conduct for healthcare and care service of Norway and analysing healthcare professionals’ security practices is
[31] and in most international standards for healthcare service. presented.
The purpose of logging and protecting the logs includes non-
repudiation and investigations [32], [33]. Access logs can be
analysed to improve data quality and integrity by detecting R EFERENCES
healthcare information errors and inconsistencies [32], [33]. [1] Gartner, “Market trends: Cloud-based security services
For this reason, the Healthcare Security Practice Analysis, market, worldwide, 2014,” 2014. [Online]. Available:
Modelling and Incentivization (HSPAMI) project was initiated https://www.gartner.com/doc/2607617
to determine the metrics of healthcare professional’s security [2] A. Abbas and S. U. Khan, “A review on the state-of-the-art privacy-
practices towards improving upon their conscious care be- preserving approaches in the e-health clouds,” vol. 18, pp. 1431–1441,
haviour [34]. One of the major tasks of HSPAMI is to analyse 2014.
healthcare professionals’ access logs towards improving their [3] Y. Al-Issa, M. A. Ottom, and A. Tamrawi, “ehealth cloud security
challenges: A survey,” Journal of Healthcare Engineering, vol. 2019,
security behaviour [34]. pp. 1–15, 2019.
Analysing RBAC logs may require a lot effort and re- [4] N. A. Azeez and C. V. der Vyver, “Security and privacy issues
sources to design the algorithm, for such analysis to be in e-health cloud-based system: A comprehensive content analysis,”
Egyptian Informatics Journal, vol. 20, pp. 97–108, 2019.
efficient and effective. This is because RBAC mechanisms
emphasize only on the role attribute as a control variable for [5] HIPAA-Journal, “Hipaa explained.” [Online]. Available:
https://www.hipaajournal.com/hipaa-explained/
implementing the required protection mechanisms. Without
[6] M. Scholl, K. Stine, J. Hash, P. Bowen, A. Johnson, C. D. Smith,
considerable efforts and resources, a higher rate of outliers, and D. I. Steinberg, “Nist special publication 800-66 revision 1: An
false positives and false negative rates are likely to be recorded introductory resource guide for implementing the health insurance
during the analysis. It is desirable to design the algorithm portability and accountability act (hipaa) security rule,” 2008.

www.ijacsa.thesai.org 689 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 11, No. 2, 2020

[7] ISO, “Iso/iec 27799:2016 health informatics - information security control scheme for secure sharing of electronic health records,” in Proc.
management in health using iso/iec 27002,” 2016. [Online]. Available: Applications and Services (Healthcom) 2016 IEEE 18th Int. Conf. e-
https://www.iso.org/standard/62777.html Health Networking, Sep. 2016, pp. 1–6.
[8] openEHR, “openehr – a semantically -enabled health computing plat- [22] HL7-International, “Fhir overview,” 2019. [Online]. Available:
form,” 2016. https://www.hl7.org/fhir/overview.html
[9] HL7-International, “Clinical document architcture (cda).” [23] S. Mukherjee, I. Ray, I. Ray, H. Shirazi, T. Ong, and M. G.
[10] A. Ferreira, D. Chadwick, P. Farinha, R. Correia, G. Zao, R. Chilro, Kahn, “Attribute based access control for healthcare resources,” in
and L. Antunes, “How to securely break into rbac: The btg-rbac model,” Proceedings of the 2Nd ACM Workshop on Attribute-Based Access
in Proc. Annual Computer Security Applications Conf, Dec. 2009, pp. Control, ser. ABAC ’17. New York, NY, USA: ACM, 2017, pp. 29–40.
23–31. [Online]. Available: http://doi.acm.org/10.1145/3041048.3041055
[11] HIPAA, “Break glass procedure: Granting emergency access to critical [24] E. Mrema and V. Kumar, “Fine grained attribute based access control
ephi systems,” 2004. of healthcare data,” 2018.
[12] A. D. Brucker and H. Petritsch, “Extending access control models [25] K. Seol, Y. Kim, E. Lee, Y. Seo, and D. Baik, “Privacy-preserving
with break-glass,” in Proceedings of the 14th ACM Symposium on attribute-based access control model for XML-based electronic health
Access Control Models and Technologies, ser. SACMAT ’09. New record system,” IEEE Access, vol. 6, pp. 9114–9128, 2018.
York, NY, USA: ACM, 2009, pp. 197–206. [Online]. Available: [26] H. S. G. Pussewalage and V. A. Oleshchuk, “An efficient multi-show
http://doi.acm.org/10.1145/1542207.1542239 unlinkable attribute based credential scheme for a collaborative e-health
[13] W. Li, B. M. Liu, D. Liu, R. P. Liu, P. Wang, S. Luo, and W. Ni, environment,” in Proc. IEEE 3rd Int. Conf. Collaboration and Internet
“Unified fine-grained access control for personal health records in Computing (CIC), Oct. 2017, pp. 421–428.
cloud computing,” IEEE Journal of Biomedical and Health Informatics, [27] A. Michalas and N. Weingarten, “Healthshare: Using attribute-based
vol. 23, no. 3, pp. 1278–1289, May 2019. encryption for secure data sharing between multiple clouds,” in Proc.
[14] S. Narayan, M. Gagné, and R. Safavi-Naini, “Privacy preserving ehr IEEE 30th Int. Symp. Computer-Based Medical Systems (CBMS), Jun.
system using attribute-based infrastructure,” in Proceedings of the 2017, pp. 811–815.
2010 ACM Workshop on Cloud Computing Security Workshop, ser. [28] J. Bethencourt, A. Sahai, and B. Waters, “Ciphertext-policy attribute-
CCSW ’10. New York, NY, USA: ACM, 2010, pp. 47–52. [Online]. based encryption,” in Proc. IEEE Symp. Security and Privacy (SP ’07),
Available: http://doi.acm.org/10.1145/1866835.1866845 May 2007, pp. 321–334.
[15] M. Li, S. Yu, Y. Zheng, K. Ren, and W. Lou, “Scalable and secure [29] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-
sharing of personal health records in cloud computing using attribute- based encryption for fine-grained access control of encrypted
based encryption,” IEEE Transactions on Parallel and Distributed data,” in Proceedings of the 13th ACM Conference on
Systems, vol. 24, no. 1, pp. 131–143, Jan. 2013. Computer and Communications Security, ser. CCS ’06. New
[16] C. Wang, X. Xu, D. Shi, and W. Lin, “An efficient cloud-based personal York, NY, USA: ACM, 2006, pp. 89–98. [Online]. Available:
health records system using attribute-based encryption and anonymous http://doi.acm.org/10.1145/1180405.1180418
multi-receiver identity-based encryption,” in Proc. Cloud and Internet [30] O. Standard, “extensible access control markup language (xacml)
Computing 2014 Ninth Int. Conf. P2P, Parallel, Grid, Nov. 2014, pp. version 3.0,” Jan. 2013. [Online]. Available: http://docs.oasis-
74–81. open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html
[17] H. Y. Balinsky and N. Mohammad, “Fine grained access of [31] D. ehelse, “Code of conduct for information security and data
interactive personal health records,” in Proceedings of the 2015 protection in the healthcare and care services sector,” 2018. [Online].
ACM Symposium on Document Engineering, ser. DocEng ’15. New Available: https://ehelse.no/normen/documents-in-english
York, NY, USA: ACM, 2015, pp. 207–210. [Online]. Available: [32] A. Ferreira, R. Cruz-Correia, and L. Antunes, “Usability of authentica-
http://doi.acm.org/10.1145/2682571.2797098 tion and access control: A case study in healthcare,” in Proc. Carnahan
[18] I. Ray, T. C. Ong, I. Ray, and M. G. Kahn, “Applying attribute based Conf. Security Technology, Oct. 2011, pp. 1–7.
access control for privacy preserving health data disclosure,” in Proc. [33] A. Ferreira, P. Farinha, C. Santos-Pereira, R. J. C. Correia, P. P.
IEEE-EMBS Int. Conf. Biomedical and Health Informatics (BHI), Feb. Rodrigues, A. da Costa Pereira, and V. Orvalho, “Log analysis of
2016, pp. 1–4. human computer interactions regarding break the glass accesses to
[19] H. S. G. Pussewalage and V. Oleshchuk, “A patient-centric attribute genetic reports,” in ICEIS 2013 - Proceedings of the 15th International
based access control scheme for secure sharing of personal health Conference on Enterprise Information Systems, Volume 3, Angers,
records using cloud computing,” in Proc. IEEE 2nd Int. Conf. Col- France, 4-7 July, 2013, S. Hammoudi, L. A. Maciaszek, J. Cordeiro,
laboration and Internet Computing (CIC), Nov. 2016, pp. 46–53. and J. L. G. Dietz, Eds. SciTePress, 2013, pp. 46–53.
[20] M. Joshi, K. Joshi, and T. Finin, “Attribute based encryption for secure [34] P. Yeng, B. Yang, and E. Snekkenes, “Observational measures for
access to cloud based ehr systems,” in Proc. IEEE 11th Int. Conf. Cloud effective profiling of healthcare staffs’ security practices,” in Proc. IEEE
Computing (CLOUD), Jul. 2018, pp. 932–935. 43rd Annual Computer Software and Applications Conf. (COMPSAC),
[21] H. S. G. Pussewalage and V. A. Oleshchuk, “An attribute based access vol. 2, Jul. 2019, pp. 397–404.

www.ijacsa.thesai.org 690 | P a g e