A Formal Model of Healthcare Security Policy

This paper has been motivated by a conflict between the NHS Executive and the BMA [Anderson] concerning the requirements for, and the provision of, security in the NHS-wide Networking Programme [NHSE-IMG]. It cannot attempt to resolve that conflict, because the documents from both parties to it lack the precision required of a Healthcare Security Policy Model. The NHS document is, quite correctly, more concerned with the mechanisms on which secure communications services must rely than with the purposes to which those mechanisms will be put. The BMA document is, quite correctly, concerned with the principles of confidentialty. It is critical of the mechanisms it but does not provide a statement of security policy in a form that admits the verification of its internal consistency, or its validation with respect to the purposes of Healthcare and the expectations of its pracitioners and patients. We hold such a formal statement to be both necessary and possible to construct. In fact, we construct a prototype Formal Healthcare Security Policy Model as a proof of concept. This expressed as a statebased (popularly known as object-oriented), set-theoretic model in the style of [Schuman]. For readers unfamiliar with discrete mathematics, the earlier parts of the model are accompanied by a tutorial in the notation, and a guide to the basic set-theoretic operators is appended.