Medical organizations find it challenging to adopt cloud-based electronic medical records services, due to the risk of data breaches and the resulting compromise of patient data. Existing authorization models follow a patient centric approach for EHR management where the responsibility of authorizing data access is handled at the patients' end. This however creates a significant overhead for the patient who has to authorize every access of their health record. This is not practical given the multiple personnel involved in providing care and that at times the patient may not be in a state to provide this authorization. Hence there is a need of developing a proper authorization delegation mechanism for safe, secure and easy cloud-based EHR management. We have developed a novel, centralized, attribute based authorization mechanism that uses Attribute Based Encryption (ABE) and allows for delegated secure access of patient records. This mechanism transfers the service management overhead from the patient to the medical organization and allows easy delegation of cloud-based EHR's access authority to the medical providers. In this paper, we describe this novel ABE approach as well as the prototype system that we have created to illustrate it.
[1]
Kaija Saranto,et al.
Definition, structure, content, use and impacts of electronic health records: A review of the research literature
,
2008,
Int. J. Medical Informatics.
[2]
Tim Finin,et al.
An Ontology for a HIPAA compliant cloud service
,
2016
.
[3]
Deborah L. McGuinness,et al.
OWL Web ontology language overview
,
2004
.
[4]
Brent Waters,et al.
Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization
,
2011,
Public Key Cryptography.
[5]
Ling Liu,et al.
Security Models and Requirements for Healthcare Application Clouds
,
2010,
2010 IEEE 3rd International Conference on Cloud Computing.
[6]
Anupam Joshi,et al.
Representing Attribute Based Access Control Policies in OWL
,
2016,
2016 IEEE Tenth International Conference on Semantic Computing (ICSC).
[7]
Reihaneh Safavi-Naini,et al.
Privacy preserving EHR system using attribute-based infrastructure
,
2010,
CCSW '10.