Aspect-oriented design and implementation of adaptable access control for Electronic Medical Records

Abstract

Objectives

Maintaining proper access control to Electronic Medical Records (EMR) is essential to protecting patients’ privacy. We aim to develop mechanisms and tools that can support fine-grained and adaptable access control for EMR.

Method

This paper presents an aspect-oriented design and implementation scheme to providing adaptable access control for Web-based EMR systems. In our scheme, access control logic is decoupled from the core of the EMR application and collected into separate aspect modules which are automatically synthesized from access control rules in XML format and properly designed aspect templates. The generated aspect modules will then be compiled and integrated into the underlying EMR application using standard aspect tools. At runtime, these binary aspect modules will be executed to enforce the required access control. Future changes of access control rules can also be effectively realized through these mechanisms without actual coding.

Results

A structured form of access control rules based on the Taiwan Electronic Medical Record Template, a suite of abstract aspects and templates for enforcing access control and a translator for synthesizing the complete access control code in AspectJ from such access control rules and aspect templates. We have also built a Web-based EMR prototype implementation to demonstrate our approach.

Conclusion

Our approach can not only accommodate a wide range of fine-grained access control requirements but also enforce them in a modular and easy to adapt manner without incurring extra performance overhead due to rule interpretation. The use of aspect-oriented technology to provide adaptable access control for EMR is a promising approach. We have further enhanced our scheme with a mechanism for dynamic adjustment of access control rules. Other tools for authoring and analyzing the access control rules are the main parts of our future work.

Introduction

There is little doubt that healthcare information systems (HIS) will move towards a fully integrated Electronic Medical Record (EMR). However, as we move closer to a paperless environment and Internet-based applications, we must realize that the risks to privacy and security incurred by using electronic systems are also increased. This is a very complicated issue. Besides social aspects, it also calls for much technological advancement to achieve a proper balance between the needs of the individual with the needs of society [1]. Fortunately, with the advancing of technology, privacy and security of EMR can be enhanced if managed properly. In terms of information system development, an effective and flexible access control mechanism is clearly an essential part of a secure and privacy enhanced EMR system [2].

While there are many works focused on modeling access control requirements for EMR [3], [4], [5], [6], [7], there are very few results concerning the development of an implementation scheme for enforcing access control in HIS with EMR. There are at least two major difficulties. First, like other security requirements, access control is a system-wide concern that permeates through all the major modules of a system. Although there is a generic need to enforce access control for protected resources, yet the specific constraint for granting access to each individual resource may not be the same. Hence it is very often to see the code for implementing access control scattered over the whole system and tangled with other functional code. This makes the coding task error-prone and difficult to verify its correctness and to perform the needed maintenance.

Second, access control rules in healthcare domain are inherently fine-grained and dynamic. It is common for information system developers to partition users into different categories, e.g., by roles in an organization, and define access privileges in terms of the application functions that a particular category of users is authorized to perform, e.g., an administrative clerk is limited to administrative functions and excluded from transaction functions. For EMR, however, we often need to go beyond the function-level and impose an additional level of access control in terms of the data contents being accessed. In other words, users may be allowed to perform a specific function, but some data elements must be excluded from viewing or modifying. For example, while any physician can view some parts of a patient's medical record, only the patient's caring doctor can see the whole record and modify it. On the other hand, we will have to bypass the constraint in an emergency. In addition, changes in legislation or changes in the interpretation of legislation may lead to major revision of the access control rules. All these lead to the conclusion that access control rules in healthcare domain are complex and subject to frequent changes.

Policy-driven access control [8], where policies express rules or constraints, is a well-accepted approach aiming to address the issues described above. Essentially, such an approach advocates a separate and loosely coupled security architecture in which access control decision function and enforcing function are decoupled from the core of the underlying application and are maintained largely independent of the core. This approach is also called adaptable access control [9] since it makes the access control logic much easier to manage and adjust.

In the past, the typical implementation scheme to providing adaptable access control is employing a rule-driven and centralized authorization engine, often referred to as reference monitor [10] or policy interpreter [8]. At runtime, all user requests to any protected resources will be transferred to the authorization engine, which will determine whether such requests should be granted by interpreting the involved access control rules. If we change the access control rules interpreted by the engine, the access control behavior of the underlying system will be adjusted accordingly, thus making the access control of the application very easy to adapt. However, such approaches usually incur a certain amount of runtime overhead due to rule interpretation, and may not give the degree of fine-granularity we need.

Therefore, techniques and tools for implementing adaptable access control are also worth further investigation. Here we present a new implementation scheme to providing adaptable access control for Web-based EMR systems. Instead of using policy interpreters, our scheme takes a policy-compiler-like approach. We show that aspect-oriented programming (AOP) [11] is a key enabler for developing our scheme, and the access control mechanisms we provide will not only retain much of the flexibility of the policy interpreter approach but also improves on it in several ways. Moreover, we demonstrate our implementation scheme by developing a prototype in AspectJ [12] and Java that can support flexible access control for the Taiwan Electronic Medical Record Template (TMT) [13], a local standard for EMR developed by the Taiwan Association for Medical Informatics.

The remainder of the paper is organized as follows. Section 2 introduces AOP and AspectJ briefly. Section 3 outlines our approach to adaptable access control and overviews our system architecture. Sections 4 Structure of the access control rules for EMR, 5 Using aspects to enforce access control explain our design of access control rules and aspect code templates, followed by a description of the main components we devised for synthesizing the access control aspects in Section 6. Section 7 presents some discussions on our approach. Section 8 describes related work. Finally, Section 9 concludes and outlines our future work.