![](bg8.png)
of the attempted access and forwards the request to
the global access control service which in
cooperation with the AA decides whether access
should be granted or denied to the requesting party.
If the requesting party has the required privileges a
connection to the corresponding PHR is established
and the corresponding part of the patient’s record is
provided to him/her.
After reviewing the patient’s medical record, the
ED physician forms the appropriate care plan for the
patient under treatment.
7 CONCLUDING REMARKS
Personal health records can address healthcare
information needs as they can provide each person
with a complete copy of his medical record. Thus,
PHRs constitute a valuable tool for supporting the
continuity of care and consequently the quality,
access and efficiency of health care delivery. As
PHR systems grow in popularity, it is important that
they be managed and maintained responsibly
without hindering accessibility to important
information in cases that it is mostly needed (e.g.
emergency cases). Hence, apart from the security
and privacy controls which are common to any
electronic health record system, in PHR systems a
suitable mechanism should be in place that will
automate the authorization propagation process
without the patients’ involvement. The prototype
system presented in this paper deals with this
security issue. In particular, a mechanism is
presented whereby the process of granting
(revoking) authorization to (from) healthcare
professionals on patients’ PHR is performed without
the patient’s involvement. To this end, context-
aware technology is used. Thus, both clinical and
administrative patient data are becoming
immediately available to people who need it via
accessible, secure and highly usable PHRs, fact that
constitutes an enabling factor of the patient-centred
shared care.
A number of issues related to the implementation
of systems like the one proposed in this paper
suggest directions for future work. The most
important concern the means used for patient
authentication as well as the way medical staff is
granted access to medical data in cases where patient
registration is performed after the patient has
received treatment, as is often the case in EDs.
REFERENCES
Koufi, V., Vassilacopoulos, G., 2008. HDGPortal: A Grid
Portal Application for Pervasive Access to Process-
Based Healthcare Systems, In PervasiveHealth’08,
2nd International Conference in Pervasive Computing
Technologies in Healthcare
Tang, P. C., Ash, J. S., Bates, D. W., Overhage, J. M.,
Sands, D. Z., 2006. Personal health records:
definitions, benefits, and strategies for overcoming
barriers to adoption. Journal of the American Medical
Informatics Association : JAMIA (2006) 13(2): 121-
126.
Wiljer, D., Urowitz, S., Apatu, E., DeLenardo, C.,
Eysenbach, G., Harth, T., Pai, H., Leonard, K. J.,
2008. Patient accessible electronic health records:
exploring recommendations for successful
implementation strategies. Journal of medical Internet
research, 10(4).
Lauer, G., 2009 Health Record Banks Gaining Traction in
Regional Projects,
http://www.ihealthbeat.org/features/2009/health-
record-banks-gaining-traction-in-regional-
projects.aspx
Yasnoff, W. A., 2008. Electronic Records are Key to
Health-care Reform, BusinessWeek.
Win, K. T., Susilo, W., Mu, Y., 2006. Personal Health
Record Systems and Their Security Protection, Journal
of Medical Systems (2006) 30: 309-315.
Comini, L., Mazzu, M., Scalvini, S., 2008. Security
aspects in electronic personal health record: data
access and preservation, Digital Prevention Europe,
Briefing Paper.
Røstad, L., Nytrø, Ø, 2008. Personalized Access Control
for a Personally Controlled Health Record, In
CSAW’08, 2nd ACM Workshop on Computer
Security Architectures
My Personal Health Record (MyPHR), http://myphr.ca/
National Institute of Standards and Technology (NIST),
2009. Role Based Access Control (RBAC) and Role
Based Security, http://csrc.nist.gov/groups/SNS/rbac/
Java Agent Development Framework,
http://jade.tilab.com/
Organization for the Advancement of Structured
Information Standards (OASIS), 2008. Core and
Hierarchical Role Based Access Control (RBAC)
Profile of XACML v2.0, http://docs.oasis-
open.org/xacml/2.0/access_control-xacml-2.0-rbac-
profile1-spec-os.pdf
Java Authentication and Authorization Service,
http://java.sun.com/javase/6/docs/technotes/guides/sec
urity/jaas/JAASRefGuide.html
ICW eHealth Framework, Lifesensor, 2009. http://idn.icw-
global.com/solutions/lifesensor/lifesensor.html
Wikipedia, 2009. Emergency Department,
http://en.wikipedia.org/wiki/Emergency_department
Metavante, In Case of Emergency Personal Health
Record, https://www.icephr.com/
AUTOMATING AUTHORIZATION PROPAGATION PROCESS IN PERSONAL HEALTH RECORDS
89