![](bg5.png)
times allowed to view data after it is liberated or the
number of devices allowed to view data, for instance,
allowing to view data two times.
“Usage purposes” is one of the most important
constraint that ensures patient’s record being used is
in the right direction. It is important to note that us-
age purpose should be continuously controlled during
usage session. Based on our analysis, six types of
purpose are identified, the same as that of access pur-
poses: normal, critical, emergency, personal archive,
research, and statistic.
“Obligations” refers to any duty that needs to be
performed by requester or system during the usage
session (before, during, or after the use of patient’s
record). For example, a ”delete” action is required to
be performed after the usage license is expired while
”notify” needs to be performed before and after the
use of data. Here are the possible obligations required
in usage control applied to PCRHIS: “Deletion and
store ”, “notification”, and “logging”.
6 DISCUSSION
In this section, we discuss the issues that can be raised
when patient is given fully the rights to administrate
and control the access and usage policy. In system
where access control is based on rule/policy, it is re-
quired for rule/policy creator to have the knowledge
on how rule works and to be beware of what they are
doing and the consequence of doing so. In health in-
formation system, particularly in our proposed sys-
tem, it is understood that it is not possible to make
an assumption that all patients have sufficient com-
puter skill or knowledge and can operate or set rule
by themselves. Thus, to solve this problem, we pro-
pose to use three possible groups of users as presented
below for rule creation and validation.
1) Patient: they can set up the rule through policy
administration point by themselves without the sup-
port from healthcare professional or other people such
as their trusted-person or guardian, but if the problem
occurs, for instance, patient mistakenly defines a rule
that is not like what he/she wishes, it is the responsi-
bility of patient themselves.
2) Patient’s Trusted-person and Guardian: as men-
tioned in the requirements in previous section, it is
required for a patient to assign their trusted-person
and/or guardian to represent them in case patient can
not exercise their rights. Those person can help pa-
tient in setting up and validating the rule if patient
wishes to do so.
3) Healthcare Professional: healthcare profes-
sional can also help patient to set the rule on their be-
half, but patient’s consent written in paper is required
in this case. This entity may be the most trusted entity
in the system in term of knowledge.
Although those three entities may be sufficient to
solve the raising problem, we still need other mech-
anism to make sure that the data is safe for at least
a minimum required security as defined in law. To
fix the problem, a default access and usage policy is
required. This means that policy creator can set up
their own preference policy, if not the default policy
is applied.
7 CONCLUSIONS AND FUTURE
WORK
In this paper, we identified different types of users
and data applied to PCRHIS. We also identified ac-
cess and usage control requirements for the address-
ing system. It is important to note that although this
work links primarily to the WHN project, its result
can be applied to any other system that has a simi-
lar model. Our future work includes a thorough study
of the access and usage control models, then the con-
struction of the configurable access and usage control
system based on the requirements presented in this
paper.
REFERENCES
Bandar, A. and Colin, F. (2008). Access control require-
ments for processing electronic health records. In
Proceedings of the 2007 international conference on
Business process management, BPM’07, pages 371–
382, Berlin, Heidelberg. Springer-Verlag.
DocuLiv EPR (2003). DocuLive EPR: A hos-
pital Electronic health record system devel-
oped by Siemens Medical Systems Norway.
http://www.siemens.com/entry/cc/en/, latest ac-
cess: July 2011.
EUdirective (1995). Directive 95/46/EC of the Eu-
ropean Parliament and of the Council of 24
October 1995 on the protection of individu-
als with regard to the processing of personal
data and on the free movement of such data.
https://www.cdt.org/privacy/eudirective/EU.
HL7 PHR (2011). Health Level International Seven.
http://www.hl7.org. Latest access: July 2012.
Hu, V. H., Ferraiolo, D., and Kuhn, D. R. (2006). Assess-
ment of access control system. National Institute of
Standards and Technology.
Pretschner, A., Hilty, M., Sch, F., Schaefer, C., and Walter,
T. (2008). Usage control enforcement: Present and
future. IEEE Security and Privacy, 6:44–53.
AccessandUsageControlRequirementsforPatientControlledRecordTypeofHealthcareInformationSystem
335