![](bg6.png)
5 CONCLUSIONS/FUTURE
WORK
In this paper we depicted the need for risk-aware
access control models that support the regulation,
development, and deployment of access control
procedures for data sharing in biomedical research
platforms. We proposed a method that identifies the
essential risk components, necessary for such access
control procedures and extended existing models to
overcome the limitations of the “manual” biomedical
data sharing processes, such as the IRB, and the
“automated” ones based on e-HBS.
Currently we are working on coming up with
efficient equations to calculate the different risk
elements. This work is challenging and requires
significant efforts on many fronts:
• Assigning data sensitivity to datasets is the main
challenge. As a start, we are currently working
on classifying data into a set of pre-defined
sensitivity classes.
• Creating local (and ideally universal) user
records for storing data breach information is
another theoretical/practical challenge.
Analogous to credit scores, the risk associated
with individual users should indicate the gravity
of their past breaches, and should reward users’
progress. Our approach is to standardize all data
breaches (i.e. create a breach classification) and
create an account system for all users that can be
accessed by data holders when required.
• The security of the user’s environment is related
to the user’s institution (the research institution
to which a user is affiliated). Thus, the risk can
benefit from having universal security
certification programs for research institutions.
Such programs would provide certifications to
different institutions based on their privacy and
security practices. Refer to (El Emam et al.,
2009) for a list of parameters to take in
consideration when evaluating institutions’
privacy and security practices.
Another necessary task is to extend the system to
provide Omics data. For that, we need to study the re-
identification power of this data to be able to annotate
it with any privacy risk. Some work has already been
done along these lines for single nucleotide
polymorphisms (SNPs) (Lin et al., 2004).
REFERENCES
Armando, A., Bezzi, M., Metoui, N., Sabetta, A., 2015.
Risk-Aware Information Disclosure, in: Garcia-Alfaro,
J., Herrera-Joancomartí, J., Lupu, E., Posegga, J.,
Aldini, A., Martinelli, F., Suri, N. (Eds.), Data Privacy
Management, Autonomous Spontaneous Security, and
Security Assurance, Lecture Notes in Computer
Science. Springer International Publishing, pp. 266–
276.
Chen, L., Crampton, J., 2011. Risk-aware role-based access
control, in: International Workshop on Security and
Trust Management. Springer, pp. 140–156.
Chen, L., Crampton, J., Kollingbaum, M. J., Norman, T. J.,
2012. Obligations in risk-aware access control, in:
Privacy, Security and Trust (PST), 2012 Tenth Annual
International Conference on. IEEE, pp. 145–152.
Cheng, P.-C., Rohatgi, P., Keser, C., Karger, P.A., Wagner,
G.M., Reninger, A.S., 2007. Fuzzy multi-level security:
An experiment on quantified risk-adaptive access
control, in: 2007 IEEE Symposium on Security and
Privacy (SP’07). IEEE, pp. 222–230.
Choi, D., Kim, D., Park, S., 2015. A framework for context
sensitive risk-based access control in: medical
information systems. Comput. Math. Methods Med.
2015.
Dankar, F. K., Al-Ali, R., 2015. A Theoretical Multi-level
Privacy Protection Framework for Biomedical Data
Warehouses. Procedia Comput. Sci., The 6th Interna-
tional Conference on Emerging Ubiquitous Systems
and Pervasive Networks (EUSPN 2015)/ The 5th
International Conference on Current and Future
Trends of Information and Communication Technolo-
gies in Healthcare (ICTH-2015)/ Affiliated Workshops
63, 569–574. doi:10.1016/j.procs.2015.08.386
Dankar, F. K., Badji, R., 2017. A risk-based framework for
biomedical data sharing. J. Biomed. Inform. 66, 231–
240.
El Emam, K., Dankar, F. K., Vaillancourt, R., Roffey, T.,
Lysyk, M., 2009. Evaluating the risk of re-identification
of patients from hospital prescription records. Can. J.
Hosp. Pharm. 62, 307.
Google Android: A Comprehensive Security Assessment -
Google Scholar [WWW Document], n.d. URL
https://scholar.google.ae/scholar?q=Google+Android
%3A+A+Comprehensive+Security+Assessment&btn
G=&hl=en&as_sdt=0%2C5 (accessed 5.21.17).
He, S., Narus, S. P., Facelli, J. C., Lau, L. M., Botkin, J. R.,
Hurdle, J. F., 2014. A domain analysis model for eIRB
systems: Addressing the weak link in clinical research
informatics. J. Biomed. Inform. 52, 121–129.
Home | Global Alliance for Genomics and Health [WWW
Document], n.d. URL http://genomicsandhealth.org/
(accessed 5.21.17).
International Cancer Genome Consortium [WWW
Document], n.d. URL http://icgc.org/ (accessed
5.21.17).
Kandala, S., Sandhu, R., Bhamidipati, V., 2011. An
attribute based framework for risk-adaptive access
control models, in: Availability, Reliability and Security
A Risk-aware Access Control Model for Biomedical Research Platforms
327