Access Control in e-Health Portal Systems

Many e-health portal systems are implemented using off-the-shelf software components. The security features provided by such components are usually insufficient. This paper addresses the issue from the access control perspective. More specifically, we first propose a two-tier approach to access control for e-health portals. The approach supplements existing role based access control (RBAC) capabilities with a rule-based access control module based on the classical flexible authorization framework (FAF) model. We study conflict resolution and interaction between the two modules. We also address authentication for real-time services provided by remote service providers.