A patient-centric approach to delegation of access rights in healthcare information systems

With widespread adoption of digitalization, the healthcare industry is more prone to cyber attacks than ever before. For thwarting data breaches, a robust access control system plays a vital role by only granting authorized access requests. An ideal healthcare access control system should also have the provision for delegation management which enables a patient — in certain conditions — to delegate her access rights to someone she trusts. We believe that patients should be in control of their data, and hence the delegation process should also be at their discretion. On this premise, we present a patient-centric mechanism for delegation of access privileges in a healthcare scenario where a patient can exert complete control over her access-right delegation by issuing a tamper-resistant delegation-token. We implemented the proposed delegation mechanism leveraging security features of our eTRON security architecture which advocates use of public key cryptography and tamper-resistant devices. The proposed mechanism ensures the security of the entire delegation process from initiation to access decision of delegated rights.