Applying attribute based access control for privacy preserving health data disclosure

Patients often willingly share their health data in a controlled manner for the purposes of research. The disclosure of such data in response to requests from researchers must conform to various policies imposed by the patient, the rights of the data requester, and organizational and governmental regulations. This work investigates the applicability of Attribute-Based Access Control (ABAC) model for specifying and enforcing these various types of policies. Specifically, it demonstrates how the XACML framework can be used for specifying and enforcing these policies.