Integrated Access Control for Health Care Information Systems

In this project, principles, models and methods for integrated access control for health care information systems will be studied. Integrated access control means that the access control mechanisms are an integral part of the ICT health care systems, and that access can be controlled in a well-defined, consistent and compatible manner in interoperable health care systems The models need to be specifically tailored for access to information in integrated, distributed and user-centred ICT systems, and will take into consideration security requirements from the users, administration and management alike, such as privacy, integrity and availability. The future all-encompassing ICT systems for the health care sector will be large, complex structures with stric t technical and managerial requirements, and the implemented security solutions, in particualr the access control architectures, should be introduced without unduly complicating the technical structure of the ICT systems, or reduce the user-friendliness a nd efficiency of the systems in any significant manner. Some security requirements, e.g. privacy, will as a minimum have to adhere to exteranl requirements in accordance with appropriate standards established by existing laws and regulations, others, e.g. integrity and availability, will be dictated by the superset of the minimum quality requirements posed on a per-organization basis for the information processed in the integrated ICT systems. The research methods employed will span a considerable scale, from theoretical and formal modelling of access control policies and principles to performing simulation and tests of access control models and methods in a laboratory setting and in close co-operation with user-centred environments of developed prototype systems, in which the security and efficiency of the designs can be demonstrated.