SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Towards an Integrated Approach to Access Control in Health Information Systems

alize avatar
alize
17 diapositives · 325 Views · Sep 16, 2014

This presentation outlines the iAccess project, which focuses on developing an integrated access control system for healthcare information. Funded by the Norwegian Research Council and conducted from 2005 to 2008, it involves collaborative efforts from NTNU, SINTEF, and the University of Oslo. The project addresses key challenges in sharing sensitive health information across various clinical systems while complying with strict legal frameworks for information security and patient privacy. The iAccess Handbook serves as a valuable resource for healthcare institutions dealing with access control issues.

#towards an integrated approach to access control in health information systems #towards an integrated approach to access control in health information systems ppt #powerpoint #presentation
Towards an Integrated Approach to Access Control in Health Information Systems - slide 1
01 / 17Towards an Integrated Approach to Access Control in Health Information Systems
1 / 17

Télécharger la présentation

Towards an Integrated Approach to Access Control in Health Information Systems
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Towards an Integrated Approach to Access Control to Health Information Presented by: Inger Anne Tøndel SINTEF Co-authors: Per Håkon Meland SINTEF Lillian Røstad SINTEF Øystein Nytrø NTNU

  2. The iAccess Project • Integrated Access Control for Healthcare Information Systems (iAccess) • Funded by the Norwegian Research Council • 2005-2008 (++) • Applied research activities + two PhD-students • A research partnership between NTNU, SINTEF and UiO • NTNU: Dep. of Computer and Information Science • SINTEF: Dep. Software Engineering, Safety and Security • UiO: Faculty of law • Participants: • Rikshospitalet University Hospital/The Norwegian Radium Hospital • Central Norway Regional Health Authority (HEMIT)

  3. Background – Access Control Integration • Reality: Not one EHR, many clinical systems! • Integration of healthcare information from several system is an emerging trend • Local • Regional • National • Access control is a key issue in order to share sensitive information • Various access control mechanisms • Access control in integrated systems • Access control is dependent on the information • Strict legal requirements for information security and patient privacy • Challenges related to technology, organization and legislation

  4. The iAccess Handbook (Norwegian) iaccess.idi.ntnu.no

  5. The iAccess Handbook – Content (1) • Part 1 – Reference Information • A repository of useful information • Technical viewpoint • Organizational viewpoint • Legal viewpoint

  6. Overview of Central Laws and Regulations • Regulations related to the access restriction to treatment of health information. Classified according to formal-, factual-, personnel regulations • Regulations related to instructions, permissions and conditions for sending, receiving and exchanging health information • Regulations related to information quality • Regulations related to provision of the confidentiality, integrity and availability of health information • Regulations related to internal control • Regulations related to particular technical, physical or organisational methods of treatment

  7. The iAccess Handbook – Content (2) • Part 2 – Survey Methods • Part 3 – Combining and Presenting Results  The iAccess Method

  8. Documentation Study • Examples of relevant information: • legislation • local policies and routines • documentation of existing systems • plans and strategies for the future • Our experience: • Hard to know what you will get...

  9. Different focus groups Decision makers System developers/maintainers Process maps Activities, roles, documentation/tools Results Process maps Discussions!! Process Workshops • Scenarios • A new employee starts working at the hospital, and needs access to the IT-systems. • An employee accesses the patient record of his neighbor, without having a medical responsibility for this neighbor.

  10. Semi-Structured Interviews • Experiences of system users • How does the current access control solution influence their workday? • Interviewees • Clinical personnel – physicians, nurses, nutritionists • Administrative personnel – secretaries • Questions based on the scenarios used in the process workshops • Enables comparison

  11. Combining Results • Show results from the different types of surveys in the same diagrams • Domain models • Relation between concepts • Use cases/misuse cases • Real world shortcomings, conflicts, grey areas • Activity diagrams • More structured than process maps • Map activities to roles • Add comments and information about documentation/tools

  12. Example Activity Diagram: The New Employee Scenario

  13. Experiences from the use of the methods • Useful for retrieving information related to organizational issues and work processes • Are often not described in one single document • Information sharing between the participants • The process maps are not ideal for retrieving technical information • Too many details • Hard to show information flow • Important to combine inputs from different focus groups • Grasp the full picture • Makes it possible to discover differences in opinions

  14. Input from different focus groups • Decision makers • Focus on routines, plans for the future • System developers/maintainers • Focus on the IT systems • System users • How does the system fit their work day • Example1: • Routines and responsibilities for auditing of logs • Problems with checking huge logs • Users have high expectations regarding detection of misuse • Example 2: • Routines and forms involved when access is to be assigned to a system • How is this done technically in the systems? • How is this process experienced by the users?

  15. Conclusion • The handbook and the methods  Starting point for working on the challenges of access control in integrated health information systems • Target group • PhD students • Hospitals (IT departments) • Many challenges • Technical • Organizational • Juridical

  16. Further Work • Improve the iAccess handbook • Test new methods • Taxonomy for classification of access control • Observations, logs, questionnaires???? To be decided... • Focus on consent? • PhD students.... • We have concentrated on access control within hospitals • There are also challenges regarding access to information between hospitals (and also other care givers)

  17. Thank you!