Role prediction using Electronic Medical Record system audits.

Zhang W, Gunter CA, Liebovitz D, Tian J, Malin B
AMIA Annu Symp Proc. 2011 2011: 858-67

PMID: 22195144 · PMCID: PMC3243238

Electronic Medical Records (EMRs) provide convenient access to patient data for parties who should have it, but, unless managed properly, may also provide it to those who should not. Distinguishing the two is a core security challenge for EMRs. Strategies proposed to address these problems include Role Based Access Control (RBAC), which assigns collections of privileges called roles to users, and Experience Based Access Management (EBAM), which analyzes audit logs to determine access rights. In this paper, we integrate RBAC and EBAM through an algorithm, called Roll-Up, to manage roles effectively. In doing so, we introduce the concept of "role prediction" to identify roles from audit data. We apply the algorithm to three months of logs from Northwestern Memorial Hospital's Cerner system with approximately 8000 users and 140 roles. We demonstrate that existing roles can be predicted with 50% accuracy and intelligent grouping of roles through Roll-Up can facilitate 65% accuracy.

MeSH Terms (6)

Algorithms Computer Security Electronic Health Records Humans Medical Audit Medical Records Systems, Computerized

Connections (2)

This publication is referenced by other Labnodes entities: