A model of accountability, confidentiality and override for healthcare and other applications

ABSTRACT

A UML model of Authorisation is described, which was developed for an Electronic Medical Records application in collaboration with the UK NHS Information Authority. The model is an enhancement of the UK Healthcare Model (HcM), in that it provides extra classes for use with HcM classes. It provides powerful confidentiality specification capabilities, which can also be used in other applications.A Role (actually called AgentActivityType for consistency with the HcM) may be directly associated with an Accountability. An Accountability is an agreement where one Party commissions a second Party to undertake Activities under the authority of that Accountability.Four types of Confidentiality Permission are defined which allow access to data items (SubjectPhenomena), or to data items with specific types (SubjectPhenomenonType). Access can be granted to individual Agents, or to AuthorizedAgents acting in specified Roles. A model of override allows the Confidentiality Permissions to be overridden in a strictly controlled way. Override facilities are granted to Agents by establishing appropriate Accountabilities, and any use of override is logged.Access to data can be granted to groups of Agents, and to group of Roles. Establishing access rights for a group involves defining a set of Confidentiality Permissions for the group.The Authorisation Model is illustrated throughout the paper by examples from healthcare. In particular a demanding scenario (child abuse) is presented. In this scenario complex restrictions must be placed on the data, which might result in inappropriate actions if clinicians and other professionals are denied access to the data.

REFERENCES

• 1: "Information for Health: an Information Strategy for the NHS", NHS Executive, ref A1103 (September 1998).
• 2: "NHS - IMG Healthcare Model", NHS IMC. www.imc.exec.nhs.uk/hcm (1998).
• 3: srens, R., Dobson, J., "Responsibility modelling as a technique for organisational requirements definition", Intelligent Systems Engineering" (Spring 1994).
• 4: "The Clinical View of the Common Basic Specification - The Cosmos Project Clinical Process Model", NHS IMC, ref E5018 (1992).
• 5: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 6: Griew A, "Healthcare Scenarios and other papers" http://137.44.37.10/chi/, 'PHSS Reports', appendix B1 (1999).
• 7: Longstaff JJ, Thick M et al, "Confidentiality for a Primary Care-based EPR", Proceedings of TEHRE 98 Conference, CAEHR, ISBN 1 -893378-00-4 (November 1998).
• 8: Longstaff JJ, Thick M et al, "EHR and EPR Confidentiality based on Accountability and Consent: Tools for the Caldicott Guardian", Health Informatics Journal, Vol 6, No 1, ISSN 1460-4582 (March 2000).