Consent-based access control for secure and privacy-preserving health information exchange

Electronic health record exchanges are crucial functions of modern healthcare systems. These components are fundamental in providing quality care and enable for a larger spectrum of services. A framework which protects patient information during data exchanges is essential for healthcare systems. To achieve security and privacy-preservation for information exchange, we propose a consent-based access control (CBAC) mechanism for healthcare systems. A consent is an authorization initiated by a patient for an intended data requester via an agreement between them. After obtaining the consent from the patient, a healthcare organization can gain access to the data, which is encrypted by a healthcare provider. This is achieved by a cryptographic primitive: conditional proxy re-encryption. By doing so, patient medical data is protected against access of unauthorized parties, including public data center. Additionally, the proposed scheme achieves collusion resistance. Furthermore, mutual authentication and contextual privacy are attained. Performance evaluation demonstrates that the proposed CBAC scheme can achieve security and privacy preservation with high computational efficiency.