Authentication, Authorization, and Access Control in Health IT

Authentication, authorization, and access control are the technical safeguards that decide who may reach health information and what they may do with it. Authentication establishes that a user (or system) is who it claims to be; authorization determines what an authenticated user is permitted to do; and access control enforces those permissions when data and functions are requested. Together they are the front line of confidentiality and integrity in health information systems.

Definition

Authentication is the process of verifying a claimed identity; authorization is the process of determining the actions and resources a verified identity is permitted; access control is the mechanism that enforces authorization decisions by allowing or denying specific operations on protected resources.

Scope

This entry explains the distinction between authentication and authorization, common authentication factors and the role of multi-factor authentication, and the dominant models of access control, especially role-based access control and its extensions, as applied to electronic health records and other clinical systems. It also touches on the tension between restricting access and supporting clinical workflow. It is reference material on the concepts and is not an implementation guide or security configuration for any specific system.

Core questions

• How does a system establish that a user is who they claim to be?
• How are permissions structured so that users can do their work without over-broad access?
• What models exist for organizing access decisions, and how do they differ?
• How can access control respect both security and clinical workflow needs?
• What role do patients have in controlling access to their own records?

Key concepts

• Authentication versus authorization
• Authentication factors (knowledge, possession, inherence)
• Multi-factor authentication
• Role-based access control (RBAC)
• Least privilege and separation of duties
• Attribute-based and context-aware access control
• Break-the-glass emergency access
• Granular, patient-directed access preferences

Mechanisms

Access decisions proceed in stages. Authentication first binds a request to an identity using one or more factors: something the user knows (a password), has (a token or device), or is (a biometric); combining factors yields multi-factor authentication, which resists credential theft better than passwords alone. Once authenticated, authorization determines permitted actions. Role-based access control organizes this by assigning permissions to roles and roles to users, so that a clinician inherits the access appropriate to their function rather than receiving individually managed permissions; this aligns naturally with the principle of least privilege and eases administration in large organizations (Sandhu et al., 1996; Ferraiolo et al., 2001). Extensions add attributes and context (such as relationship to the patient or time of access), and emergency 'break-the-glass' provisions allow controlled override with heightened logging. Patients themselves may wish to exert granular control over who sees which parts of their record, which adds a further dimension to access policy (Caine & Hanania, 2013). The HIPAA Security Rule's technical safeguards require access control and related controls for electronic protected health information (HHS OCR, 2013).

Clinical relevance

Well-designed access control protects confidentiality while still letting care teams reach the information they need; poorly designed controls can either expose data or obstruct clinical work, prompting unsafe workarounds. Evidence that patients want fine-grained control over their records bears on how systems balance protection with autonomy (Caine & Hanania, 2013). This entry describes the concepts for reference and education and is not a configuration or security guide for any specific system.

Evidence & guidelines

The conceptual foundations of role-based access control are laid out in the seminal model paper (Sandhu et al., 1996) and codified in the proposed NIST standard (Ferraiolo et al., 2001). The HIPAA Security Rule's technical safeguards require access control, audit controls, integrity protection, person-or-entity authentication, and transmission security for electronic protected health information (HHS OCR, 2013). Specific control requirements depend on an organization's risk analysis and on current official standards.

History

Early computer systems relied on simple discretionary and mandatory access-control models. Role-based access control emerged in the 1990s as a more manageable approach for large organizations, formalized in the influential model of Sandhu and colleagues (1996) and later proposed as a NIST standard (Ferraiolo et al., 2001). Health-care adoption followed because clinical roles map naturally onto role-based permissions, and the approach has since been extended with attribute- and context-aware mechanisms to handle the nuances of clinical access.

Debates

How granular should patient control over record access be?

Survey evidence indicates patients often want fine-grained control over who can see specific parts of their electronic records, but implementing such granularity can complicate clinical access and care coordination, raising a design tension between autonomy and usability.

Seminal works

• sandhu-1996
• ferraiolo-2001

Frequently asked questions

What is the difference between authentication and authorization?

Authentication verifies who a user is (for example, by checking a password and a second factor), while authorization decides what that verified user is allowed to do. Authentication comes first; authorization governs the actions that follow.

Why is role-based access control common in health IT?

Clinical work is organized around defined roles, so assigning permissions to roles and roles to people scales better than managing each user's access individually. It also supports the principle of least privilege, giving each role only the access its function requires.