An Extended Consent-Based Access Control Framework: Pre-Commit Validation and Emergency Access
This framework significantly improves the reliability and efficiency of consent management in healthcare information systems by proactively resolving conflicts, thereby enhancing patient autonomy and data security for healthcare providers and patients. It is an incremental improvement to existing CBAC frameworks.
The paper introduces an extended Consent-Based Access Control (CBAC) framework that addresses the issue of contradictory consent directives in healthcare information systems by enforcing semantic correctness at consent creation time. It achieves this through a pre-commit validation workflow and a Consent Conflict Analysis Module (CCAM), resulting in low and stable runtime decision latency, outperforming standard XACML-based baselines as policy repositories scale. Additionally, it incorporates a context-aware emergency access mechanism that strictly limits disclosure to clinically essential information.
Consent-Based Access Control (CBAC) is a foundational mechanism for enforcing patient autonomy in modern healthcare information systems. Many CBAC frameworks are built on the eXtensible Access Control Markup Language (XACML) and inherit its \emph{lazy evaluation} model, in which policy interactions are resolved only at request time. This design allows contradictory consent directives to accumulate within the repository, creating a semantic gap between patient intent and system behavior while burdening high-frequency runtime decisions with complex conflict resolution. This paper presents an extended CBAC framework that enforces semantic correctness at consent creation time rather than during access evaluation. The framework introduces a pre-commit validation workflow centered on a Consent Conflict Analysis Module (CCAM), which proactively detects modality conflicts and redundancies before directives become active. In addition, immutable system invariants are formalized to guarantee baseline access for record authors and patients, preserving clinical continuity and professional accountability. Finally, the framework incorporates a context-aware emergency mediation mechanism that enables controlled \emph{break-the-glass} access driven by real-time physiological evidence, with disclosure strictly bounded by an Emergency Disclosure Control Function (EDCF). Simulation-based evaluation using controlled synthetic workloads demonstrates that pre-commit conflict resolution yields low and stable runtime decision latency and consistently outperforms standard XACML-based baselines as policy repositories scale. Emergency access experiments further demonstrate strong restrictions on data access, pruning the majority of non-relevant record elements while preserving clinically essential information.