Sujansky & Associates, LLC, San Carlos, CA, USA.
Sujansky & Associates, LLC, San Carlos, CA, USA.
J Biomed Inform. 2010 Oct;43(5 Suppl):S46-S50. doi: 10.1016/j.jbi.2010.08.001. Epub 2010 Aug 7.
Online personal health records (PHRs) enable patients to access, manage, and share certain of their own health information electronically. This capability creates the need for precise access-controls mechanisms that restrict the sharing of data to that intended by the patient. The authors describe the design and implementation of an access-control mechanism for PHR repositories that is modeled on the eXtensible Access Control Markup Language (XACML) standard, but intended to reduce the cognitive and computational complexity of XACML. The authors implemented the mechanism entirely in a relational database system using ANSI-standard SQL statements. Based on a set of access-control rules encoded as relational table rows, the mechanism determines via a single SQL query whether a user who accesses patient data from a specific application is authorized to perform a requested operation on a specified data object. Testing of this query on a moderately large database has demonstrated execution times consistently below 100ms. The authors include the details of the implementation, including algorithms, examples, and a test database as Supplementary materials.
在线个人健康记录 (PHR) 使患者能够以电子方式访问、管理和共享某些自己的健康信息。这种能力需要精确的访问控制机制，将数据的共享限制在患者预期的范围内。作者描述了一种针对 PHR 存储库的访问控制机制的设计和实现，该机制基于可扩展访问控制标记语言 (XACML) 标准，但旨在降低 XACML 的认知和计算复杂性。作者完全使用关系数据库系统和 ANSI 标准 SQL 语句来实现该机制。该机制基于一组编码为关系表行的访问控制规则，通过单个 SQL 查询来确定从特定应用程序访问患者数据的用户是否被授权对指定数据对象执行请求的操作。在一个中等大小的数据库上对该查询进行测试，证明其执行时间始终低于 100ms。作者包括了实现的详细信息，包括算法、示例和一个测试数据库作为补充材料。
