Attribute-Based Access Control and Minimum Necessary Enforcement in Interoperable US Healthcare Systems
Gavkharoybonu Abdukarimova · International Journal of Scientific Research in Science Engineering and Technology · 2024
The accelerated rate of interoperable healthcare systems in the United States has compounded the difficulty of implementing the Health Insurance Portability and Accountability Act (HIPAA) of minimum necessary standard in heterogeneous electronic health record (EHR), virtual care, Internet of Things (IoT), and application programming interface (API)-based settings. The contextual sensitivity and flexibility found in fine-grained, dynamic authorization that is demanded by such environments are not achieved by the traditional role-based access control (RBAC) models. The article investigates attribute-based access control (ABAC) as a supporting element of implementing minimum necessary access in interoperable U.S. healthcare systems. The research will be based on the recent breakthroughs in policy-focused architectures, risk-sensitive and hybrid access control models, and blockchain-powered enforcement models to provide the synthesis of the current study of solving the problem of ABAC implementation, policy enforcement through smart contracts, and audit access governance. The analysis identifies the ways in which contextual, environmental and compliance motivated attributes can be combined with interoperability standards including HL7/FHIR to provide accurate and purposely constrained data sharing with regulatory compliance maintained. Moreover, the article also discusses how decentralized technologies can be used to enhance access integrity, accountability, and cross-organizational trust, especially in cloud-based, virtual hospital, and IoT-enabled healthcare environments. Such issues as attribute governance, complexity of policies, scalability, and cross-domain interoperability are mentioned, and the future research directions are suggested to develop standardized, patient-centered, and legally required access control systems. The results highlight how ABAC has the potential to conceptualize the principle of minimum necessary as a dynamic and enforceable control and not a fixed compliance standard in contemporary healthcare systems in the United States.