4. Ontology-Driven Authorization Policies on Personal Health Records for Sustainable Citizen-Centered Healthcare

The citizen-centered paradigm requires that citizens are active participants in their healthcare processes. Personal health records (PHRs) empower citizens and allow them to manage their health and wellness by collecting life-long cross-institutional information from various sources. A virtual PHR is defined here as a collaborative platform, which is enhanced by cloud computing and Internet of Things (IOT) technologies, for sharing citizens’ healthcare data typically stored in distributed, autonomous healthcare data sources as well as healthcare data stored by the citizen him/herself and assistive technology equipment; it can thus be considered as an entity on the network that, in addition to its own medical data, it can, be populated by relevant healthcare information on the fly at the moment of an attempted access. Although the requirement for integrating distributed, heterogeneous data sources for use by PHR services is challenging, pointing to the need for establishing a data sharing policy based on an interoperability platform, to resolve the heterogeneity among the data sources, new security challenges are induced due to the facts that citizens are the owners of their medical data and that various security policies are enforced on the various data sources. This chapter presents an authorization system for a virtual PHR, which is based on semantic technologies such as ontologies and is provided as a cloud service, to enable authorized access to integrated citizen information upon user requests. The system is based on the role and attribute based access control (RABAC) model and supports authorization policies of various granularity levels subject to area-wide constraints imposed by the health and social services involved.