Re: Resend: [CPR security policies at BHS]

[Jim Williams <jgwilliams@mindspring.com>]

The constraints on psychological information in the Baptist Healthcare
policy remind me of the mental-health constraints modeled by T.C. Ting.
His goal was to produce a policy model for mental health records in
Connecticut.  His work clearly indicates that the access controls seen
in traditional operating systems don't suffice.  

   T.C. Ting, "Application Information Security Semantics:  A Case of 
   Mental Health Delivery," DATABASE SECURITY III: Status and Prospects,
   Elsevier Science 1990.

My take on his work is that one needs role based access control, with
parameterized roles.  A similar but different conclusion is reached in
the following paper:

   L. Notargiacomo and R.D. Graubart, "Health Delivery:  The Problem 
   Solved?"  DATABASE SECURITY IV: Status and Prospects, Elsevier 
   Science, 1991.

I'll be happy to send copies of either paper to those interested.


-- Jim Williams
----------------
Broadcast message to hrac-rfp from Jim Williams <jgwilliams@mindspring.com>.
Go to http://cadse.cs.fiu.edu/omg/hrac-rfp to browse the mail list archive.