Access control is one of the key issues handling the information flow inside healthcare actors, between healthcare actors and cross border healthcare actions.
Conventional access control models are for example Identity Based Access Control (IBAC) and Role Based Access Control (RBAC). In IBAC access permissions are directly associated with a subject and it is difficult to scale. In RBAC access permissions are based on the role(s) a subject is performing. RBAC gives better scalability and ease of use but have drawbacks.
In Sweden a national security application are under way and is built upon Attribute Based Access Control (ABAC). This model consists of three groups of attributes:

• Subject Attributes
Associated with a subject (E.g. identifier, name, job title, role….)
• Resource Attributes
Associated with a resource (E.g. metadata elements …)
• Environment Attributes
Describes the environment or context (E.g. current date, time, classifications…)

This Swedish initiative will be the world’s largest XACML 3.0 (OASIS) deployment.
I see the beauty of policy’s and the abilities in the Service Oriented perspectives but in the daily caregiver situation could the complexity making the policies be too high and leaving doors open accessing confidential electronic patient records?