Role prediction using Electronic Medical Record system audits.

Wen Zhang*, Carl A. Gunter, David Liebovitz, Jian Tian, Bradley Malin

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

23 Scopus citations


Electronic Medical Records (EMRs) provide convenient access to patient data for parties who should have it, but, unless managed properly, may also provide it to those who should not. Distinguishing the two is a core security challenge for EMRs. Strategies proposed to address these problems include Role Based Access Control (RBAC), which assigns collections of privileges called roles to users, and Experience Based Access Management (EBAM), which analyzes audit logs to determine access rights. In this paper, we integrate RBAC and EBAM through an algorithm, called Roll-Up, to manage roles effectively. In doing so, we introduce the concept of "role prediction" to identify roles from audit data. We apply the algorithm to three months of logs from Northwestern Memorial Hospital's Cerner system with approximately 8000 users and 140 roles. We demonstrate that existing roles can be predicted with 50% accuracy and intelligent grouping of roles through Roll-Up can facilitate 65% accuracy.

Original languageEnglish (US)
Pages (from-to)858-867
Number of pages10
JournalAMIA ... Annual Symposium proceedings / AMIA Symposium. AMIA Symposium
StatePublished - 2011

ASJC Scopus subject areas

  • General Medicine


Dive into the research topics of 'Role prediction using Electronic Medical Record system audits.'. Together they form a unique fingerprint.

Cite this