Health Insurance Portability and Accountability Act (HIPPA) Compliant Access Control Model for Web Services
Abstract
Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a set of rules to be followed by health plans, doctors, hospitals, and other healthcare providers in the U.S. HIPAA privacy rules create national standards to protect individuals’ health information. Recently, there have been increasing demands and discussions about Web services-based healthcare applications. It is, therefore, necessary for HIPAA privacy rules to be standardized in Web services. However, so far no comprehensive solutions to the various privacy issues have been defined in this area. This paper summarizes the HIPAA privacy rules and surveys the topic of protecting health data privacy under the HIPAA. We propose a vocabulary-based Web services privacy framework with Role-based Access Control (RBAC) with privacy extensions and argue the HIPAA compliance for such framework. For illustration, we present the first two HIPAA rules in the extended RBAC model and embed into the HIPAA-compliant technical architecture for implementation of Web services.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In e-healthcare, personal data are subject to regulations like the Health Insurance Portability and Accountability Act of the United States (HIPPA).
“More specifically in e-healthcare, personal data are subjected to regulations like the Health Insurance Portability and Accountability Act of the United States (HIPPA) [8].”
From Federated learning-based AI approaches in smart healthcare: Concepts, taxonomies, challenges and open issues (2023) · cites this paper as [8]
Cited by
Sorted by citations
Federated learning for smart healthcare: A survey
Nguyen, D. C., Pham, Q.-V., Pathirana, P. N., Ding, M., Seneviratne, A., Lin, Z., Dobre, O., & Hwang, W.-J. (2023) · ACM Computing Surveys · doi:10.1145/3501296 · Cited by 827 · see citing works
Rahman, A., Hossain, M. S., Muhammad, G., Kundu, D., Debnath, T., Rahman, M., Khan, M. S. I., Tiwari, P., & Band, S. S. (2023) · Cluster Computing · doi:10.1007/s10586-022-03658-4 · Cited by 399 · see citing works
“More specifically in e-healthcare, personal data are subjected to regulations like the Health Insurance Portability and Accountability Act of the United States (HIPPA) [8].”
MethodSecurity and Privacy Challenges of Large Language Models: A Survey
Das, B. C., Amini, M. H., & Wu, Y. (2025) · ACM Computing Surveys · doi:10.1145/3712001 · Cited by 445 · see citing works
Secure information systems development – a survey and comparison
Villarroel, R. H., Fernández‐Medina, E., & Piattini, M. G. (2004) · Computers & Security · doi:10.1016/j.cose.2004.09.011 · Cited by 64 · see citing works
Semantic access control for cloud computing based on e-Healthcare
Sun, L., Wang, H., Yong, J., et al. (2012) · IEEE International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd.2012.6221866 · Cited by 64 · see citing works
The national healthcare crisis: Is eHealth a key solution?
HILL, J. W., & Powell, P. (2009) · Business Horizons · doi:10.1016/j.bushor.2009.01.006 · Cited by 60 · see citing works
Churi, P. P., Pawar, A., & Moreno-Guerrero, A.-J. (2021) · Inventions · doi:10.3390/inventions6030045 · Cited by 30 · see citing works
Purpose Based Access Control for Privacy Protection in E-Healthcare Services
Sun, L., Wang, H., Soar, J., et al. (2012) · Journal of Software · doi:10.4304/jsw.7.11.2443-2449 · Cited by 28 · see citing works
Enabling Web Services Policy Negotiation with Privacy preserved using XACML
Cheng, V. S. Y., Hung, P. C. K., & Chiu, D. K. W. (2007) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2007.207 · Cited by 26 · see citing works
“We adopt the privacy access control model from [8] and extended with SOAP, XACML and negotiation message.”
MethodSelf-citationBloomfield, B. S., Fischer, A. J., King, H. C., Lehman, E. L., & Clark, R. R. (2020) · Journal of Applied School Psychology · doi:10.1080/15377903.2020.1749204 · Cited by 19 · see citing works
Federated Learning for Smart Healthcare: A SurveyPreprint
Nguyen, D. C., Pham, Q., Pathirana, P. N., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.08834 · Cited by 17 · see citing works
Privacy Risks Analysis and Mitigation in Federated Learning for Medical Images
Das, B. C., Amini, M. H., & Wu, Y. (2023) · IEEE International Conference on Bioinformatics and Biomedicine (BIBM) · doi:10.1109/bibm58861.2023.10385829 · Cited by 15 · see citing works
“Global data protection regulations like HIPPA [3] are in place to safeguard private health information, emphasizing the need for privacy.”
BackgroundA Federated Learning Framework Based on Differentially Private Continuous Data Release
Cai, J., Liu, X., Ye, Q., Liu, Y., & Wang, Y. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3364060 · Cited by 14 · see citing works
“…AImodelsadequately,butsharingclients’datarashlyforcen-tralized learning, especially for sensitive medical data, may violate regulations such as US Health Insurance Portability and Accountability Act (HIPPA) [4] or the general data protection regulation (GDPR) [5].”
BackgroundFederated learning for digital healthcare: concepts, applications, frameworks, and challenges
Sachin, D. N., Annappa, B., & Ambesange, S. (2024) · Computing · doi:10.1007/s00607-024-01317-7 · Cited by 11 · see citing works
A purpose based usage access control model for E-healthcare services
Sun, L., & Wang, H. (2011) · doi:10.1109/icdke.2011.6053928 · Cited by 9 · see citing works
Rowan, W., O’Connor, Y., Lynch, L., & Heavin, C. (2017) · Procedia Computer Science · doi:10.1016/j.procs.2017.11.125 · Cited by 8 · see citing works
Access control management for e-Healthcare in cloud environment
Sun, L., Yong, J., & Soar, J. (2014) · ICST Transactions on Scalable Information Systems · doi:10.4108/sis.1.2.e3 · Cited by 8 · see citing works
“em requires a much more effective access approach due to the fact that collecting countrywide, worldwide information system is paramount for health organizations, governments, and world-wide agencies [1, 4]. However, it is getting hard to extract useful information from the enormous amount of data that is being collec…”
BackgroundRole-Based Access Control Requirements Model with Purpose Extension.
Farzad, F., Yu, E., & Hung, P. C. K. (2007) · Cited by 7 · see citing works
Self-citationAhmed, K. M., Das, B. C., Saadati, Y., & Amini, M. H. (2024) · Big and integrated artificial intelligence · doi:10.1007/978-3-031-57567-9_4 · Cited by 6 · see citing works
Nursing Activities Score: trajectory of the instrument from paper to cloud in a university hospital
de Camargo, M. D., Silveira, D. T., Lazzari, D. D., et al. (2021) · Revista da Escola de Enfermagem da USP · doi:10.1590/1980-220x-reeusp-2020-0233 · Cited by 6 · see citing works
“The institution database was protected in a business environment by Google®, by the certified security and data protection devices and by the standards of the Health Insurance Portability and Accountability Act (HIPPA) (14–15) .”
MethodPrivacy Access Control Model with Location Constraints for XML Services
Zheng, Y., Chen, Y., & Hung, P. C. K. (2007) · doi:10.1109/icdew.2007.4401018 · Cited by 4 · see citing works
“The following set of privacy-based entities (purpose, recipient, obligation and retention) is added to the proposed core RBAC as shown in Figure 1 [26].”
MethodInfluentialSelf-citationBig Data Paradigm for Healthcare Sector
Wassan, J. T. (2015) · Advances in public policy and administration (APPA) book series · doi:10.4018/978-1-4666-9649-5.ch010 · Cited by 4 · see citing works
Towards a Privacy Policy Enforcement Middleware with Location Intelligence
Zheng, Y., Chiu, D. K. W., Wang, H., et al. (2007) · doi:10.1109/edocw.2007.32 · Cited by 4 · see citing works
“[37] P. C. K. Hung, K. Karlapalem and J. Gray III, “Least Privilege Security in CapBasED-AMS,” The International Journal of Cooperative Information Systems, Vol. 8, Issue.”
MethodInfluentialSelf-citationChiu, D. K. W., Wang, Y., Hung, P. C. K., Cheng, V. S. Y., Chan, K.-K., Kafeza, E., & Tung (2011) · International Journal of Systems and Service-Oriented Engineering · doi:10.4018/jssoe.2011100105 · Cited by 3 · see citing works
Self-citationPathFL: Multi-alignment Federated Learning for pathology image segmentation
Zhang, Y., Chen, F., Qi, Y., Yang, G., & Fu, H. (2025) · Medical Image Analysis · doi:10.1016/j.media.2025.103670 · Cited by 2 · see citing works
Big Data Paradigm for Healthcare Sector
Wassan, J. T. (2016) · Big Data · doi:10.4018/978-1-4666-9840-6.ch026 · Cited by 2 · see citing works
Research Issues of Privacy Access Control Model for Mobile Ad Hoc Healthcare Applications with XACML
Hung, P. C. K., Andrade, J., Chen, Y., et al. (2007) · International Conference on Advanced Information Networking and Applications Workshops (WAINA) · doi:10.1109/ainaw.2007.312 · Cited by 2 · see citing works
“In this research work, XACML will be the first emerging technology we investigate to be one of the starting points to fill into the picture [25].”
BackgroundSelf-citationBradshaw, K., Donohue, B. C., & Wilks, C. R. (2014) · Aggression and Violent Behavior · doi:10.1016/j.avb.2014.04.010 · Cited by 2 · see citing works
An Edge Computing-Based Complex Event Processing Technique for Sensor-Based Systems
Dhillon, A. S. (2018) · doi:10.22215/etd/2018-13383 · Cited by 2 · see citing works
The National Health Information Network and the Future of Medical Information Privacy
Szewczak, E. J. (2015) · Communications of the IIMA · doi:10.58729/1941-6687.1336 · Cited by 2 · see citing works
“…likely that any future NHIN will use TCP/IP as its fundamental protocol, perhaps together with legacy systems for a time (www.amia.org/pubs/symposia/D005234.pdf; Retrieved September 3, 2006 fi-om the American Medical Informatics Association website); Deshmukh & Croasdell, 2005; Cheng & Hung, 2006).”
BackgroundWu, D., Zhong, S., He, Y., Luo, X., & Gao, X. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3683950 · Cited by 2 · see citing works
“Besides, with the consideration of data security and resources [18], [47], data owners (e.g., data management companies) are unwilling to directly share their raw data.”
Secure authentication and authorization design for rural‐based healthcare institutions
Hembroff, G. C., & Cai, Y. (2008) · Security and Communication Networks · doi:10.1002/sec.41 · Cited by 1 · see citing works
A Taxonomic View of Consumer Online Privacy Legal Issues, Legislation, and Litigation
Secor, A. M. (2009) · IGI Global eBooks · doi:10.4018/978-1-60566-012-7.ch002 · Cited by 1 · see citing works
Opportunities and Threats for E-Health on an Ageing Society
Borges, A. P., & Cardoso, C. (2016) · IGI Global eBooks · doi:10.4018/978-1-4666-9978-6.ch076 · Cited by 1 · see citing works
Privacy Issues in the Web Services Architecture
Carminati, B., Ferrari, E., & Hung, P. C. K. (2011) · IGI Global eBooks · doi:10.4018/978-1-59140-914-4.ch002
Self-citationAccessibility Issues in Interoperable Sharing of Electronic Health Records: Physician’s Perspective
Bhartiya, S., & Mehrotra, D. (2016) · Healthcare delivery in the information age · doi:10.1007/978-3-319-25973-4_10
“It is mandatory for the system to identify any security gaps while accessing EHRs and fulfil its responsibilities for both the HIPAA Privacy Rule (Cheng and Hung 2006) and other applicable laws.”
BackgroundChiu, D. K. W., Wang, Y., Hung, P. C. K., et al. (2012) · IGI Global eBooks · doi:10.4018/978-1-4666-2470-2.ch015
Self-citationHe, X., Li, T., Wen, C., Liu, H., & Sun, Q. L. (2025) · International Conference on Intelligent Technology and Embedded Systems (ICITES) · doi:10.1109/icites66466.2025.11274294
“…over the internet poses substantial risks of private personal information leakage and may violate existing privacy laws [10], such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States [11] and the European Union’s General Data Protection Regulation (GDPR) [12].”
- Authors
- Cheng, V. S. Y., & Hung, P. C. K.
- Affiliations
- Hong Kong University of Science and Technology (HK)
- Ontario Tech University (CA)
- ORCID
- Hung, Patrick C.K.
- Venue
- International Journal of Healthcare Information Systems and Informatics
- Publisher
- IGI Global Scientific Publishing
- Published
- 2006-01-01
- Volume
- 1
- Issue
- 1
- Pages
- 22-39
- ISSN
- 1555-3396 (ISSN-L)
- 1555-340X
- OpenAlex
- W1990798025
- Cited by
- 37
- References
- 0
- Citations by year
- 2026: 1 · 2025: 3 · 2024: 3 · 2023: 1 · 2022: 2 · 2021: 2 · 2020: 1 · 2018: 1 · 2017: 1 · 2016: 3 · 2015: 2 · 2014: 2 · 2012: 3
- FWCI
- 9.30
- Type
- journal article
- Language
- ng
- Open access
- closed
- Locations
- International Journal of Healthcare Information Systems and Informatics (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- HIPAA, health information privacy, role-based access control, access control, web services, privacy framework, HIPAA compliance, health data protection, technical architecture
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
