A Context-Based Access Control Model for HIPAA Privacy and Security Compliance

It is somewhat ironic that the Administrative Simplification subtitle of HIPAA, the Health Insurance Portability and Accountability Act of 1996, includes several provisions that result in administrative complexity of a hitherto unknown degree. Cumbersome record keeping and reporting requirements offset the benefits brought about by claims-processing automation. This paper proposes a new approach to meeting much of the burden imposed by the HIPAA privacy and security requirements. By adopting this approach, an organization may avail itself of the significant benefits brought about by transaction standardization and, at the same time, avoid the unwanted side effects of having to adopt inconvenient manual processes.