Role based access control (RBAC)

Why it matters

A hospital record is used by hundreds of people with very different jobs. Managing permissions person by person becomes unmanageable and leaves gaps. In a 2010 economic analysis for NIST, 84 percent of RBAC adopters surveyed said roles improved the efficiency of maintaining their access control policy [1]. Access management is also one of the ten practices in the Health Industry Cybersecurity Practices publication [2].

Key points

• Each user receives the access their role requires and no more: a pharmacist sees prescriptions and dispensing, a laboratory scientist sees orders and results.
• In health care, role alone is not enough. Access also reflects assignment, such as the patients under a clinician's care at their facility, with audited break glass access for emergencies.
• Roles must be reviewed when staff change jobs or leave.
• Strong sign in completes the model. CISA states that multifactor authentication makes an account 99 percent less likely to be hacked [3].

In Moana

MOANA Desktop gives each role its own workspace, with role based access, two factor authentication and audited break glass access across the platform.

Sources

1. Economic Analysis of Role Based Access Control: Final Report, RTI International for the National Institute of Standards and Technology, 2010
2. Exploring the Health Industry Cybersecurity Practices publication and how to use it, TechTarget HealthTech Security, 2023
3. Multifactor authentication, Cybersecurity and Infrastructure Security Agency, 2024