# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 4 Implementation of Proposed Model in Healthcare Scenario
### Attribute-Based Access Control Implementation
#### 4.4.4 XACML Policies  
Once the PDP engine was implemented, the last thing needed was to define our XACML policies. XACML articulates access control policies, defining permissible actions and their conditions (who can do what and when). Access policies were created considering the roles of the main actors in the MC Children's Hospital to specify the privileges each actor can perform at a certain time considering the level of the risk. The access policies were developed and implemented to ensure the appropriate handling and protection of medical records in the MC Children's Hospital scenario. These access policies are designed to strike a balance between maintaining data security, ensuring appropriate access to medical records based on professional roles and responsibilities, and safeguarding patient privacy. They aim to support the delivery of quality healthcare while adhering to legal and ethical standards. The complete access policies for each role based on the operation type and risk level are shown in Table 7.  
For admins' access, they are granted the ability to delete medical records if the risk is negligible. This access allows them to remove irrelevant or outdated information to maintain data integrity and minimize clutter in the system. Admins can also write any medical records if the risk is negligible, low, or medium. This access enables them to update patient records or add necessary information in cases where the risk level is within acceptable limits. Similarly, admins can read any medical records if the risk is negligible, low, or medium. This access allows them to review and access patient information for administrative purposes, such as verifying data accuracy or fulfilling legal requirements. For doctors' access, they are not granted the ability to delete medical records. This restriction ensures data integrity and prevents the accidental or malicious deletion of patient information. Doctors with normal, advanced, or premium privileges can write internal medical records if the risk level is negligible. This access enables doctors to document their observations, diagnoses, and treatment plans for patients. In the same way, doctors with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low, or medium. This access allows doctors to review patient histories, lab results, and other relevant information to provide appropriate care and make informed medical decisions. Also, doctors with advanced or premium privileges can access confidential and restricted medical records if the risk level is negligible, low, or medium. This access is granted to authorized personnel who require access to sensitive information for specialized treatments or research purposes. As far as nurses' access, they are not granted the ability to delete medical records. This restriction ensures data integrity and prevents accidental or unauthorized removal of patient information. Also, nurses with normal, advanced, or premium privileges can write internal medical records if the risk level is negligible. This access allows nurses to document patient care activities, observations, and medication administration. Similarly, nurses with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low, or medium. This access enables nurses to access patient information for providing appropriate care, monitoring vital signs, and administering medications. As for social workers' access, they cannot delete medical records. This restriction ensures data integrity and prevents the unauthorized alteration or removal of patient information. They also cannot write medical records. This limitation is in place because social workers primarily focus on providing support and assistance to patients and their families, rather than documenting medical information. Also, social workers with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low, or medium.