# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 3 Risk-Aware RBAC and ABAC Model: Proposed Approach  
The limitations of traditional access control systems have become increasingly apparent, which often struggle to cope with the dynamic and complex nature of modern healthcare environments. The complex relationship of diverse roles, varying levels of sensitivity in patient data, and the need for timely access for healthcare professionals pose substantial challenges for these models [32]. Additionally, traditional access control mechanisms lack the granularity required to differentiate between users based on their specific attributes, leading to potential security vulnerabilities and privacy concerns. As healthcare systems become more interconnected and data-driven, a more adaptive and comprehensive approach to access control becomes imperative. RBAC offers a structured approach to permission management by assigning predefined roles to users based on their responsibilities to simplify access control administration in healthcare environments. This model aligns well with organizational structures, ensuring individuals have the necessary access rights for their specific tasks [33]. Similarly, ABAC introduces flexibility by considering various attributes like user characteristics and environmental conditions, enabling fine-grained control over access permissions. In healthcare, where dynamic access requirements prevail, ABAC proves invaluable in adapting to changing circumstances and ensuring precise access control. In the same way, RiBAC adds a layer of sophistication by dynamically adjusting access permissions in response to perceived risk factors [34]. This is particularly crucial in healthcare, where the sensitivity of patient data requires real-time adjustments to access privileges, proactively mitigating potential risks and enhancing overall information security in healthcare systems. While each of these elements possesses distinct advantages, their standalone application in modern healthcare applications holds inherent limitations. Therefore, this paper proposes a novel risk-aware RBAC and ABAC access control model by integrating RiBAC, RBAC, and ABAC approaches, as shown in Figure 1, to provide a dynamic and fine-grained model for healthcare systems. The proposed model uses not only users' roles within their organizations and their dynamic attributes but also the estimated risk value associated with each access request to determine the access decision. The conceptualization of an integrated model incorporating RiBAC, RBAC, and ABAC represents a novel contribution to the scholarly landscape. This novel approach holds significant promise, particularly for healthcare systems. By combining these distinct approaches, our proposed model offers several advantages. Firstly, it enhances the granularity of access control mechanisms to enable finer-grained control over sensitive healthcare data. Secondly, it facilitates more dynamic risk assessment and mitigation strategies, which is vital for safeguarding patient confidentiality and ensuring regulatory compliance. Lastly, the integration of RiBAC, RBAC, and ABAC modules fosters a more adaptive and context aware access control model that is better suited to the dynamic and multifaceted nature of modern healthcare systems. The structure of the proposed risk-aware RBAC and ABAC model can be divided into three main layers, as depicted in Figure 2. These layers work together in a sequential and complementary manner to deliver robust, efficient, and context-aware access control. The layers are as follows:  
* **Layer 1: Role-Based Access Control (RBAC) Layer**: This is the outermost layer, where initial access decisions are made based on the user's assigned role. It is implemented at the Policy Enforcement Point (PEP), acting as a gatekeeper that intercepts access requests at the Application Programming Interface (API) or service interface. In practical deployments, APIs serve as the main gateway through which external users and systems interact with the healthcare platform.