# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 1 Introduction  
The rapid integration of information technology into the healthcare sector has accompanied unprecedented advancements that revolutionize healthcare services. This digital evolution encompasses the adoption of electronic health records (EHRs), telemedicine, wearable health devices, and advanced data analytics, which have collectively enhanced the efficiency, accuracy, and accessibility of the healthcare system. However, alongside these improvements, the digital transformation has also introduced a variety of security challenges. As healthcare systems increasingly depend on interconnected digital platforms, safeguarding the confidentiality, integrity, and availability of sensitive patient data has become a paramount concern [1]. The proliferation of cyber threats, such as ransomware attacks, data breaches, and unauthorized access, highlights the vulnerability of healthcaredata to malicious activities. Protecting this sensitive information is critical not only to comply with regulatory requirements such as the HIPAA (Health Insurance Portability and Accountability Act) but also to maintain patient trust and ensure the safe and effective operation of healthcare services [2; 3]. Access control is a crucial solution when it comes to addressing security concerns related to such issues. It enables the denial of unauthorized users and restricts specific operations (e.g., read, write, and delete) performed by authorized users [4; 5]. In the digital domain, traditional access control models protect sensitive data and resources in various domains, including healthcare systems. These models refer to methods used to manage access to sensitive data to ensure that only authorized users can interact with the resources. In healthcare systems, these resources include EHRs, patient information, employee information, and other sensitive data [6]. Traditional access control models face limitations in adapting to the dynamic risks of modern digital healthcare systems. These models, including Role-Based Access Control (RBAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC), each have their unique advantages to ensure security and availability in different contexts [7]. However, the access control models commonly employed in today's systems are falling short of addressing the dynamic risks associated with health systems in today's digital environment. Traditional access control models rely on role-based permissions and rarely provide fine-grained access control. These models are hard to adapt to the dynamic nature of modern healthcare environments [8; 9]. To address the shortcomings of traditional access control models, this paper proposes a novel composite access control model that integrates three key models: RBAC to provide the system with resource optimization capabilities; Attribute-Based Access Control (ABAC) to offer fine-grained access control; and Risk-Based Access Control (RiBAC) to enable dynamic adjustments to access decisions. The integration of these access control models is utilized to compensate for the limitations that arise from their isolated application. This integrated approach streamlines access management through role-based categorization while considering detailed attribute-based context and dynamic risk assessment. When applied to healthcare systems, this novel model enhances their overall performance, adaptability, and security. To the best of the authors' knowledge, this is the first paper to discuss integrating these approaches, as highlighted after reviewing the state-of-the-art literature. The contribution of this paper can be summarized as follows:  
* It proposes a novel risk-aware RBAC and ABAC access control model to enhance the flexibility, adaptability, and security issues associated with modern healthcare systems. This addresses the limitations of traditional access control models by providing a more comprehensive and flexible approach to managing access to sensitive healthcare data.