# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 4 Implementation of Proposed Model in Healthcare Scenario
### Risk-Based Access Control Implementation
#### 4.3.6 Legal Compliance and GDPR Alignment  
In alignment with privacy and security regulations such as the General Data Protection Regulation (GDPR) and the UK Data Protection Act (2018), the proposed model integrates both technical and organizational safeguards to ensure lawful and ethical handling of sensitive medical data. From a technical perspective, the following safeguards are embedded into the proposed risk-based system:  
* Data Minimization: Access decisions are based on the principle of least privilege, ensuring that only the minimum necessary data required to perform a task is accessible to the user.
* Context-Aware Restrictions: Real-time evaluation of user context (time, location, and duty status) enforces restrictions on access to sensitive resources, reducing the risk of unauthorized or accidental disclosures, as mandated by GDPR Articles 5(1)(c) and 32.
* Risk Quantification and Categorization: The calculated final risk score is categorized into five risk levels (Negligible to Extreme) to guide automated or administrative  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Output Risk Value** & **Risk Category** \\ \hline
0.0–0.1 & Negligible \\ \hline
0.1–0.3 & Low \\ \hline
0.3–0.5 & Medium \\ \hline
0.5–0.7 & High \\ \hline \(>=\)0.7 & Extreme \\ \hline \hline \end{tabular}
\end{table}
Table 6: Risk category with the corresponding score.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Action** & **Sensitivity** & **\(C\)** & **\(I\)** & **\(A\)** \\ \hline Create & Sensitive/Not-Sensitive & 0 & 1 & 1 \\ \hline View & Sensitive & 1 & 0 & 0 \\ \hline View & Not-Sensitive & 0 & 0 & 1 \\ \hline Modify & Sensitive/Not-Sensitive & 0 & 1 & 1 \\ \hline Delete & Sensitive/Not-Sensitive & 0 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Risk values associated with action and data sensitivity [12; 37].  
interventions, including blocking, flagging, or logging of high-risk access attempts as part of incident response protocols.
* Auditability and Accountability: All access decisions and calculated risk scores are logged for audit purposes, facilitating accountability and post-incident investigation, satisfying GDPR Article 30's requirements for records of processing activities. From an organizational perspective, the proposed model assumes the following.
* Policy Enforcement: Healthcare institutions must define clear policies outlining which roles (e.g., doctors, nurses, police officers) are authorized to access specific data categories under defined contextual conditions.
* Training and Awareness: Users are trained regularly on appropriate data handling, the risks associated with unauthorized access, and GDPR requirements to promote a security-conscious culture.
* Incident Handling Procedures: High or extreme risk levels automatically trigger incident response measures, such as real-time alerts to security officers or automated access denials, ensuring prompt organizational reaction to potential data breaches.
* Data Protection Impact Assessments (DPIAs): The risk engine's outputs can feed into DPIAs required under GDPR Article 35 for processing operations that are likely to result in high risk to individuals' rights and freedoms.  
These safeguards ensure that the system's dynamic risk evaluation mechanism not only enhances security but also meets GDPR and similar legal obligations concerning personal health data protection.