# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 6 Discussion and Evaluation  
Traditional access control models often rely on static and predefined roles, making them inflexible and unable to adapt to the dynamic nature of healthcare environments. These models struggle to keep pace with evolving threats and the complexity of modern healthcare operations. This inflexibility can lead to vulnerabilities that expose sensitive patient information to unauthorized access and potential breaches. To address these limitations, this paper proposes a novel integrated access control model that combines the strengths of RBAC, ABAC, and RiBAC. This model leverages the fine-grained control of RBAC to define user roles and permissions, the context-aware policy definition capabilities of ABAC, and the dynamic risk assessment features of RiBAC. The integration of these three access control mechanisms creates a more flexible and adaptable system that can better mitigate emerging threats and ensure the security of sensitive medical information. The paper presents a detailed design and implementation of this model, showcasing its potential to enhance the security of healthcare systems. The results demonstrate the feasibility and effectiveness of the proposed model. Through a series of 43 experiments that simulate various scenarios of access control operations in a healthcare system, the model demonstrates significant improvement in the accuracy, precision, and recall of access control decisions compared to traditional models. The proposed integrated approach demonstrated more responsiveness to dynamic changes in risk profiles and user attributes, providing a more robust and adaptable security solution for healthcare systems. The model's ability to dynamically assess risk and adjust access permissions based on contextual factors significantly enhances its ability to mitigate threats and protect sensitive medical data. The proposed model provides a valuable framework for future research and development in access control for healthcare systems. The proposed model was evaluated against state-of-the-art studies and relevant models from the literature as shown in Table 10. The proposed model provides a layered security approach that incorporates a dedicated layer for security, which does not exist in most of the other models from the literature. This layered approach allows for more granular control and better isolation of sensitive data to enhance overall security. The proposed model includes dynamic risk assessment, a feature that is only partially addressed by Atlam \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Metric** & \begin{tabular}{l} **True** \\ **(TP)** \\ \end{tabular} & \begin{tabular}{l} **Positive** \\ **(FP)** \\ \end{tabular} & \
\begin{tabular}{l} **False Positive** \\ **(FN)** \\ \end{tabular} &
\begin{tabular}{l} **False Negative** \\ **(TN)** \\ \end{tabular} \\ \hline Value & 20 & 2 & 3 & \(18\) \\ \hline \multicolumn{6}{c}{Performance Metrics} \\ \hline Accuracy & \multicolumn{6}{c}{88.37\%} \\ \hline Precision & \multicolumn{6}{c}{90.90\%} \\ \hline Recall & \multicolumn{6}{c}{86.96\%} \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance metrics of the proposed model. et al. [6] and [PERSON] et al. [43]. This dynamic approach allows for more context-aware access decisions, considering factors like time, location, and frequency of requests, leading to more robust security. In addition, the proposed model emphasizes simplified administration, a feature missing in all other models. This likely means it utilizes a user-friendly interface or tools for policy management, making it easier to configure and maintain the access control system. The proposed model also leverages standardization, a feature shared with most of other models from the literature. This means it utilizes a widely recognized standard (XACML), allowing for greater interoperability and easier integration with existing systems. The proposed model prioritizes usability, a feature that does not exist in the other models from the literature.