# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 4 Implementation of Proposed Model in Healthcare Scenario
### Attribute-Based Access Control Implementation
#### 4.4.4 XACML Policies
This access allows social workers to access relevant patient information to assess the situation, provide appropriate support, and help in cases involving abuse or neglect. As for police officers' access, they cannot delete medical records. This restriction ensures data integrity and prevents unauthorized alteration or removal of patient information. They also cannot write medical records. This limitation is in place as their role primarily involves investigation and law enforcement rather than medical documentation. Also, police officers with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low, or medium. This access allows them to access patient information for investigation purposes, such as gathering evidence or understanding the medical context related to a case of suspected child abuse. \begin{table}
\begin{tabular}{p{42.7 pt} p{34.1 pt} p{34.1 pt}} \hline \hline
**Role** & **Operation** & **Policy Rules** \\ \hline Admin & Delete & Admin can delete any medical records if the risk is negligible. \\  & Write & Admin can write any medical records if the risk is negligible, low or medium. \\  & Read & Admin can read any medical records if the risk is negligible, low or medium. \\ \hline  & Delete & Doctors cannot delete medical records. \\  & Write & Doctors with normal, advanced, or premium privileges can write internal medical records if the risk level is negligible. \\ Doctor & Write & Doctors with advanced, or premium privileges can write confidential medical records if the risk level is negligible. \\  & Read & Doctors with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low or medium. \\  & Read & Doctors with premium privileges can read restricted medical records if the risk level is negligible or low. \\ \hline  & Delete & Nurses cannot delete medical records. \\  & Write & Nurses with normal, advanced, or premium privileges can write internal medical records if the risk level is negligible. \\ Nurse & Read & Nurses with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low or medium. \\  & Read & Nurses with advanced, or premium privileges can read confidential medical records if the risk level is negligible, low or medium. \\  & Read & Nurses with premium privileges can read restricted medical records if the risk level is negligible or low. \\ \hline  & Delete & Social workers cannot delete medical records. \\ Social & Write & Social workers cannot write medical records. \\ Worker & Read & Social workers with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low or medium. \\ \hline  & Delete & Police officers cannot delete medical records. \\  & Write & Police officers cannot write medical records. \\ Police & Read & Police officers with normal, advanced, or premium privileges can read internal medical records if the risk level is negligible, low or medium. \\ Officer & Read & Police officers with advanced, or premium privileges can read confidential medical records if the risk level is negligible, low or medium. \\  & Read & Police officers with premium privileges can read restricted medical records if the risk level is negligible or low. \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Access policies are defined for each role based on the operation type.