## 5 Methodology
### UCON and Patient Health Record Access  
The UCON model is required as dynamic access control to monitor the runtime access of the patient's health records. This control will verify the conditions of the time constraints declared by the patient. For example, if the healthcare personnel accesses the health record via a blockchain transaction within a specific time frame, this access will be allowed and constantly monitored at run time. The access will be given for a specific time frame, and the dynamic access will be monitored continuously. As soon as the condition fails, access will be revoked. Similarly, the model grants access to the health record. Additionally, unauthorized access to the health record is recorded, and a notification is sent to keep the record for audit purposes.  
Suppose the patient wants to book an appointment at a surgery clinic. In that case, the specified doctor is given access to the patient's health record at a specific time, for example, from 3 to 5 pm, and for a certain number of access times. The patient gives this authority to the doctor. Access control manages the required validity, time, and attempts. It therefore monitors access times, allowing access if the number is not exceeded while revoking access if the number is exceeded or any other unauthorized entry is attempted. These attempts will be monitored and recorded, and notifications will be sent to the patient.  
We will have a policy in the HRS that when the doctor needs to access the health record when the patient has an appointment, two hours before the appointment time, the doctor should have access to the patient's health record. If the patient and the doctor agree, the doctor can access the health record. As mentioned in the sequence diagram, we will provide API access such that any HRS can access to the blockchain-based system. Figure 3 shows the sequence diagram for accessing user-centric health records by health personnel.  
Similarly, suppose the patient delegates access to a laboratory technician or pharmacist. In that case, access will be granted for a specific time and a specific number of access times, whether to read, write, or both. The attending physician may want to access the patient's health record after conducting analyses to determine specific drugs or the type of operation and ensure that it is performed or postponed. However, the patient will have to grant authority to the doctor again after the specified time. Access control will manage the required authority, time, and access times for each access.  
Figure 2: The research methodology explaining our proposal for a user-centric health record system.  
If the patient cannot give authority, a family member will be able to grant access authority. Suppose no one is available from the family. In that case, the admin of the blockchain can be given authority to the required doctor at a specific time as an exceptional situation monitored by access control. Notifications will always be sent to the patient in the event of authorized and unauthorized access. Thus, blockchain preserves privacy and monitors all transactions at any time, ensuring they are not changed, tampered with, or deleted.