Secure and Customizable EHR Management Services with COASTmed

The exchange of electronic health records (EHR) among multiple parties and for multiple purposes raises nontrivial concerns. Unfortunately, privacy and operational policies granting individual access privileges to parties are often artifacts foreign to healthcare systems, thus EHR security is all the more frail. Moreover, current web service technologies that constitute many EHR systems treat users uniformly, making it more difficult for information consumers to use this data for specific purposes. Therefore, there is a need for EHR systems that offer secure, policy compliant access to data services and enable users to obtain the required information according to their individual authority. We present COASTmed, a notional EHR system that simultaneously offers provider-controlled differential service access and user-controlled customization. Our prototype is founded on the architectural principles of the COAST style and leverages the Rei policy language.