The COVID-19 pandemic further outlined the importance of global healthcare services provisioning for diagnosing and treating patients who tend to travel and live for large periods away from home and can be anywhere at any given time. Advances in technology enable healthcare practitioners to access critical data regarding a person’s health status to provide better services. Medical data are sensitive in nature, and therefore, a reliable mechanism should ensure that only authorized entities can access data when needed. This paper, through a layered consideration of a Globalized Healthcare Provisioning Ecosystem (GHPE), reveals the interdependencies among its major components and suggests a necessary abstraction to identify requirements for the design of an access control suitable for the ecosystem. These requirements are imposed by the nature of the medical data as well as by the newly introduced potentials of Internet of Medical Things (IoMT) devices. As a result, an attribute-based access control framework is proposed aiming to provide prompt and secure access to medical data globally by utilizing state-of-the-art technologies and standards, including Next-Generation Access Control (NGAC), blockchain and smart contracts. Three types of smart contracts are proposed that enable access control to implement attribute and policy stores where policy classes and attributes are decentralized and immutable. In addition, the usage of blockchain-based distributed identities allows patients to be in control of access to their medical data and also enables healthcare service providers to access medical data promptly and reliably through the proposed access control framework. The qualitative characteristics of the proposed approach toward a decentralized and patient-centric access control in GHPE are demonstrated and discussed based on an application paradigm.

Although the recent trend for the term “cyber-attack” is restricted for incidents causing physical damage, it has been traditionally used to describe a broader range of attempts to make unauthorized use of an asset related to computer information systems, computer networks, or even personal computing devices. As such, a cyber-attack aims to steal, alter a targets’ system/data, or even destroy targets by gaining access into a targeted system. In this respect, a whole new industry has been shaped around the need for protection against cyber-attacks, i.e. the “cyber-security” domain, which primarily deals with the protection of systems (incl. HW/SW & data) connected to the internet against cyber-attacks and should not be necessarily mixed with the domain of Information Technology (IT) Security (see Figure 4.1) that mainly refers to the protection of information. Cyber-security, on the other hand, is the ability to protect or defend the use of cyberspace from cyber-attacks by securing “things”, vulnerable through ICT. Figure 4.1 Information technology security vs cyber-security. https://s3-euw1-ap-pe-df-pch-content-public-p.s3.eu-west-1.amazonaws.com/9781003337492/51cb024d-c0f0-4f03-818e-5915e5d0ef18/content/fig4_1.tif" xmlns:xlink="https://www.w3.org/1999/xlink"/>