Preserving confidentiality and privacy of the patient’s EHR using the OrBAC and AES in cloud environment*

Recently, the use of cloud computing has been spread in various fields. One of the striking areas is the healthcare domain where the patient’s data are outsourced to the cloud storage as Electronic Health Record (EHR). Cloud computing provides the EHR with valuable benefits, but at the same time it brings some security concerns regarding the privacy and confidentiality of the patient data. In this paper, we propose a cloud based EHR system exploiting the AES cryptography with the organization-based access control. In our system, the AES encryption is performed twice to provide two layers of security and confidentiality to the EHR data which is referred to as primary and temporary encryption. The proposed system ensures the privacy of the patient along with the confidentiality of medical information in both normal and emergency situations. The security concerns of our system are analyzed based on the basic security requirements for the cloud based EHR systems. The proposed system is implemented and its performance is evaluated through experiments to prove its effectiveness for its use in resource-constrained devices. © 2018 Informa UK Limited, trading as Taylor & Francis Group.