Access Control, Identity Management, and Authentication
Access questions test identity proofing, authentication strength, authorization models, and lifecycle controls. eHealth adds clinical urgency, federated partners, and break-glass access to life-critical records.
Core rules
Identification claims an identity; authentication verifies it; authorization decides what it may do. Apply least privilege, need-to-know, and separation of duties. RBAC assigns permissions to roles, ABAC evaluates attributes such as department, patient relationship, or location, and PBAC uses policy. The joiner-mover-leaver process must create, change, and revoke access promptly. Privileged accounts need privileged access management, vaulting, and session recording. Use SSO and federation with SAML 2.0 or OpenID Connect; SMART on FHIR uses OAuth 2.0 scopes to limit app access to FHIR resources.
Authentication strength
NIST SP 800-63-3 separates IAL, AAL, and FAL. Clinical access generally needs AAL2, with phishing-resistant FIDO2/WebAuthn for high-risk roles. SMS OTP is weaker against interception. Session timeouts, re-authentication for sensitive actions, and audit logs are technical safeguards. Break-glass accounts should trigger alerts and retrospective review.
Worked example
A clinician from a partner hospital needs to view a shared record. The identity provider asserts a role attribute via SAML; the local RBAC map grants read-only access to that patient's encounter. MFA at AAL2 is required. In an emergency, the clinician uses break-glass, which grants temporary access but pages the security team; the review confirms the emergency and documents it. Reasoning: federation handles identity, local authorization enforces least privilege, and break-glass balances safety with accountability.
Traps
Role explosion from creating a role per person. Shared accounts. Treating SMS OTP as strong MFA everywhere. Overbroad OAuth scopes. Failing to deprovision leavers. No review of break-glass use.