Modelling a user authorisation and data access framework for multi-specialty research systems in secondary health care

Patient identification and consequent recruitment in clinical trials is normally preceded with searches on electronic health record (EHR) systems. Query results may be collated across multiple health organisations and specialties. In such scenarios, a prime concern is the possibility of systems and their users inadvertently or otherwise impinging on the privacy of patients. Access to patient data is crucial for research purposes, but the degree of access must be controlled in such a way that it conforms to agreed legal, organisational and ethical policies. In this paper, we present a proposed model for managing a dynamic matrix of roles and data access privileges within the context of research systems in secondary care.