Capability Exchange: Improving Access Control Usability in Health IT

Clinicians report usability problems in modern health IT systems in part because the strictness of computerization eliminates the layer of informality which previously enabled them to get their jobs done. In this paper, we examine a solution by considering the strictly-enforced medical order as a security capability, and then using capability exchange to authorize frustrated end-users to re-introduce the necessarily flexibility. We prototype our idea using OpenEMR and Belay, and show how this prototype can address access control usability problems reported by clinicians.