Role-Based Access Control for Healthcare

Quick Answer

Role-Based Access Control combined with mandatory account uniqueness is the right fit because the scenario actually describes two separate problems that need two separate fixes: the current DAC model lets individual users set their own permissions rather than enforcing access based on job function, and separately, nurses have been sharing accounts to reach records outside their own unit. RBAC solves the first problem by tying access to defined roles like doctor, nurse, lab technician, and administrative staff, so permissions are determined by job function rather than by whatever an individual user decides to grant, which is what directly satisfies HIPAA's need-to-know requirement, since a nurse's role determines exactly what patient data they can see, not personal discretion. Mandatory account uniqueness solves the second problem by requiring every user to authenticate with their own distinct identifier, which makes account sharing structurally impossible rather than merely discouraged by policy, and it also restores accountability, since every action can now be traced to a specific individual rather than a shared login. Neither piece alone fully addresses the scenario: RBAC without unique accounts still allows shared credentials to bypass role boundaries, and unique accounts without RBAC still leave permissions at each user's own discretion. When a scenario combines a need-to-know access problem with an account-sharing problem, look for an answer that pairs a role-based model with an identity-uniqueness requirement.