Towards enforcement of purpose for privacy policy in distributed healthcare

Purpose of access is one of the core concepts in privacy which considers the data user's intent as a factor in making access control decisions and enforcement of purpose is required to ensure that data is used as what it intends for. In general, the enforcement of purpose is a complicated task. The main difficulty is how to identify the purpose of an agent when it requests to perform an action. In this paper, we discuss the design issue of purpose enforcement based on our proposed (defined) enforcement structure: pre-enforcement, ongoing-enforcement, and post-enforcement. We also propose an enforcement solution for usage control designed for distributed healthcare information system, particularly, the pre-enforcement of purpose (the validation of claimed purpose at the initial state before data is granted access).