Enhancing Healthcare Data Security and User Convenience: An Exploration of Integrated Single Sign-On (SSO) and OAuth for Secure Patient Data Access within AWS GovCloud Environments

Abstract

The ever-increasing adoption of cloud-based healthcare applications necessitates robust security measures to ensure the confidentiality, integrity, and availability of sensitive patient data. This research paper delves into the integration of Single Sign-On (SSO) and OAuth protocols to bolster secure and seamless patient data access within healthcare applications hosted on the secure AWS GovCloud platform.

The healthcare industry faces a unique challenge: balancing the need for efficient access to patient data for improved care delivery with the paramount obligation to safeguard patient privacy. Traditional authentication methods involving individual login credentials for each application pose security risks and hinder user experience.

This paper proposes an integrated SSO and OAuth framework specifically tailored for healthcare applications hosted on AWS GovCloud. SSO centralizes user authentication, enabling a single login process to grant access to authorized applications within the healthcare ecosystem. OAuth, an authorization framework, manages delegated access to patient data, ensuring granular control over what data is shared and with whom.

AWS GovCloud offers a secure and compliant cloud environment specifically designed for government agencies and healthcare institutions subject to stringent regulatory requirements like HIPAA (Health Insurance Portability and Accountability Act). By leveraging AWS GovCloud's robust security infrastructure and compliance certifications, healthcare organizations can confidently deploy their applications while adhering to data privacy regulations.

The proposed framework utilizes a centralized identity provider (IdP) within the healthcare organization's network. This IdP serves as the single point of authentication for users accessing healthcare applications. Upon successful authentication with the IdP, SSO leverages protocols like SAML (Security Assertion Markup Language) to securely exchange user credentials with the target application hosted on AWS GovCloud.

Next, OAuth takes center stage. The healthcare application acts as a resource server, while the centralized IdP functions as an authorization server. When a user attempts to access specific patient data within the application, OAuth facilitates a secure authorization flow. The user explicitly consents to the application's request for access to specific data elements within the patient's electronic health record (EHR).

This integrated approach offers several security advantages. Firstly, by eliminating the need for multiple login credentials, the risk of password fatigue and brute-force attacks diminishes significantly. Additionally, centralized user management within the IdP allows for robust access control policies, ensuring only authorized healthcare personnel can access patient data based on their roles and responsibilities.

Furthermore, OAuth's granular access control ensures that applications only access the specific data elements required for a particular task. This minimizes the exposed data footprint, reducing the potential impact of a security breach. Finally, leveraging AWS GovCloud's built-in security features further strengthens the overall security posture of the healthcare data ecosystem.

Patient privacy remains paramount. The proposed framework incorporates robust consent management mechanisms within the OAuth flow. Patients retain complete control over what data is shared and with whom. Additionally, fine-grained access control policies within the IdP further ensure that only authorized personnel can access specific patient data elements based on the principle of least privilege.

The proposed framework adheres to stringent healthcare data privacy regulations like HIPAA. By utilizing a centralized IdP for authentication and managing user access through granular consent and authorization policies, the framework ensures compliance with relevant regulations. Additionally, deploying applications on AWS GovCloud strengthens the overall compliance posture by leveraging a pre-vetted cloud environment that meets the specific needs of the healthcare industry.

The integrated SSO and OAuth framework streamlines the user experience for healthcare personnel. By eliminating the need to manage multiple login credentials, clinicians and other authorized users can access essential patient data quickly and efficiently. This reduces cognitive burden and allows them to dedicate more time to patient care activities.

Implementing the proposed framework necessitates careful consideration of several technical challenges. Integrating disparate healthcare applications with the SSO and OAuth framework may require the development of custom APIs (Application Programming Interfaces). Additionally, ensuring robust logging and auditing capabilities to track user access and data activity is crucial.

This research lays the groundwork for further exploration. Future investigations could delve into the integration of advanced security protocols like multi-factor authentication (MFA) to further enhance access control. Additionally, research on leveraging emerging technologies like blockchain for secure data provenance and audit trails could be explored within the context of this framework.