The context and the sitbac models for privacy preservationan experimental comparison of model comprehension and synthesis

Situation-Based Access Control (SitBAC) is a conceptual model for representing access control policies of healthcare organizations by characterizing situations of access to patient data. The SitBAC model enables formal representation of access situations as an ontology of concepts (Patient, Data Requestor, EHR, Task, and Response) along with their attributes and relationships. A competing access control model is the Contextual Role-Based Access Control (Context) model. The Context model uses logical expressions (rules) that specify contextual authorizations (i.e., characteristics of access requests that are available at access time). Open questions that relate to formal representation of scenarios involving access to patient data are: 1) which of the two models yields a formal representation that is easier to comprehend; 2) which of the two models facilitates the synthesis of correct models, and how does the task complexity affect the performance of comprehension and synthesis. In this study, we address these questions through a controlled experiment. The results of the experiment suggest that while there are no differences between the two models when it comes to comprehending or synthesizing simple scenarios of data access, for complex scenarios, there is a significant advantage to the SitBAC model in terms of both comprehension and synthesis.