abstract

Role-Based Access Control (RBAC) has become one of the most widely adopted methods for safeguarding electronic health records (EHRs) in contemporary healthcare environments. By assigning permissions to roles rather than individuals, RBAC aims to streamline access privileges and mitigate risks associated with inappropriate data exposure. This paper presents an in-depth examination of RBAC within the healthcare sector, highlighting its theoretical underpinnings, practical applications, benefits, and limitations. The study employs a mixed-methods approach, combining a systematic literature review, expert interviews, and a survey of healthcare information technology professionals to gauge the efficacy of RBAC implementations. Findings reveal that while RBAC significantly enhances data security and compliance with regulations, its effectiveness can be undermined by organisational challenges such as poorly defined roles, lack of ongoing training, and insufficient policy enforcement. Moreover, rapid technological evolution and the growing need for cross-institutional data sharing introduce complexities that traditional RBAC systems may struggle to address. This paper proposes strategies to refine RBAC models, including dynamic role assignment, integration with emerging technologies like blockchain, and the importance of a robust organisational culture that prioritises security. Ultimately, the study underscores that a well-implemented RBAC framework, when combined with complementary security measures and comprehensive governance, can substantially reduce the risk of data breaches and bolster patient trust in digital healthcare systems.