Aug 2026· East African Journal of Information Technology· Vol 9, pp. 527-546· 0 citations
TL;DR
An AI-driven risk-adaptive Zero-Trust framework that incorporates real-time patient deterioration into access control decisions and suggests that integrating clinical deterioration predictions into Zero-Trust access control can improve emergency responsiveness while preserving security and accountability.
Abstract
Emergency access to Electronic Health Record (EHR) systems presents a difficult balance between protecting sensitive patient information and ensuring that clinicians can obtain critical information without delay. Existing security approaches, including Zero-Trust Architecture (ZTA), multi-factor authentication (MFA), and conventional break-glass mechanisms, primarily rely on user identity, device, or network context and do not consider the patient's current clinical condition. No existing approach uses the patient's real-time clinical deterioration as the signal that drives the access decision, which is the specific gap this study addresses. The novelty of the proposed framework lies in coupling clinical-deterioration prediction directly to Zero-Trust policy enforcement, together with automatic privilege revocation once the patient stabilises, rather than in any single component. This study proposes an AI-driven risk-adaptive Zero-Trust framework that incorporates real-time patient deterioration into access control decisions. An LSTM model analyses five vital signs and classifies patient status as STABLE, WARNING, or CRITICAL. The predicted clinical risk is combined with role-specific emergency authority to calculate a composite risk score that determines one of four access levels: Direct Access, MFA Required, Restricted Access, or Denied. The framework was evaluated using the MIMIC-III Clinical Database Demo, comprising 98 patients and 5,992 NEWS2-labelled time-series sequences, together with 6,000 simulated access requests across six clinical specialities. The proposed model achieved an overall accuracy of 82.20%, a CRITICAL-class recall of 88.00%, and an AUC of 0.9752. The access-control engine produced an average decision latency of 0.265 ms while maintaining complete audit logging and 99.3% least-privilege compliance. These findings suggest that integrating clinical deterioration predictions into Zero-Trust access control can improve emergency responsiveness while preserving security and accountability. Although the framework was evaluated in a simulated environment, the results demonstrate its potential for future deployment and validation in real clinical settings.
Large language models (LLMs) are rapidly transforming the landscape of healthcare, bringing new opportunities for clinical information management, decision support, documentation, and knowledge-intensive services. However, when these models are applied to regulated health care environments, the risks are not just about the accuracy of the models; they need to be addressed. Hallucinated content, privacy exposure, unreliable evidence, inappropriate automation, adversarial inputs, and uncertain model behaviour may compromise the accountability and safety of AI-assisted healthcare processes. Existing governance models are often based on pre-established controls and thereby have limited ability to rapidly adapt protection based on the varying risk levels of individual requests and clinical situations. Therefore, this study presents a TRUST-CARE, risk-adaptive AI governance framework that incorporates the governance process into the lifecycle of LLMs. The proposed system is based on a combination of contextual risk assessment, analysis of evidence reliability, processing of privacy-aware evidence, retrieval-based generation, hallucination verification, confidence calibration, and risk-triggered human oversight. The proposed methodology compares the performance of TRUST-CARE with the baseline configuration, conventional LLM, healthcare LLM, retrieval-augmented generation, and safety-guarded versions of the two baselines on the basis of task performance, evidence grounding, hallucination rate, calibration, privacy exposure, robustness, security, and expert trustworthiness assessment. The proposed architecture helps determine whether an AI response can be generated automatically, when there is a need for further evidence checking, and when human intervention must be mandated. The governance framework model provides a structured mechanism to link model behaviour with evidence quality, clinical risk, uncertainty and accountability. TRUST-CARE thus advances the standard safety controls in healthcare towards risk-sensitive, evidence-based, auditable AI governance under human supervision.
Shahid Ahmed Qureshi· International journal of com...· 0 citations
: Healthcare ecosystems face persistent identity-fragmentation challenges that undermine secure, interoperable data access across Electronic Health Records (EHR), telemedicine platforms and clinical Application Programming Interfaces (APIs). Existing Identity and Access Management (IAM) solutions rely on static role assignments and reactive audit mechanisms ill-suited to dynamic clinical environments. This paper presents the Zero-Trust Patient Identity Engineering Framework for Healthcare (ZTPIF-H), which integrates decentralised identity, Artificial Intelligence (AI)-driven adaptive authorisation, smart-contract-based consent governance and blockchain-based immutable auditability. The framework is organised around four pillars — Identity Assurance, Adaptive Trust Decisioning, Consent Governance and Immutable Accountability — operationalised through an eight-phase lifecycle. Relative to prior work, this version adds a multi-dimensional comparison with state-of-the-art healthcare IAM approaches, a reproducible experimental protocol, an explicit threat model with a systematic security analysis, and an AI-trustworthiness analysis covering interpretability, calibration, robustness and fail-safe behaviour aligned with the NIST AI Risk Management Framework (AI RMF) and the EU AI Act. A proof-of-concept (PoC) evaluation in a simulated secondary-care environment shows a 42% reduction in authorisation latency, a 62% reduction in false-positive denials and a 77% reduction in standing-privilege exposure versus a conventional IAM baseline. ZTPIF-H aligns with HL7 FHIR R4, OpenID Connect (OIDC), W3C Verifiable Credentials (VC) and NIST Zero Trust Architecture (ZTA) principles, offering a vendor-neutral, incrementally adoptable pathway to modern healthcare identity engineering
Background: Healthcare data systems in the United States face a threat environment in which conventional perimeter-based security architectures are increasingly mismatched to cloud-connected, vendor-dependent, and Internet of Medical Things (IoMT)-enabled clinical infrastructure. Zero-trust architecture (ZTA) and advanced encryption techniques are widely recommended as remedies, yet empirical, quantitative evidence directly comparing zero-trust and perimeter-based postures, and benchmarking the specific cryptographic primitives proposed for healthcare deployment, remains limited.
Objective: This study designs, implements, and empirically evaluates a four-layer Zero-Trust Encrypted Healthcare Data Architecture (ZTE-HDA) that integrates an artificial intelligence/machine learning (AI/ML)-driven continuous verification engine, governed, micro-segmented access control, and a layered encryption scheme combining symmetric, asymmetric, and homomorphic primitives.
Methods: A synthetic dataset of 60,000 access events (3.33% labelled malicious across five attack archetypes: credential theft, insider snooping, ransomware staging, lateral movement, and subtle impossible-travel) was generated to train and evaluate four candidate continuous-verification models (logistic regression, random forest, gradient boosting, and a multilayer perceptron). A benchmark suite measured the performance of AES-256-GCM, ChaCha20-Poly1305, RSA-2048/4096, elliptic-curve Diffie-Hellman (ECDH P-256), a hybrid ECDH+AES-256-GCM scheme, and Paillier homomorphic encryption across payload sizes representative of healthcare data artefacts. A 10,000-trial Monte Carlo simulation modelled lateral breach propagation across a 20-segment healthcare data network under perimeter-based versus zero-trust, continuously verified, micro-segmented conditions. No real patient data, live hospital network, or production healthcare information system was used at any stage; all experiments were conducted entirely on synthetic, computer-generated data.
Results: The gradient boosting and multilayer perceptron models achieved the strongest overall discrimination (area under the receiver operating characteristic curve [AUC] of 0.989 and 0.990, respectively; F1-scores of 0.915 and 0.926), with recall (detection rate) of 88.5% to 94.7% across all four models and a mean per-event inference latency below 3.1 milliseconds for three of the four models, supporting real-time policy decisions. AES-256-GCM substantially outperformed ChaCha20-Poly1305 on this hardware, reaching throughput of approximately 8.0 gigabytes per second for 512 kilobyte payloads, consistent with AES-NI hardware acceleration. Paillier homomorphic addition of 25 encrypted laboratory values was verified to be exact (decrypted sum equal to the plaintext sum to six decimal places) but carried substantial per-value overhead (approximately 104 milliseconds to encrypt a single value). The Monte Carlo simulation showed that the zero-trust, continuously verified architecture reduced the mean breach blast radius from 8.75 to 1.12 of 20 simulated data segments (an 87.2% reduction) and eliminated simulated full-network compromise entirely (13.2% of perimeter-model trials versus 0% of zero-trust-model trials).
Conclusion: An AI/ML-driven continuous verification engine combined with layered, workload-appropriate encryption and micro-segmentation produces large, quantifiable reductions in simulated breach impact relative to a perimeter-based baseline, while remaining within latency and computational budgets that are suggestive of, though not yet confirmed to be, compatibility with real-time clinical operation; this remains to be validated on live clinical systems. The findings, while derived from a simulation rather than a live clinical deployment, offer a preliminary, reproducible quantitative reference point, rather than a confirmed operational benchmark, for healthcare organisations and policymakers evaluating zero-trust and advanced-encryption investment under the evolving United States regulatory landscape.
Chinyere Nelson Amaeze, Ezekiel Dauda Gambo· Advances in Research· 0 citations
Artificial intelligence (AI) is becoming an increasingly important component of healthcare, supporting diagnosis, clinical decision-making, medical imaging, triage, and patient-facing services. While these technologies offer significant opportunities to improve healthcare delivery, they also raise important questions about patient safety, fairness, privacy, transparency, cybersecurity, and accountability. This paper examines the regulatory framework governing medical AI in the European Union, focusing on the interaction between the Artificial Intelligence Act (AI Act), the Medical Device Regulation (MDR), the In Vitro Diagnostic Medical Device Regulation (IVDR), the General Data Protection Regulation (GDPR), and the European Health Data Space (EHDS). Drawing on doctrinal and conceptual regulatory analysis, it argues that many AI-enabled medical systems should be regulated through continuous lifecycle compliance rather than by relying primarily on a one-time assessment at market entry. The analysis identifies the training and validation dataset as a particularly important point of regulatory convergence, especially among the EHDS, GDPR, and AI Act data-governance requirements, and examines how responsibility is allocated across the general-purpose AI value chain under Article 25. Building on this analysis, the paper proposes a compliance-by-design framework that translates overlapping legal requirements into a set of auditable governance artefacts covering system classification, regulatory mapping, data governance, validation, human oversight, conformity assessment, post-market monitoring, and change control. The framework is illustrated through two contested use cases and complemented by recommendations tailored to the responsibilities of different stakeholder groups. The analysis incorporates Regulation (EU) 2026/1744 (Digital Omnibus on AI), while recognising that supporting guidance, harmonised standards, and implementation of the EHDS continue to evolve and should be checked when the framework is applied. The framework is conceptually derived and illustrated through constructed use cases rather than empirically validated; future work should assess its usability, consistency, and discriminating power through structured expert assessment and Delphi-based consensus methods.
Qaiser Khan, Abdul Raffay Saeed· Frontiers in Digital Health· 0 citations
A reproducible evaluation of safety and access control for Medicare.IO is reported, a transparent case study of how an ambitious student prototype can be transformed into a more testable, safety-aware system.
Kaustubha Khandagale, S. Bhosle, Akhilesh Kurhadkar et al.· DMPedia Lecture Notes in Com...· 0 citations
TeleZK-FL establishes the feasibility of verifiable, trustless federated learning on commodity telehealth hardware by eliminating the computational bottlenecks of server-side proof generation while incurring only 0.1%–0.3% AUC degradation.
P. Jayaraman, R. Delhibabu· Frontiers in Digital Health· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
