An AI-Driven Risk-Adaptive Zero-Trust Framework for Emergency Electronic Health Record Access

Abstract

Emergency access to Electronic Health Record (EHR) systems presents a difficult balance between protecting sensitive patient information and ensuring that clinicians can obtain critical information without delay. Existing security approaches, including Zero-Trust Architecture (ZTA), multi-factor authentication (MFA), and conventional break-glass mechanisms, primarily rely on user identity, device, or network context and do not consider the patient's current clinical condition. No existing approach uses the patient's real-time clinical deterioration as the signal that drives the access decision, which is the specific gap this study addresses. The novelty of the proposed framework lies in coupling clinical-deterioration prediction directly to Zero-Trust policy enforcement, together with automatic privilege revocation once the patient stabilises, rather than in any single component. This study proposes an AI-driven risk-adaptive Zero-Trust framework that incorporates real-time patient deterioration into access control decisions. An LSTM model analyses five vital signs and classifies patient status as STABLE, WARNING, or CRITICAL. The predicted clinical risk is combined with role-specific emergency authority to calculate a composite risk score that determines one of four access levels: Direct Access, MFA Required, Restricted Access, or Denied. The framework was evaluated using the MIMIC-III Clinical Database Demo, comprising 98 patients and 5,992 NEWS2-labelled time-series sequences, together with 6,000 simulated access requests across six clinical specialities. The proposed model achieved an overall accuracy of 82.20%, a CRITICAL-class recall of 88.00%, and an AUC of 0.9752. The access-control engine produced an average decision latency of 0.265 ms while maintaining complete audit logging and 99.3% least-privilege compliance. These findings suggest that integrating clinical deterioration predictions into Zero-Trust access control can improve emergency responsiveness while preserving security and accountability. Although the framework was evaluated in a simulated environment, the results demonstrate its potential for future deployment and validation in real clinical settings.