在醫療系統中，存取控管是電子病歷安全防護的核心。針對這樣的議題，我們實驗室已經有設計出一種安全的架構，利用最新的程式開發技術，剖面導向程式設計為基礎，設計出一種宣告式電子病歷安全控管的方法。這樣的設計讓安全管理者可以有系統化的控制整個系統的安全存取。但是這樣的架構下，安全規則的變動必須經過好幾道複雜的手續，造成使用上彈性不足。 本研究針對這樣的架構提出幾種改進的方式，使安全規則更動更具有彈性。主要分為兩方面，第一，針對安全規則的變數，設計可以彈性更動的方式，不需要為了更動變數而重複整個安全控管規則產生流程。第二，利用動態載入的功能，提出可以由外部Java程式寫好安全控管規則，在執行時候將該規則載入來判斷，如此對於複雜的安全控管規則也有修改的彈性。希望藉由這樣彈性的設計使我們設計的安全控管架構更能符合實際使用的需求。 / Maintaining proper access control to Electronic Medical Records (EMR) is essential to protecting patients’ privacy. However, the fine-grained and dynamic nature of access control rules for EMR has imposed great challenges on the healthcare information system developers. This thesis presents a dynamically configurable access control mechanism for Web-based EMR systems.It is an enhancement of a previous work in which static aspects are employed to enforce fine-grained access control for EMR. Specifically, we provide two additional kinds of dynamic adjustment mechanism to enhance the static access control aspects, namely dynamic parameters and dynamic constraints. If the scope of dynamic changes is small, dynamic parameters can realize the required changes. Otherwise, dynamic constraints can be used to support replacement of the access control enforcing code while allowing the EMR application running as usual. Consequently, system administrators have a fine range of choices with different trade-offs between flexibility and performance, namely fully static aspects, parameterized aspects using dynamic parameters and fully dynamic aspects using dynamic constraints. We have built a Web-based EMR prototype implementation using AspectJ to demonstrate our approach.