Statistics for An Access Control Framework for Protecting Personal Electronic Health Records