To meet requirements of EHRs security sharing in the cloud computing conditions, this paper presents an access control framework for composite EHRs under the cloud computing environment. We propose and construct composite EHRs based on multi-CDAs' logical relationship. On the basis of attribute-based multilevel access control policy, we realize the security management of composite EHRs. By using the XML Web service, which based on the XML XLINK technology, we achieve the goal of downloading and checking composite EHRs. Compared with existing schemes, our project is much more suitable for EHRs security sharing in the cloud computing conditions.