PubMed Health⌕ Search
Home/Archive/PubMed

PubMed · 15747955

Security requirements in EHR systems and archives.

Pekka Ruotsalainen
View original source ↗Export metadata ↓

Abstract

EHR system is a system for recording, retrieving, and manipulating information in electronic health care records. Archive is an organisation that intends to preserve health records for access and use for an identified group of consumers. There exist many combinations of EHR-systems and archives. EHR-system can be a single on-line system with integrated archiving functions or archive and EHR-system are co-operative or federated systems. This paper describes both common security requirements for EHR-systems and archives and security requirement specific for archives. Requirements are derived from ethical and legal principles. From principles a set of security requirements are derived. Safeguards for implementing security are discussed. In practise EHR-system and archive share many security services. This document is proposing that inside a security domain both the archive and EHR-system have a common security policy. In addition to this the archiving organisation needs a documented policy for information preserving and a policy for access and distribution of information between other archives.

Explore related subjects

Access to InformationArchivesComputer SecurityConfidentialityHumansInformation ManagementMedical Records Systems, ComputerizedJournal Article

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Pekka Ruotsalainen. 2004. Security requirements in EHR systems and archives.. https://pubmed.ncbi.nlm.nih.gov/15747955/

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related citations

PubMed2007

The prevalence and inaccessibility of Internet references in the biomedical literature at the time of publication.

OBJECTIVES: To determine the prevalence and inaccessibility of Internet references in the bibliography of biomedical publications when first released in PubMed. METHODS: During a one-month observational study period (Feb 21 to Mar 21, 2006) the Internet citations from a 20% random sample of all forthcoming publications released in PubMed during the previous day were identified. Attempts to access the referenced Internet citations were completed within one day and inaccessible Internet citations were recorded. RESULTS: The study included 4,699 publications from 844 different journals. Among the 141,845 references there were 840 (0.6%) Internet citations. One or more Internet references were cited in 403 (8.6%) articles. From the 840 Internet references, 11.9% were already inaccessible within two days after an article's release to the public. CONCLUSION: The prevalence of Internet citations in journals included in PubMed is small (<1%); however, the inaccessibility rate at the time of publication is considered substantial. Authors, editors, and publishers need to take responsibility for providing accurate and accessible Internet references.

Access to Information↗
PubMed2007

Securing electronic health records without impeding the flow of information.

OBJECTIVE: We present an integrated set of technologies, known as the Hippocratic Database, that enable healthcare enterprises to comply with privacy and security laws without impeding the legitimate management, sharing, and analysis of personal health information. APPROACH: The Hippocratic Database approach to securing electronic health records involves (1) active enforcement of fine-grained data disclosure policies using query modification techniques, (2) efficient auditing of past database access to verify compliance with policies and track security breaches, (3) data mining algorithms that preserve privacy by randomizing information at the individual level, (4) de-identification of personal health data using an optimal method of k-anonymization, and (5) information sharing across autonomous data sources using cryptographic protocols. CONCLUSIONS: Our research confirms that policies concerning the disclosure of electronic health records can be reliably and efficiently enforced and audited at the database level. We further demonstrate that advanced data mining and anonymization techniques can be employed to analyze aggregate health records without revealing individual patient identities. Finally, we show that web services and commutative encryption can be used to share sensitive information selectively among autonomous entities without compromising security or privacy.

Access to Information↗