Restructuring the electronic medical record to incorporate full digital signature capability

The security of Electronic Medical Records can be enhanced by the addition of digital signatures that guarantee data integrity, authenticate the signer, and establish non-repudiation through the use of public key encryption. The task is complicated by the contribution of multiple providers to an encounter and the entry of data at multiple points in time Dividing encounters into an episode of care and redesigning the data model of the EMR will facilitate full signature capabilities. Generation of digital signatures is best accomplished using microprocessors on smart cards that control visibility of the private keys and assist in user authentication. The Java Programming Language including cryptography extensions and a smart card API is a useful tool for adding digital signature to an EMR. Inter-operability of signatures and continuity of signature will require attention to standards and preservation of cryptography and authentication certificate archives. Digital signatures will need to accommodate changes in data storage formats when information is transported between EMR systems using XML or other transaction standards because the original signatures will not validate if the data storage format changes. The costs of adding digital signature to EMR mandates serious examination of the business case for digital signature within an EMR as compared with transactions such as electronic prescriptions. At present, there is no regulatory requirement for digital signature of an EMR.