Access and privacy rights using web security standards to increase patient empowerment

Area of Science:

• Health Informatics
• Information Security
• Public Health Policy

Background:

• Electronic Health Record (EHR) systems are increasingly complex, with access granted to non-medical personnel, raising privacy and confidentiality concerns.
• Existing access control schemes in healthcare organizations do not fully empower patients regarding their personal health data.
• International guidelines on data privacy, such as those from the OECD, need to be integrated into health information system development.

Purpose of the Study:

• To propose a technical solution for patient empowerment in managing access to Electronic Health Records (EHRs).
• To ensure patients can monitor and control who accesses their health information, thereby enhancing privacy and confidentiality.
• To align health information system development with patient rights and promote data protection standards.

Main Methods:

• Review of OECD principles for privacy and trans-border data flow.
• Introduction of a technical solution based on web security standards for EHR access control.
• Analysis of current EU standards for confidentiality and privacy in healthcare.

Main Results:

• A user-friendly, web-based system enables patients to grant or deny access to their EHRs.
• Patients gain the ability to track the flow of their personal health data.
• The proposed solution aligns with patient empowerment goals and enhances data security.

Conclusions:

• Health information systems that empower patients with control over their EHRs are technically feasible.
• Implementation of such systems is crucial for protecting patient privacy and promoting data confidentiality.
• Governments and society should encourage policies that support patient empowerment in healthcare data management.