Related Experiment Video
Updated: May 15, 2026
Implementation of a Real-Time Psychosis Risk Detection and Alerting System Based on Electronic Health Records using CogStack
Published on: May 15, 2020
Security and privacy in electronic health records: a systematic literature review
José Luis Fernández-Alemán1, Inmaculada Carrión Señor, Pedro Ángel Oliver Lozoya
1Department de Informatics and Systems, Faculty of Computer Science, University of Murcia, 30100 Murcia, Spain. aleman@um.es
Objective:
To report the results of a systematic literature review concerning the security and privacy of electronic health record (EHR) systems.
Data Sources:
Original articles written in English found in MEDLINE, ACM Digital Library, Wiley InterScience, IEEE Digital Library, Science@Direct, MetaPress, ERIC, CINAHL and Trip Database.
Study Selection:
Only those articles dealing with the security and privacy of EHR systems.
Data Extraction:
The extraction of 775 articles using a predefined search string, the outcome of which was reviewed by three authors and checked by a fourth.
Results:
A total of 49 articles were selected, of which 26 used standards or regulations related to the privacy and security of EHR data. The most widely used regulations are the Health Insurance Portability and Accountability Act (HIPAA) and the European Data Protection Directive 95/46/EC. We found 23 articles that used symmetric key and/or asymmetric key schemes and 13 articles that employed the pseudo anonymity technique in EHR systems. A total of 11 articles propose the use of a digital signature scheme based on PKI (Public Key Infrastructure) and 13 articles propose a login/password (seven of them combined with a digital certificate or PIN) for authentication. The preferred access control model appears to be Role-Based Access Control (RBAC), since it is used in 27 studies. Ten of these studies discuss who should define the EHR systems' roles. Eleven studies discuss who should provide access to EHR data: patients or health entities. Sixteen of the articles reviewed indicate that it is necessary to override defined access policies in the case of an emergency. In 25 articles an audit-log of the system is produced. Only four studies mention that system users and/or health staff should be trained in security and privacy.
Conclusions:
Recent years have witnessed the design of standards and the promulgation of directives concerning security and privacy in EHR systems. However, more work should be done to adopt these regulations and to deploy secure EHR systems.
Related Concept Videos
01:30Methods of Documentation VII: EMR
01:25Ethical Standards I
The Code of Ethics provisions outline the nurse's duty to the patient, the healthcare team, the profession, and society. The Code's fundamental principles include advocacy,...
01:06Legal Guidelines for Documentation
01:18Guidelines and Strategies for Safe Computer Charting
Maintain Confidentiality and Security:
01:11Purpose of Health Records I
Here's a breakdown of how health records serve these purposes:
01:23Ethical Standards II
Nurses are entrusted with upholding various ethical principles and standards. Nurses forge solid therapeutic relationships using trust, empathy, autonomy, confidentiality, and professional competence.
Confidentiality is crucial, embodying respect for individual privacy and...