Towards an evaluation framework for medical device-integrated electronic medical record

Area of Science:

• Health Informatics
• Cybersecurity in Healthcare
• Medical Device Integration

Background:

• Medical device (MD)-integrated electronic medical records (MDI-EMR) introduce significant cyber threats impacting patient safety.
• Existing risk assessment approaches for EMR and MDs often evaluate these components independently, failing to address integrated vulnerabilities.

Purpose of the Study:

• To identify comprehensive evaluation dimensions and measures for MDI-EMR systems.
• To propose an integrated evaluation framework for MDI-EMR, addressing the limitations of independent assessment methods.

Main Methods:

• Conducted a comprehensive literature review across multiple databases (PubMed, Web of Knowledge, Scopus, ACM, Embase, IEEE, Ingenta).
• Analyzed existing EMR and MD risk assessment frameworks and security controls.
• Synthesized findings to develop a novel framework based on sociotechnical dimensions and MD risk assessment approaches.

Main Results:

• Previous evaluation frameworks inadequately addressed the integrated nature of MDI-EMR.
• Identified common evaluation aspects from existing, yet fragmented, risk management and assessment frameworks.
• Proposed a novel, integrative evaluation framework for MDI-EMR.

Conclusions:

• The proposed framework provides a comprehensive approach to evaluating MDI-EMR, crucial for ensuring patient safety.
• This framework aims to inform stakeholders about safety levels and assess risk mitigation effectiveness.
• Further validation and refinement are planned to enhance the framework's applicability and utility.