Security and privacy in electronic health records: a systematic literature review

From Clinfowiki
Jump to: navigation, search

First Review


Privacy and Security in Electronic Health Record (EHR) is still an ongoing initiative in most Healthcare Industries. It is huge and rules are constantly changing. Most vendors are also working hard in developing, creating and embedding Privacy and Security within the system.


The authors of this study aims to “report the results of a systematic literature review concerning the security and privacy of electronic health record (EHR) system.” [1] One of their goals was to find out if certain EHRs were utilizing rules/regulations related to security and privacy


The selection process included articles dealing with Security and Privacy of EHR Systems from various data sources such as MEDLINE, ACM Digital Library, Wiley InterScience, IEEE Digital Library, Science@Direct, MetaPress, ERIC, CINAHL and Trip Database. They used a pre-defined search string and able to extract 775 articles which were reviewed and narrowed down to 49 articles by the three authors. [1]


Among the 49 articles that were subject to their system review, study revealed the following:

 * 26 used standards and regulations related to the Privacy and Security of EHR Data. The most widely used regulations are:
        **Health Insurance Portability and Accountability Act (HIPAA) and 
        **The European Data Protection Directive 95/46/EC 
 * 23 articles used symmetric key and/or asymmetric key schemes 
 * 13 articles employed the pseudo anonymity technique in EHR systems  
 * 11 articles proposed the use of a digital signature scheme based on PKI (Public Key Infrastructure)
 * 13 articles proposed a login/password (seven of them combined with a digital certificate or PIN) for authentication.[1] 
 * 27 studies included Role-Based Access Control (RBAC) and seemed to be the most preferred
 * 25 studies included availability of Audit-log files [1]


The works of the authors are highly admirable. It was very tedious and time very consuming yet they came up with very informative and accurate results. I do agree with the authors that Privacy and Security Standards and regulations have always been in place and integrated in the EHR Systems. However, it is ongoing and continues to evolve and need more enhancements from time to time. With Meaningful Use as one its drivers to implement Privacy and Security, more initiatives are coming on this area of the EHR.

Second Review


This paper describes the results of a systematic literature review of privacy and security practices used within electronic health record systems.


The authors purport that at the time of the writing, there had been very little policy development involving the many significant privacy and security issues to be handled given the advent of integrated electronic health records (EHRs). Privacy is defined as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others”. The three fundamental goals of privacy and security are confidentiality, integrity, and availability. Confidentiality is the process that ensures that information is accessible only to those authorized to have access to it. Integrity refers to the duty to ensure that information is accurate and not modified in an unauthorized fashion. Availability is the property of being accessible and useable at the time needed by an authorized entity. The authors also note that an essential component of security is accountability.


The fundamental question these researchers hoped to answer was “What security and privacy features do current EHR systems have?” The authors used a comparative framework extracted from the ISO 27799 standard. A systematic literature review was performed following guidelines set by the Preferred Reporting Items for Systematic reviews and Meta-Analysis (PRISMA) group. The literature search used the following keywords: “electronic health record” AND (“privacy” OR “security”)).


The literature search produced 49 relevant articles which cited 26 standards and regulations related to privacy and security of EHR data. The most commonly cited regulations were the Health Insurance Portability and Accountability Act (HIPAA) and the European Data Protection Directive 95/46/EC. Technical methodologies cited included symmetric and asymmetric keys for data encryption, pseudo-anonymity techniques, digital signatures based on Public Key Infrastructure (PKI), logins and passwords combined with digital certificates or personal identification numbers (PINs). The most common access control model was role-based access control (RBAC). The use of audit logs and personnel training were also noted in the literature studied. A summary of this study’s findings can be found in Tables 3 and 4 of the original paper.


Each paper included in the systematic review was examined for the following: • What standards and regulations are followed? • Are anonymity techniques used? • Is encryption used? • What authentication methods are used? • Access control models used and overrides allowed? • How are user roles defined and granted? • What kind of information is exchanged? • Are audit logs used? • Is user training in security and privacy implemented?

The most common standards cited included HIPAA, ASTM, European Union Directives, CEN/ISO EN13606, IMIA Code of Ethics, Digital Signature Guidelines of the American Bar Association, and standards developed by National Institute of Standards and Technology (NIST). In regard to anonymity, use of two-way pseudonymization (replaces the patient’s name with a code) and one-way anonymization techniques were discussed. De-identification with and without the ability to backward decode patient information is necessary for medical research using patient records. Encryption was commonly cited in these studies and included by symmetric key and public key schemes. In regard to user authentication, the most common method cited was username and password, although HIPAA suggests two-factor authentication using two of the three following types of information: something a person knows, something a person has, and/or a biometric attribute. A study of access control methods showed that RBAC is the best, most flexible approach for EHRs. Roles are typically defined based on profiles established at the local level. The authors also noted a need for overrides in the case of emergencies, but overriding standard access should be widely audited and fully justified. Lastly, audit trails, personnel training and ongoing education were considered important adjuncts to all the other privacy and security measures discussed.


Assuring a patient’s privacy and securing their health-related data are imperative to preventing social, psychological, and financial harm that may ensue following improper disclosure. These issues are becoming more important due to national and international initiatives to consolidate health data in centralized databases and make data more accessible to more providers.


These researchers did an extensive review and summary of privacy and security procedures that were documented in the literature. This article would be a good reference for standards, protocols, and procedures to employ when planning privacy and security policies for an EHR and the facility as a whole.


  1. 1.0 1.1 1.2 1.3 Fernández-Alemán JL, et. al (2013). Security and privacy in electronic health records: a systematic literature review. Journal of biomedical informatics, 46(3), 541-562. Accessed from 04/07/2015./