Information Security In Electronic Medical Record Management System

Project and Seminar Material Under Health Information Management

Information Security In Electronic Medical Record Management System


Web technologies offer some very exciting benefits in Health Care environments, such as the ease of use, capabilities to organise and link information (from distributed sources), strong multimedia presentation capabilities, and broad coverage of most hardware platforms and operating systems. These benefits have been adopted and used by the Electronic Medical Record Systems, which provide access to medical record information using Electronic Information Technologies.

In this Research, study the security problems related to the Electronic Medical Record (EHMs). More specifically we propose a security policy (based on the Role Based Access Control) that addresses many of the related security problems it also describes an Internet-based application for patient care using advanced multimedia techniques in a secure environment. The aim is to offer high quality care to users of health services over inexpensive communication pathways, using secure Internet-based, interactive communication tools. The provision of communication security over the Internet requires also the use of cryptographic and authentication techniques for Internet environment and the use of firewalls.

Electronic medical records (EMR) adoption is posited to improve patient care through enhancements in activities ranging from information access and exchange, to medical research. As such, a concerted governmental effort is underway to encourage EMR adoption. However, uptake has been slow as breaches have led to concerns over information security and privacy. The response of EMR managers to these concerns will be critical to EMR adoption. That said, managing information security and privacy is a complicated endeavour, requiring attention to multiple facets of the firm. Thus, research is needed to assist scholars and EMR managers in exploring and understanding the related salient issues. This study conceptualizes and applies a framework based largely on the work of Dhillon (1997, 2006) which addresses the technical, formal, and informal dimensions of information security and privacy in the healthcare provider context. In doing so, it 1) describes and supports a conceptual framework for scholarly exploration of EMR information security and privacy issues, 2) highlights key issues within each dimension of the framework, and 3) provides an information security and privacy planning framework for EMR managers.

Chapter One

1.0 Introduction

With the many advances in information technology over the years, particularly in healthcare, a number of different forms of electronic health care have been developed and implemented. Some countries are currently planning a nationwide electronic record health care delivery system. The type and extent of electronic health vary and what one country calls an electronic health, E/Tele health may not be the same as that of developed countries. Although work is going on in some countries on some form of a computerized patient health care information system and yet not many hospitals have successfully introduced an electronic health record with clinical data entry at the point of care. Interest in automating the health record is generally high in both developed and developing countries, unfortunately, in some cases, the introduction of an HER system seems overwhelming and almost out of reach to many health providers and administrators as well as health record/health information managers.

Why is this so? The obstacles may not be available technology but technical support and cost of changing to an electronic system coupled with insufficient healthcare funding. In many developing countries cost, available technology, lack of technical expertise and computer skills of staff, and lack of processing facilities are in fact major issues which would need to be addressed before implementation is possible.

In addition to the above, resistance by some medical practitioners and health professionals generally to electronic documentation may be a problem in almost all the health institutions in the country. Most health administrators and information managers are aware that it may take time to change or at least modify health practitioner’s behavior and attitudes.

The reason for wanting to change to an electronic system is important. Many persons involved in healthcare today expect to move from a paper to paperless environment. This is a major step and has been successfully achieved in some of our health institutions. Institution should not focus on just going paperless. They should focus on encouraging departments and health care practitioners to move to an electronic system to:-

  1. Improve the accuracy and quality of data record in a health record.
  2. Enhance healthcare practitioners’ access to a patient’s health information enabling it to be shared by all for the present and continuing care of that patient.
  3. Improve the quality of care as a result of having health information immediately available at all for patient care.
  4. Improve the efficiency of the health record service.
  5. Reduce healthcare costs.

Also in some instances there is a tendency to expect that with the introduction of an electronic health record many of the problems currently experienced in maintaining paper record will be eliminated. This is not the case if identified problems are not addressed and remedied prior to introducing an HER system merely automating health records content and procedures may perpetrate deficiencies and not meeting the HER goals of the institution.
Current problems identified in health care documentation, as well as privacy and confidentiality issues must be addressed and quality control measures introduced before a successful change can be implemented.

Although the introduction of a fully electronic health records system may seem far off in many healthcare institutions they are being introduced rapidly in others and there is no doubt that the future of health information management lies with automation and automatic transmission of information required for patient management at all levels of healthcare.

1.1 Background to the Study

Good management of records and information is fundamental to a well functioning organisation since it supports business activity and provides a basis for efficient service delivery. It also provides the mechanism whereby user can account for their decisions and actions. Records provide evidence for the people to confirm or claim their public rights and entitlements, as well as providing individuals with evidence to justify decisions and a mechanism whereby they can have trust in private enterprise. Moreover, good records management is simply good business practice.

However, the healthcare system in Nigeria is changing today dramatically. A major objective has been to achieve more efficient as well as high-quality care over inexpensive communication pathways using public networks such as the Internet.

The growing dependence of Medical care processes on information technology, the increasing number of threats resulting from distributed and decentralised implementations of the Electronic Medical Records System, the usage of communications over open and insecure networks such as the Internet and the growing awareness of patients and doctors about data security and privacy all impose severe security requirements upon the systems. The Custodian (user) needs to implement reasonable administrative, technical and physical safeguards to protect health information from reasonably anticipated threats to the security or integrity of the health information, including unauthorized access, use, disclosure, modification or destruction. An Electronic Medical Records (EMR) system processes, manages, and stores sensitive information such as patient profiles including medical history, prescriptions, laboratory results, and schedule information. If reasonable security safeguards are not implemented then this could compromise the confidentiality, integrity, and availability of health information in an Electronic Medical Records system.

1.2 Statement of the Problem

Most privacy and security risks apply to both paper and electronic records. However, the way that these are exploited and can be mitigated is different. The statements of the problem in this research however are the associated risks common to both paper and electronic records are 1) the risk of inappropriate access of medical records, 2) the risk of medical record tempering, and 3) the risk of medical record loss due to natural catastrophes.
Regardless of format, patient records are subject to the risk of inappropriate access. For paper records, the risk materializes in the form of gaining access to record storage areas; finding records left on counters, exam rooms or copy machines; receiving misdirected fax copies; and other similar events. Inappropriate access can be accidental or intentional. Since access to paper records implies physical access, securing against inappropriate access is accomplished by segregating records into separate locked storage areas; restricting physical access to storage areas; recording sign in and sign out procedures; and maintaining records handling training and other similar procedures. With electronic records, inappropriate access manifests itself in one of two ways: 1) an unauthorized user gains access to the Electronic Medical Records data; or 2) an authorized user violates the appropriate use conditions.

Electronic records can be subject to ‘serendipitous’ access in situations such as when a user account is left open. Electronic records can also be subject to breaches of network security that may allow a hacker to gain access to user credentials and thereby to bypass the access control protections. Medical records can be altered in a number of ways, including back dating, fraudulent entries, erasures, or other modifications. Paper Records Anyone who has access to the paper record can remove pages, add entries, erase or otherwise tamper with authentic entries. Electronic Records: The ability to make changes to an electronic record depends upon the rights assigned to a user. Users with data modification privileges can generally add, delete, or modify data or entire records.

Electronic records can degrade catastrophically — tapes break, a bearing breaks on a piece of hardware, optical media is scratched. Such failures can happen at any time without warning. Depending on the type of storage and the amount of damage, it may be impossible to recover the affected data.

The Risk of Technology Becoming Obsolete: Retrieval and use of paper records is not affected by technological changes. Even where paper records are stored on film or micro-fiche, the expected technology life cycle is sufficiently long to avoid obsolescence concerns.

Accurate patient identification is the backbone of an effective and efficient health record system, whether manual or electronic. As discussed previously unique patient identification is a major issue that should be addressed before moving forward to automation. Other possible issues may include:

  1. Clinical data entry issues and lack of standard terminology
  2. Resistance to computer technology and lack of computer literacy
  3. Strong resistance to change by many healthcare providers
  4. High cost of computers and computer systems and funding limitations
  5. Concern by providers as to whether information will be available on request
  6. Concerns raised by healthcare professionals, patients and the general community about privacy, confidentiality and the quality and accuracy of electronically generated information
  7. Quality of electronic healthcare information and accuracy of data entries
  8. Lack of staff with adequate knowledge of disease classification systems
  9. Manpower issues – lack of staff with adequate skills
  10. Environmental issues – electrical wiring and supply of electricity, amount and quality of space needed for computers, etc.

1.3 Research Questions

  1. Are the current information security technologies adequate for Electronic Medical Records System in Nigeria?’
  2. Why is it necessary to manage hospitals records?
  3. What is information security in the context of Electronic Medical Records System?
  4. Why is information security important for Electronic Medical Records System?
  5. What are the current technologies for information security available to Electronic Medical Records System?
  6. What are the problems encountered in the management of electronic health record in public hospitals?

1.4 Objective of the Study

The objectives of this study are as follows.

  1. To know if the current information security technologies are adequate for electronic Medical Records System in the Healthcare Industries.
  2. To understand Information Security in the context of Electronic Medical Records
  3. The importance of information security in Electronic Medical Records.
  4. And also the find lasts solutions to the present challenges in the modernize e- Medical Records System.

1.6 Significance of the Study.

This research work is to a great importance as it will help to understand the concept of Information Security as well as privacy and confidentiality in electronic Medical Records System.

1.6. Scope and Limitation

The scope of this study will be limited to healthcare industry both staff and patients of Lagos University Teaching Hospital (LUTH), Idi-Araba, Lagos

Questionnaires will be distributed to the staff and the patients of the hospital.

The limitations of this study include;

  1. The possibility of underreporting the effectiveness and efficiency of electronic medical records.
  2. Variation in participation rate across different department in the hospital and levels sampled of the professions.
  3. Absolute honesty in staff and patients response.
  4. Retrieval of all Questionnaires distributed.

Chapter Five

5.0 Summary, Conclusion and Recommendations.

5.1 Conclusion

The study concludes that medical record is the principal repository of a patient’s health care information, so every health organization needs an electronic medical records with adequate information security.

Electronic medical records provide healthcare workers with an extensive option for improving patient care. Not only can electronic records not be misplaced as paper records can, but the information in the record is more accurate as well as legible. St. Lagos University Teaching Hospital is in the process of implementing a paperless medical record in order to improve care for both current patients and future patients. Successfully linking clinical treatment plans with research protocol information provides valuable information when assessing the effectiveness of particular treatment plans. Research efforts can move forward more rapidly when data is collected in an efficient manner as is provided by the electronic record. In addition, human error is less of a factor than it was when data was collected manually from paper charts. that is organized and staffed to provide adequate information.

5.2 Recommendations for Intervention

Based on the findings of the study, the following recommendations were made:

  1. The Lagos University Teaching Hospital Management Board should ensure that there is a record management policy and standard in place to guide the electronic record management of its patient records.
  2. Hospital Management Board should ensure that sufficient, trained and experienced record/IT management personnel are been employed to manage the various record departments in the hospital.
  3. Hospital Management Board should ensure that there are adequate record manuals and filing systems in the hospitals.
  4. The State government should ensure adequate fund is been given to the central hospitals in order for them to meet up with their expected roles

Project Material Download

5,000 5000

The Complete Material Will Be Sent to You in Just 2 Steps

Quick & Simple…

Step One Purchase

Make Payment (Through Transfer) of ₦5,000 to Any of the Account Below

Access Bank PlcAcc No: 0811003731
Samphina Academy
Current Account
Zenith BankAcc No: 1225513212
Samphina Academy
Current Account
PalmPay Main LogoAcc No: 8143831497
Samphina Academy
Digital Account

Or CLICK HERE To Pay With Debit Card

CLICK HERE To Purchase Material ($15)
Make Payment of 120 GHS to 0553978005 | Douglas Cloud Osabutey | MTN MoMo

Step Two Purchase

Send the Following Details on WhatsApp ( 08143831497) After Payment

  1. Payment Details

  2. TOPIC: Information Security In Electronic Medical Record Management System

The Complete Material Will Be Sent To You On WhatsApp After Receiving Your Details
T & C Apply

  Contact Our Help Desk

Need a Different Topic? Perform a Quick Search

List of Related Works

Click on Any Topic to Preview the Content

Samphina Academy

Samphina Academy is an Online Educational Resource Center that is aimed at providing students with quality information and materials to aid them in succeeding in their academic pursuit.