Methodological Review
Security and privacy in electronic health records: A systematic literature review

https://doi.org/10.1016/j.jbi.2012.12.003Get rights and content
Under an Elsevier user license
open archive

Abstract

Objective

To report the results of a systematic literature review concerning the security and privacy of electronic health record (EHR) systems.

Data sources

Original articles written in English found in MEDLINE, ACM Digital Library, Wiley InterScience, IEEE Digital Library, Science@Direct, MetaPress, ERIC, CINAHL and Trip Database.

Study selection

Only those articles dealing with the security and privacy of EHR systems.

Data extraction

The extraction of 775 articles using a predefined search string, the outcome of which was reviewed by three authors and checked by a fourth.

Results

A total of 49 articles were selected, of which 26 used standards or regulations related to the privacy and security of EHR data. The most widely used regulations are the Health Insurance Portability and Accountability Act (HIPAA) and the European Data Protection Directive 95/46/EC. We found 23 articles that used symmetric key and/or asymmetric key schemes and 13 articles that employed the pseudo anonymity technique in EHR systems. A total of 11 articles propose the use of a digital signature scheme based on PKI (Public Key Infrastructure) and 13 articles propose a login/password (seven of them combined with a digital certificate or PIN) for authentication. The preferred access control model appears to be Role-Based Access Control (RBAC), since it is used in 27 studies. Ten of these studies discuss who should define the EHR systems’ roles. Eleven studies discuss who should provide access to EHR data: patients or health entities. Sixteen of the articles reviewed indicate that it is necessary to override defined access policies in the case of an emergency. In 25 articles an audit-log of the system is produced. Only four studies mention that system users and/or health staff should be trained in security and privacy.

Conclusions

Recent years have witnessed the design of standards and the promulgation of directives concerning security and privacy in EHR systems. However, more work should be done to adopt these regulations and to deploy secure EHR systems.

Highlights

► The preferred access control model in EHR systems is RBAC. ► Asymmetric and symmetric key encryption are equally used to encrypt data in EHRs. ► Communications in EHRs are securely encrypted using SSL and TSL. ► Login/password is the most common authentication mechanism found in EHRs.

Keywords

Electronic health records
Systematic review
Privacy
Confidentiality
Security
Standards

Cited by (0)