A WWW implementation of national recommendations for protecting electronic health information

Analysis of the quality of hospital information systems Audit Trails

Background

Audit Trails (AT) are fundamental to information security in order to guarantee access traceability but can also be used to improve Health information System’s (HIS) quality namely to assess how they are used or misused. This paper aims at analysing the existence and quality of AT, describing scenarios in hospitals and making some recommendations to improve the quality of information.

Methods

The responsibles of HIS for eight Portuguese hospitals were contacted in order to arrange an interview about the importance of AT and to collect audit trail data from their HIS. Five institutions agreed to participate in this study; four of them accepted to be interviewed, and four sent AT data. The interviews were performed in 2011 and audit trail data sent in 2011 and 2012. Each AT was evaluated and compared in relation to data quality standards, namely for completeness, comprehensibility, traceability among others. Only one of the AT had enough information for us to apply a consistency evaluation by modelling user behaviour.

Results

The interviewees in these hospitals only knew a few AT (average of 1 AT per hospital in an estimate of 21 existing HIS), although they all recognize some advantages of analysing AT. Four hospitals sent a total of 7 AT – 2 from Radiology Information System (RIS), 2 from Picture Archiving and Communication System (PACS), 3 from Patient Records. Three of the AT were understandable and three of the AT were complete. The AT from the patient records are better structured and more complete than the RIS/PACS.

Conclusions

Existing AT do not have enough quality to guarantee traceability or be used in HIS improvement. Its quality reflects the importance given to them by the CIO of healthcare institutions. Existing standards (e.g. ASTM:E2147, ISO/TS 18308:2004, ISO/IEC 27001:2006) are still not broadly used in Portugal.

A study on agent-based secure scheme for electronic medical record system

Patient records, including doctors' diagnoses of diseases, trace of treatments and patients' conditions, nursing actions, and examination results from allied health profession departments, are the most important medical records of patients in medical systems. With patient records, medical staff can instantly understand the entire medical information of a patient so that, according to the patient's conditions, more accurate diagnoses and more appropriate in-depth treatments can be provided. Nevertheless, in such a modern society with booming information technologies, traditional paper-based patient records have faced a lot of problems, such as lack of uniform formats, low data mobility, slow data transfer, illegible handwritings, enormous and insufficient storage space, difficulty of conservation, being easily damaged, and low transferability. To improve such drawbacks, reduce medical costs, and advance medical quality, paper-based patient records are modified into electronic medical records and reformed into electronic patient records. However, since electronic patient records used in various hospitals are diverse and different, in consideration of cost, it is rather difficult to establish a compatible and complete integrated electronic patient records system to unify patient records from heterogeneous systems in hospitals. Moreover, as the booming of the Internet, it is no longer necessary to build an integrated system. Instead, doctors can instantly look up patients' complete information through the Internet access to electronic patient records as well as avoid the above difficulties. Nonetheless, the major problem of accessing to electronic patient records cross-hospital systems exists in the security of transmitting and accessing to the records in case of unauthorized medical personnels intercepting or stealing the information. This study applies the Mobile Agent scheme to cope with the problem. Since a Mobile Agent is a program, which can move among hosts and automatically disperse arithmetic processes, and moves from one host to another in heterogeneous network systems with the characteristics of autonomy and mobility, decreasing network traffic, reducing transfer lag, encapsulating protocol, availability on heterogeneous platforms, fault-tolerance, high flexibility, and personalization. However, since a Mobile Agent contacts and exchanges information with other hosts or agents on the Internet for rapid exchange and access to medical information, the security is threatened. In order to solve the problem, this study proposes a key management scheme based on Lagrange interpolation formulas and hierarchical management structure to make Mobile Agents a more secure and efficient access control scheme for electronic patient record systems when applied to the access of patients' personal electronic patient records cross hospitals. Meanwhile, with the comparison of security and efficacy analyses being the feasibility of validation scheme and the basis of better efficiency, the security of Mobile Agents in the process of operation can be guaranteed, key management efficacy can be advanced, and the security of the Mobile Agent system can be protected.

An information system and medical record to support HIV treatment in rural Haiti

Lack of infrastructure, including information and communication systems, is considered a barrier to successful HIV treatment programmes in resource poor areas. The authors describe how they set up a web based medical record system linking remote areas in rural Haiti and how it is used to track clinical outcomes, laboratory tests, and drug supplies and to create reports for funding agencies

Toward more user-friendly electronic endoscopy information systems: role of accessories

The needs placed on today's physician to improve efficiency in the endoscopy unit are nowhere more apparent than in transcribing endoscopy reports. In spite of the constant progress made in currently available electronic endoscopy information systems, the systems lack efficiency and ease of use. Both of these problems could be addressed through the linkage of electronic endoscopy information systems to currently available accessory systems. W review how the linkage of tablet personal computers, voice recognition systems, and web connectivity software, which facilitates communication with electronic-based medical records, can be helpful. The final answer, however, will have to await clinical trials.

Application service providers in dentistry

ASP practice management systems are a new and potentially useful service for the dental profession. ASP systems have the potential to reduce the time, effort, and expense required to maintain computer-based practice management functions. ASP systems can deliver a rich array of functions at a distance, eliminate concerns about upgrades, back-ups, and server hardware, and make management of client workstations easier. The ASP industry is young, however, and its companies and products will be in constant flux. Practitioners should exercise great caution in selecting an ASP system. If the ASP model proves viable in dentistry over the long term, we can expect to see a growing number of services being delivered over the Internet. Many ASPs exist already that serve many needs of small businesses, such as accounting, personnel management, and supply ordering. Application service provider systems also have the potential to improve communication between dental care providers. The ease of exchanging selected patient information between providers may result in more patient-related information exchange than is currently the case. The quality of dental care can only benefit.

CareWeb, a web-based medical record for an integrated health care delivery system

With the advent of Integrated Health care Delivery Systems, medical records are increasingly distributed across multiple institutions. Timely access to these medical records is a critical need for health care providers. The CareWeb project provides an architecture for World Wide Web-based retrieval of electronic medical records from heterogeneous data sources. Using Health Level 7 (HL7), web technologies and readily available software components, we consolidated the electronic records of Boston's Beth Israel and Deaconess Hospitals. We report on the creation of CareWeb (freya.bidmc.harvard.edu/careweb.htm) and propose it as a means to electronically link Integrated Health care Delivery Systems and geographically distant information resources.

Healthconnect: clinical grade patient-physician communication

A critical mass of Internet users is leading to a wide diffusion of electronic communications within medical practice. Unless implemented with substantial forethought, these new technological linkages could disturb delicate balances in the doctor-patient relationship, threaten the privacy of medical information, widen social disparity in health outcomes, and even function as barriers to access. The American Medical Informatics Association (AMIA) recently published recommendations to guide computer-based communications between clinicians and patients. This paper describes the motivations for and the design of HealthConnect, a web-based patient-doctor communications tool currently in use at Children's Hospital, Boston. Structural and process-oriented features of HealthConnect, as they relate to promotion of adherence with the Guidelines, are discussed.

Clinical information systems for integrated healthcare networks

In the 1990's, a large number of hospitals and medical practices have merged to form integrated healthcare networks (IHN's). The nature of an IHN creates new demands for information management, and also imposes new constraints on information systems for the network. Important tradeoffs must be made between homogeneity and flexibility, central and distributed governance, and access and confidentiality. This paper describes key components of clinical information systems for IHN's, and examines important design decisions that affect the value of such systems.

Methodology for security development of an electronic prescription system

Data security is an essential requirement in all health care applications. Developers of medical information systems should utilize the existing security development and evaluation methods to foresee as many of the technical and human factors that may endanger data security as possible and apply appropriate precautions. Modern smart card technology facilitates the building of robust security framework for interorganizational shared care systems. In this article, we describe the way we utilized the existing security evaluation criteria in developing the security concept of our electronic prescription system.

Nationwide telecare for diabetics: a pilot implementation of the HOLON architecture

This paper presents results from a demonstration project of nationwide exchange of health data for the home care of diabetic patients. A consortium of industry, academic, and health care partners has developed reusable middleware components integrated using the HOLON architecture. Engineering approaches for multi-organization systems development, lessons learned in developing layered object-oriented systems, security and confidentiality considerations, and functionality for nationwide telemedicine applications are discussed.