An information security diagnostic of Electronic Data Capture Systems for the Personal Health Train

Abstract

A Case Report Form (CRF) is a questionnaire mostly used in clinical trial research to collect patients' information. Electronic Case Report Form (eCRF) is taking the place of the normal paper CRF due to its digital convenience. An eCRF is a feature of an Electronic Data Capture (EDC) system and it collects users' information, which might be sensitive. This research aims to find appropriate EDC systems for the Personal Health Train (PHT). This platform enables organizations and researchers to work with health data from diverse sources without sharing these data. Therefore, it is necessary to ensure that the system is prepared for privacy and security regulations. Due to the diversity of privacy regulations worldwide, this research investigates whether the EDC systems comply with the European Union General Data Protection Regulation (GDPR). This paper presents a short review of the PHT concept, the role of the Findable, Accessible, Interoperable and Reusable (FAIR) data principles, potential risks, protection measures for hospital information systems. In our evaluation, we provided an overview of five EDC systems: Castor, OpenClinica, REDCap, NowEDC, and ShareCRF. We evaluated their security and privacy features and techniques to store data. A comparison of their features is given, and a preliminary usability test is presented.