Towards a practical healthcare information security model for healthcare institutions

Abstract

In recent years, a number of countries have introduced plans for national electronic patient record (EPR) systems. This paper argues that, in the near future, both patients and healthcare stakeholders will be able to access medical records from WWW-based EPR systems. We contend that the primary impediment to the successful implementation and widespread uptake of the EPR concept is the fact that current healthcare information security (HIS) applications are not sufficiently robust. This paper identifies two main Information Security technologies: 1) Public key infrastructure (PIU) and 2) Biometrics that hold a lot of promise in a healthcare context. The key contribution of this paper is to propose a novel multi-layered HIS framework based on a combination of PIU, Smartcard and Biometrics technologies. We argue that this new HIS framework could assist healthcare institutions to provide a truly secure infrastructure for the electronic transmission of clinical data in the future. This paper also makes a case for the creation of a new nodal HIS body because existing information security bodies like the Forum of Incident Response and Security Teams are for general-purpose organizations and not specifically suited for the healthcare sector.

Ubiquitous Healthcare Information System: Toward Crossing the Security Chasm

“…The implemented system has to be assessed in order to validate that it complies with the functional and security requirements and that it will operate within an acceptable level of residual security [Kissel et al, 2008]. Prior research on implementation in both the healthcare IT and ubiquitous device security has concentrated on the technical aspects of implementation of technologies [Dwivedi, Bali, Belsis, Naguib, et al, 2003;Epstein, Pasieka, Lord, Wong, et al, 1998;Hu and Weaver, 2004;Kardas and Tunali, 2006;Ng et al, 2006].…”

HIV Drug-Resistant Patient Information Management, Analysis, and Interpretation

“…An important aspect to take into account when building the model for the HIV management system is security. Dwivedi et al [58] argued that electronic medical records will only become a reality if security takes a prominent role in design considerations and during implementation. Two of the most promising techniques for incorporating security into any information system are public key infrastructure and biometrics.…”

Security Risk Management in Healthcare: A Case Study

“…Healthcare IT security research also has focused predominantly on the technical aspects of healthcare IT system implementation [Dwivedi, Bali, Belsis, Naguib, et al, 2003;Epstein, Pasieka, Lord, Wong, et al, 1998;Hu and Weaver, 2004;Kardas and Tunali, 2006;Ng, Sim, and Tan, 2006]. Some work also has been done in the area of maintenance of healthcare IT systems for security reasons.…”