The objective of this study is to answer the research question, ‘Are current information security technologies adequate for electronic health records (EHRs)?’ In order to achieve this, the following matters have been addressed in this article: (i) What is information security in the context of EHRs? (ii) Why is information security important for EHRs? and (iii) What are the current technologies for information security available to EHRs? It is concluded that current EHR security technologies are inadequate and urgently require improvement. Further study regarding information security of EHRs is indicated.
AllaertF.A.Le TeuffG.QuantinC.BarberB. (2004). The legal knowledge of the electronic signature: A key for a secure direct access of patients to their computerised medical record. International Journal of Medical Informatics73: 239–242.
AndersonR.J. (1999). Information technology in medical practice: Safety and privacy lessons from the United Kingdom. Medical Journal of Australia170(14): 181–185.
4.
BarrowsR.C.JrClaytonP.D. (1996). Privacy, confidentiality and electronic medical records. Journal of the American Medical Informatics Association3: 139–148.
5.
BilykhI.BychkovY.JahnkeJ.H.McCallumG.ObryC.OnabajoA.KuziemskyC. (2003). Can GRID services provide answers to the challenges of national health information sharing?Proceedings of the 2003 Conference of the Centre for Advanced Studies. Canada, IBM Press: 39–45.
6.
CarterM. (2000). Integrated electronic health records and patient privacy: Possible benefits but real dangers. Medical Journal of Australia172: 28–30.
7.
ChiltonL.BergerJ.E.MelinkovichP.NelsonR.RappoP.D.StoddardJ.SwansonJ.VanchiereC.LustigJ.GotliebE.M.DeutschL.GerstleR.LieberthalA.ShiffmanR.SpoonerS.A.SternM. (1999). Pediatric Practice Action Group and Task Force on Medical Informatics. Privacy protection of health information: Patient rights and pediatrician responsibilities. Pediatrics104: 973–977.
8.
ChinT. (2001), Security breach: Hacker gets medical records. American Medical News44: 18–19.
CoieraE.ClarkeR. (2004). ‘E-Consent’: The design and implementation of consumer consent mechanisms in an electronic environment. Journal of American Medical Informatics Association11(2): 129–140.
11.
ConnollyC. (2004). Managing patient consent in a multidisciplinary team environment. Privacy Law and Policy Reporter11: 1.
12.
CotterJ. (2003), Alberta health providers to share medical records via computer. Canadian Press, October 25.
13.
CoxP. (2001). Using patient identifiable data without consent. British Medical Journal322(7290): 858.
14.
DreiseitlS.VinterboS.Ohno-MachadoL. (2002). Disambiguation data: Extracting information from anonymized sources. Journal of American Medical Informatics Association9(6): 110–114.
15.
DudeckJ. (2001). Informed consent for cancer registration. Lancet Oncology2: 8–9.
16.
EvansB.RamayC.N. (2001). Integrity of communicable disease surveillance is important to patient care. British Medical Journal322: 858.
17.
EysenbachG. (2000). Consumer health informatics: Recent advances. British Medical Journal320: 1713–1716.
18.
FriedB. M.PittmanS. (2001). Protecting medical privacy in a digital age: Beyond policies and procedures. A critical role for technology. California, Surf Control Inc. Available at:<http://itpapers.news.com>.
19.
GaithersburgI.V. (2000). Electronic medical records and patient privacy. The Health Care Manager, March: 63–69.
20.
GostinL.O.Turek-BrezinaJ.PowersM.KozloffR.FadenR.SteinauerD.D. (1993). Privacy and security of personal information in a new health care system. The Journal of the American Medical Association270(20):2487–2493.
21.
GritzalisD.LambrinoudakisC. (2004). A security architecture for interconnecting health information systems. International Journal of Medical Informatics73: 305–309.
Health Information Privacy Office (HIPO) (2002). Protecting the privacy of health information in the Northern Territory: Discussion paper, March 2002. Northern Territory Government.
24.
Health Records and Information Privacy Act 2002 (NSW).
IngelfingerJ.R.DrazenJ.M. (2004). Registry research and medical privacy. New England Journal of Medicine350(14): 1452.
27.
Institute of Medicine (2003). Committee on data standards for patient safety: Board of health care services. Key capabilities of an electronic health record system: Letter report. The National Academy of Sciences. Available at: <http://www.iom.edu/report.asp?id=14391> (accessed 8 August 2003).
KlugeE-H. W. (2004). Informed consent to the secondary use of EHRs: Informatics rights and their limitations. In: Proceedings of the 11th World Congress on Medical Informatics, Part 1. FieschiM.CoieraE.LiY-C. J. (eds). Amsterdam, IOS Press: 635–638.
Ohno-MachadoL.SilveiraP.S.P.VinterboS. (2004). Protecting patient privacy by quantifiable control of disclosures in disseminated databases. International Journal of Medical Informatics73: 599–606.
32.
ParnellS.FearonA. (2002). South and west Devon: ERDIP evaluation report, volume 2: Proof of concept. UK, NHS Information Authority.
33.
QuantinC.AllaertF-A.DusserreL. (2000). Anonymous statistical methods versus cryptographic methods in epidemiology. International Journal of Medical Informatics60: 177–183.
34.
RindfleischT. C. (1997). Confidentiality, information technology and health care. Communications of the Association of Computing Machinery40: 93–100.
35.
RobertsL.WilsonS. (2001), Argument for consent may invalidate research and stigmatize some patients. British Medical Journal322: 858.
36.
RoseM. (2003). A survey of computer security in the ACT Division. Canberra, ACT Division of General Practice.
37.
SchattnerP.PleteshnerC. (2004). The GPCG computer security project: Final report. Monash University, The Department of General Practice in Affiliation with the Department of Rural Health, The University of Melbourne, Monash Division of General Practice.
38.
SchillerG. (2003). Informatics survey of general practice. Adelaide, Adelaide Central and Eastern Division of General Practice.
39.
SchuerenbergB. K. (2005). Implantable RFID chip takes root in CIO, mobile health data and health data management. Available at: <http://www.mobilehealthdata.com> (accessed 16 May 2005).
40.
SonginiM.C.DashJ. (2000). Hospital confirms hacker stole 5,000 patient files: Attack points to need for standards for patient records. Computer World34(51): 7.
41.
SteinL. (1997). The electronic medical record: Promises and threats; web security: A matter of trust. Web Journal, Volume 2, Issue 3, O'Reilly & Associates. Available at: <http://www.oreilly.com/catalog/wjsum97/excerpt/>.
WinK.T.CrollP.CooperJ. (2003). Privacy, confidentiality and consent of electronic health record systems. Proceedings of the Eleventh Annual Health Informatics Conference, Darling Harbour, Sydney, Australia, 10–12 August.
