Electronic Signature for Medical Documents – Integration and Evaluation of a Public Key Infrastructure in Hospitals

Reconciling value-based objectives for security and identity management

Purpose

In this paper, using values of individuals in a Swedish health-care organization, electronic identity management objectives related to security are defined.

Design/methodology/approach

By using value-focused thinking, eliciting values from interviews of three groups of health-care staff’s objective hierarchies for three stakeholder groups are identified and defined. Objective hierarchies allow comparison across multiple stakeholder groups such that strategic objectives for identity management can be compared and contrasted.

Findings

This qualitative investigation, which used value-focused thinking, revealed 94 subobjectives, grouped into 12 fundamental and 14 means objectives, which are essential for developing measures that address potential value conflicts in a health-care organization around electronic identity management. The objectives developed in this study are grounded socioorganizationally and provide a way forward in developing measures aimed to reducing potential conflicts at a policy level.

Originality/value

In a final synthesis, congruence (or lack thereof) in the electronic identity management approach for a Swedish health organization is suggested. This also creates a foundation to evaluate and weight different objectives for strategic decision management.

Electronic Discharge Summaries: The Current State of Play

The exchange of health information between acute care providers (e.g. hospitals) and primary care providers (e.g. general practitioners) has traditionally been via hard copy discharge summaries. In recent years the advent of sophisticated information and communication technology has fuelled developments in electronic discharge referral systems (eDRS), which are credited with enabling more timely and accurate information exchange, enhancing patient care, and ultimately improving patient outcomes. The aim of this paper is to highlight key issues regarding the development and implementation of electronic discharge referral systems. A detailed literature review of information related to electronic discharge summaries was undertaken for publications between 1992 and 2006. While eDRS appear to be beneficial, further improvements are needed before systems are dependable. Through prospective enhancements and increased availability of eDRS internationally, electronic discharge referral systems have the potential to facilitate effective communication exchange across the primary-secondary care interface.

Meeting the security requirements of electronic medical records in the ERA of high-speed computing

This study has two objectives. First, it aims to develop a system with a highly secured approach to transmitting electronic medical records (EMRs), and second, it aims to identify entities that transmit private patient information without permission. The NTRU and the Advanced Encryption Standard (AES) cryptosystems are secured encryption methods. The AES is a tested technology that has already been utilized in several systems to secure sensitive data. The United States government has been using AES since June 2003 to protect sensitive and essential information. Meanwhile, NTRU protects sensitive data against attacks through the use of quantum computers, which can break the RSA cryptosystem and elliptic curve cryptography algorithms. A hybrid of AES and NTRU is developed in this work to improve EMR security. The proposed hybrid cryptography technique is implemented to secure the data transmission process of EMRs. The proposed security solution can provide protection for over 40 years and is resistant to quantum computers. Moreover, the technique provides the necessary evidence required by law to identify disclosure or misuse of patient records. The proposed solution can effectively secure EMR transmission and protect patient rights. It also identifies the source responsible for disclosing confidential patient records. The proposed hybrid technique for securing data managed by institutional websites must be improved in the future.

An enhanced security solution for electronic medical records based on AES hybrid technique with SOAP/XML and SHA-1

This study aims to provide security solutions for implementing electronic medical records (EMRs). E-Health organizations could utilize the proposed method and implement recommended solutions in medical/health systems. Majority of the required security features of EMRs were noted. The methods used were tested against each of these security features. In implementing the system, the combination that satisfied all of the security features of EMRs was selected. Secure implementation and management of EMRs facilitate the safeguarding of the confidentiality, integrity, and availability of e-health organization systems. Health practitioners, patients, and visitors can use the information system facilities safely and with confidence anytime and anywhere. After critically reviewing security and data transmission methods, a new hybrid method was proposed to be implemented on EMR systems. This method will enhance the robustness, security, and integration of EMR systems. The hybrid of simple object access protocol/extensible markup language (XML) with advanced encryption standard and secure hash algorithm version 1 has achieved the security requirements of an EMR system with the capability of integrating with other systems through the design of XML messages.

Realizing digital signatures for medical imaging and reporting in a PACS environment

According to Taiwan's legislation pertaining to the protection of electronic data, the creators of electronic medical records (EMR) are solely responsible for the security of EMR. However, actual implementations that fulfill the security standards and requirements for electronic medical record systems are still lacking. Most EMR created from picture archive and communication system are not considered secure, as security protection mechanisms have not yet been granted legal status. This paper describes the details of establishing a digital signature system using Taiwan health professional cards. A digital signature system has been included to ensure quality assurance (QA) operations are controlled by technicians, and reporting capabilities have been provided for radiologist. Six imaging modalities and eight types of radiology reports have also been included in the system. Results indicate that the process of creating QA signatures does not have an adverse effect on the workflow of the facility, requiring less time for the signing and verification of radiology reports. This system has already been used routinely online in a real clinical setting for more than 2 years.

Systematic planning of patient records for cooperative care and multicenter research

PURPOSE

The purpose of this paper is to introduce a method for systematically planning patient records for structured data entry that can be used in cooperative environments (e.g. cooperative care, multicenter trials) in a way that enables multipurpose use and shared data entry.

METHODS

Design research, formal logic.

RESULTS

The method suggests five steps: analyze the prevailing documentation infrastructure, provide terminology management system (TMS), provide documentation management system (DMS), plan the logical architecture, provide all necessary tools.

CONCLUSIONS

The era of eHealth enables cooperative care and collaborative documentation. This can only be efficient if a multiple use and shared entry of data is realized. The task of the medical informatics community is to plan these environments systematically especially in complex environments which are enabled by emerging technologies.

The Public-Key-Infrastructure of the Radiological Society of Germany

Pretty Good Privacy (PGP) encoding is based on the Public-Key-Procedure and permits the safe transmission of medical data. Furthermore it allows the use of an electronic signature provided that keys used belong to the key owner and that the key owner's identity is guaranteed by a trusted third party. Under the auspices of the Radiological Society of Germany (Deutsche Röntgengesellschaft, DRG) its IT-Working Group (Arbeitsgemeinschaft für Informationstechnik, @GIT) built up an appropriate Certification Authority including the required Public-Key-Infrastructure. These @GIT certified PGP keys allow the legal use of telemedicine in Germany. Digital signatures based to those certified keys correspond to the advanced signature according to the German Signature Law.

Health information systems – past, present, future

In 1984, Peter Reichertz gave a lecture on the past, present and future of hospital information systems. In the meantime, there has been a tremendous progress in medicine as well as in informatics. One important benefit of this progress is that our life expectancy is nowadays significantly higher than it would have been even some few decades ago. This progress, leading to aging societies, is of influence to the organization of health care and to the future development of its information systems. Twenty years later, referring to Peter Reichertz' lecture, but now considering health information systems (HIS), two questions are discussed: which were lines of development in health information systems from the past until today? What are consequences for health information systems in the future? The following lines of development for HIS were considered as important: (1) the shift from paper-based to computer-based processing and storage, as well as the increase of data in health care settings; (2) the shift from institution-centered departmental and, later, hospital information systems towards regional and global HIS; (3) the inclusion of patients and health consumers as HIS users, besides health care professionals and administrators; (4) the use of HIS data not only for patient care and administrative purposes, but also for health care planning as well as clinical and epidemiological research; (5) the shift from focusing mainly on technical HIS problems to those of change management as well as of strategic information management; (6) the shift from mainly alpha-numeric data in HIS to images and now also to data on the molecular level; (7) the steady increase of new technologies to be included, now starting to include ubiquitous computing environments and sensor-based technologies for health monitoring. As consequences for HIS in the future, first the need for institutional and (inter-) national HIS-strategies is seen, second the need to explore new (transinstitutional) HIS architectural styles, third the need for education in health informatics and/or biomedical informatics, including appropriate knowledge and skills on HIS. As these new HIS are urgently needed for reorganizing health care in an aging society, as last consequence the need for research around HIS is seen. Research should include the development and investigation of appropriate transinstitutional information system architectures, of adequate methods for strategic information management, of methods for modeling and evaluating HIS, the development and investigation of comprehensive electronic patient records, providing appropriate access for health care professionals as well as for patients, in the broad sense as described here, e.g. including home care and health monitoring facilities. Comparing the world in 1984 and in 2004, we have to recognize that we imperceptibly, stepwise arrived at a new world. HIS have become one of the most challenging and promising fields of research, education and practice for medical informatics, with significant benefits to medicine and health care in general.

An assessment of PKI and networked electronic patient record system: lessons learned from real patient data exchange at the platform of OCHIS (Osaka Community Healthcare Information System)

To enhance medical cooperation between the hospitals and clinics around Osaka local area, the healthcare network system, named Osaka Community Healthcare Information System (OCHIS), was established with support of a supplementary budget from the Japanese government in fiscal year 2002. Although the system has been based on healthcare public key infrastructure (PKI), there remain security issues to be solved technically and operationally. An experimental study was conducted to elucidate the central and the local function in terms of a registration authority and a time stamp authority in contract with the Japanese Medical Information Systems Organization (MEDIS) in 2003. This paper describes the experimental design and the results of the study concerning message security.

Data security and protection in cross-institutional electronic patient records

This paper aims at identifying the specific legal requirements concerning data security and data protection of patient health data that apply to a cross-institutional electronic patient record (EPR) and describes possible solutions for meeting these requirements. In Germany, the legal framework for such records provide that disclosure of patient health information to physicians of third-party institutions is only allowed in case that it is necessary for the joint treatment of the patient, i.e. in case of a "treatment connection". As a first step, the functionality of a remote-access architecture was proven allowing a one-way connection between the EPR systems of two health institutions in Germany, which jointly treat tumor patients. Besides, a signature system model for ensuring the integrity and authenticity of medical documents was developed and implemented in the existing information system architecture of the University Medical Center of Heidelberg. Especially in Germany, the legal framework for cross-institutional EPRs is very complex and has a considerable influence on the development and implementation of cross-institutional EPRs. However, its introduction is thought to be valuable, since a cross-institutional EPR will improve communication within shared care processes, and thus improve the quality of patient care.