title: [Access control management in electronic health records: a systematic literature review].
abstract: OBJECTIVE
  This study presents the results of a systematic literature review of aspects related to access control in electronic health records systems, wireless security and privacy and security training for users.
  
  
  METHODS
  Information sources consisted of original articles found in Medline, ACM Digital Library, Wiley InterScience, IEEE Digital Library, Science@Direct, MetaPress, ERIC, CINAHL and Trip Database, published between January 2006 and January 2011. A total of 1,208 articles were extracted using a predefined search string and were reviewed by the authors. The final selection consisted of 24 articles.
  
  
  RESULTS
  Of the selected articles, 21 dealt with access policies in electronic health records systems. Eleven articles discussed whether access to electronic health records should be granted by patients or by health organizations. Wireless environments were only considered in three articles. Finally, only four articles explicitly mentioned that technical training of staff and/or patients is required.
  
  
  CONCLUSIONS
  Role-based access control is the preferred mechanism to deploy access policy by the designers of electronic health records. In most systems, access control is managed by users and health professionals, which promotes patients' right to control personal information. Finally, the security of wireless environments is not usually considered. However, one line of research is eHealth in mobile environments, called mHealth.
authors.affiliation: Grupo de Investigación de Ingeniería del Software, Departamento de Informática y Sistemas, Facultad de Informática, Universidad de Murcia, Murcia, España. mariainmaculada.carrion@um.es
authors.forename: Inmaculada
authors.initials: I
authors.lastname: Carrión Señor
authors.forename: José Luis
authors.initials: JL
authors.lastname: Fernández Alemán
authors.forename: Ambrosio
authors.initials: A
authors.lastname: Toval
mesh_terms: D003219:Confidentiality; D057286:Electronic Health Records / Q000458:organization & administration*; D006801:Humans