title: Security and privacy in electronic health records: a systematic literature review.
abstract: OBJECTIVE
  To report the results of a systematic literature review concerning the security and privacy of electronic health record (EHR) systems.
  
  
  METHODS
  Original articles written in English found in MEDLINE, ACM Digital Library, Wiley InterScience, IEEE Digital Library, Science@Direct, MetaPress, ERIC, CINAHL and Trip Database.
  
  
  METHODS
  Only those articles dealing with the security and privacy of EHR systems.
  
  
  METHODS
  The extraction of 775 articles using a predefined search string, the outcome of which was reviewed by three authors and checked by a fourth.
  
  
  RESULTS
  A total of 49 articles were selected, of which 26 used standards or regulations related to the privacy and security of EHR data. The most widely used regulations are the Health Insurance Portability and Accountability Act (HIPAA) and the European Data Protection Directive 95/46/EC. We found 23 articles that used symmetric key and/or asymmetric key schemes and 13 articles that employed the pseudo anonymity technique in EHR systems. A total of 11 articles propose the use of a digital signature scheme based on PKI (Public Key Infrastructure) and 13 articles propose a login/password (seven of them combined with a digital certificate or PIN) for authentication. The preferred access control model appears to be Role-Based Access Control (RBAC), since it is used in 27 studies. Ten of these studies discuss who should define the EHR systems' roles. Eleven studies discuss who should provide access to EHR data: patients or health entities. Sixteen of the articles reviewed indicate that it is necessary to override defined access policies in the case of an emergency. In 25 articles an audit-log of the system is produced. Only four studies mention that system users and/or health staff should be trained in security and privacy.
  
  
  CONCLUSIONS
  Recent years have witnessed the design of standards and the promulgation of directives concerning security and privacy in EHR systems. However, more work should be done to adopt these regulations and to deploy secure EHR systems.
authors.affiliation: Department de Informatics and Systems, Faculty of Computer Science, University of Murcia, 30100 Murcia, Spain. aleman@um.es
authors.forename: José Luis
authors.initials: JL
authors.lastname: Fernández-Alemán
authors.forename: Inmaculada Carrión
authors.initials: IC
authors.lastname: Señor
authors.forename: Pedro Ángel Oliver
authors.initials: PÁ
authors.lastname: Lozoya
authors.forename: Ambrosio
authors.initials: A
authors.lastname: Toval
mesh_terms: D016494:Computer Security; D057286:Electronic Health Records; D005060:Europe; D020408:Health Insurance Portability and Accountability Act; D018907:Privacy; D014481:United States