title: Authentication systems for securing clinical documentation workflows. A systematic literature review.
abstract: BACKGROUND
  Integration of electronic signatures embedded in health care processes in Germany challenges health care service and supply facilities. The suitability of the signature level of an eligible authentication procedure is confirmed for a large part of documents in clinical practice. However, the concrete design of such a procedure remains unclear.
  
  
  OBJECTIVE
  To create a summary of usable user authentication systems suitable for clinical workflows.
  
  
  METHODS
  A Systematic literature review based on nine online bibliographic databases. Search keywords included authentication, access control, information systems, information security and biometrics with terms user authentication, user identification and login in title or abstract. Searches were run between 7 and 12 September 2011. Relevant conference proceedings were searched manually in February 2013. Backward reference search of selected results was done.
  
  
  METHODS
  Only publications fully describing authentication systems used or usable were included. Algorithms or purely theoretical concepts were excluded. Three authors did selection independently. DATA EXTRACTION AND ASSESSMENT: Semi-structured extraction of system characteristics was done by the main author. Identified procedures were assessed for security and fulfillment of relevant laws and guidelines as well as for applicability. Suitability for clinical workflows was derived from the assessments using a weighted sum proposed by Bonneau.
  
  
  RESULTS
  Of 7575 citations retrieved, 55 publications meet our inclusion criteria. They describe 48 different authentication systems; 39 were biometric and nine graphical password systems. Assessment of authentication systems showed high error rates above European CENELEC standards and a lack of applicability of biometric systems. Graphical passwords did not add overall value compared to conventional passwords. Continuous authentication can add an additional layer of safety. Only few systems are suitable partially or entirely for use in clinical processes.
  
  
  CONCLUSIONS
  Suitability strongly depends on national or institutional requirements. Four authentication systems seem to fulfill requirements of authentication procedures for clinical workflows. Research is needed in the area of continuous authentication with biometric methods. A proper authentication system should combine all factors of authentication implementing and connecting secure individual measures.
authors.affiliation: Jonas Schwartze, M.Sc., Peter L. Reichertz Institute for Medical Informatics, Technische Universität Braunschweig and Hannover Medical School, Mühlenpfordtstraße 23, 38106 Braunschweig, Germany, E-mail: Jonas.Schwartze@plri.de.
authors.forename: J
authors.initials: J
authors.lastname: Schwartze
authors.forename: B
authors.initials: B
authors.lastname: Haarbrandt
authors.forename: D
authors.initials: D
authors.lastname: Fortmeier
authors.forename: R
authors.initials: R
authors.lastname: Haux
authors.forename: C
authors.initials: C
authors.lastname: Seidel
mesh_terms: D056667:Biometric Identification; D016494:Computer Security; D003878:Dermatoglyphics; D057286:Electronic Health Records; D005858:Germany; D006801:Humans; D057188:Workflow
keywords: Security; authentication system; digital signature; electronic signature