Quality evidence, quality decisions: Ways to improve security and privacy of EHR systems

The readily available and accessible large collection of electronic health records has encouraged an increasing interest on its secondary use. It is especially true for the approach of practice-based evidence where the secondary use of EHR data, collected during routine care, has the potential to improve healthcare professionals' decision-making capabilities and effectiveness, and broadens their knowledge regarding treatments, medications and clinical conditions. Through effective and quality decision-making, healthcare professionals are able to deliver care that positively improves patient health outcomes in a cost-effective and safe manner. However, privacy and security breaches potentially impact the integrity of data captured in electronic health records, and this invalidates its perceived usefulness in providing evidence to support care. In order to design a secure and effective EHR system for the adoption of practice-based evidence approaches, recommendations for privacy and security measures can follow the security control protocol of preventive, detective and corrective control. Within each control, different security solutions are recommended so that security design is truly holistic.