Secondary Use of Electronic Health Record: Opportunities and Challenges

Probably not a substantial claim: may not pass S4 (based).

Using EHR data for secondary purposes without consent, or in some cases even with consent, creates privacy issues.

“Using EHR data for secondary purposes without consent or in some cases even with consent creates privacy issues.”

• AssumptionRests on an assumption: Patients are often unwilling to share their private health data for secondary uses, sharing it only for personal care.

Classified as probably not a substantial claim.

Privacy of individuals could be severely affected when sensitive private information contained in EHR is leaked or exposed to the public.

“Privacy of individuals could be severely affected when their sensitive private information contained in EHR is leaked or exposed to the public.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Patient's information may be stolen while it is in transmission to other linked services over the network or when it is stored on distributed servers of cloud.

“Patient's information may also be stolen while it is in transmission to the other linked services over the network or when it is stored on distributed servers of cloud.”

May combine two claims.

If EHR data is leaked, theft or stolen from the database, it can be misused by altering dosage of drugs or treatment procedure and may cause severe complications or even lead to the patient's death.

“In case, if EHR data is leaked/theft or stolen from the database it can be misused (by altering dosage of drugs or treatment procedure etc.) and may cause severe complications or even lead to the patient's death [11].”

• cites [11]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

EHR system acts as a central database of information for patient documentation and billing, maintaining quality, and supporting patient related sensitive decisions.

“EHR system acts as a central database of information for patient documentation and billing, maintaining quality, and supporting patient related sensitive decisions [9].”

• cites [9] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

EHR reduces the probability of errors related to medical data analysis as it stores complete medical records and thus lowers overall healthcare cost.

“EHR reduces the probability of errors related to medical data analysis as it stores complete medical records and thus lowers overall healthcare cost [10].”

• cites [10]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Data leaks from EHR can cause financial losses or social boycott if an individual's medical condition is exposed in public.

“Data leaks can cause financial losses or an individual may encounter social boycott if his / her medical condition is exposed in public.”

Classified as probably not a substantial claim.

The most important risk associated with EHR is data security and patient's privacy.

“The most important issue is the data security and patient's privacy.”

Probably not a substantial claim: may not pass S4 (based).

Continually evolving state-of-the-art techniques in Machine Learning, Data Analytics, and hacking make it more difficult to completely protect an individual's or patient's privacy.

“continually evolving state-of-the-art techniques in Machine Learning (ML), Data Analytics (DA) and hacking are making it even more difficult to completely protect an individual's/patient's privacy.”

May combine two claims.

EHR data is used for secondary purposes including clinical research, health promotions, clinical audit and clinical governance, national screening and preventive campaigns, audits against national standards, national statistics, planning future services, and resource allocations.

“Information contained in EHR is also used for different secondary purposes (other than patient personal care) such as clinical research, health promotions, clinical audit and clinical governance, national screening and preventive campaigns, audits against national standards, national statistics, planning future services, and resource allocations etc., [12]”

• cites [12]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

EHR are patients' computerized health records that contain patients' complete information along with their medical history in a format that can be easily shared among different health care providers or accessed through linked locations when required.

“EHR are the patients' computerized health records that contain patients' complete information along with their medical history in a format (refer Figure 1) that can be easily shared among different health care providers or can be accessed by them through different linked locations when required [5].”

• cites [5]Not checked yet

  Not checked in the free run.

May combine two claims.

Sharing EHR across multiple agencies makes it vulnerable to cyber attacks and makes it difficult to implement strict privacy laws when data is shared with organizations governed by specific regional law.

“Sharing of EHR across multiple agencies makes it vulnerable to cyber attacks and also makes it difficult to implement strict privacy laws as in some cases data is shared with organization that is governed by specific regional law.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Data saved in EHRs can be accessed through multiple locations simultaneously and can be shared with different partner organizations conveniently.

“Data saved in EHRs can be accessed through multiple locations simultaneously and also can be shared with different partner organizations conveniently.”

May combine two claims.

HL7 version 2 had limitations including a difficult implementation process, a number of optional segments, and lack of proper representation capable of identifying techniques for exchanging messages and interfaces.

“However, different limitations were exposed in this version such as a difficult implementation process, having a number of optional segments and above all lack of proper representation that is capable enough to identify techniques for exchanging messages and interfaces [30].”

• cites [30]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

HL7 standard allows different healthcare organizations to share and exchange patient information via encoded data exchange.

“The HL7 standard allows different healthcare organizations to share and exchange patient information via encoded data exchange.”

• cites [9] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

FHIR standards have potential capabilities of supporting work flows in small devices like mobile phones.

“These standards have potential capabilities of supporting work flows in small devices like mobile phones [33].”

• cites [33]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

FHIR standards are very simple to adapt, possess scalability and are robust in nature.

“FHIR standards are very simple to adapt, possess scalability and are robust in nature.”

Classified as probably not a substantial claim.

Using patient sensitive information for different secondary purposes without their consent can seriously affect their privacy.

“Using patient sensitive information for different secondary purposes without their consent can seriously affect their privacy.”

• AssumptionRests on an assumption: Patients are often unwilling to share their private health data for secondary uses, sharing it only for personal care.

Probably not a substantial claim: may not pass S3 (load-bearing).

HL7 CDA is an EHR messaging standard for easy integration, interchange, sharing and retrieval of information across different clinical information systems.

“Afterwards this organization defined HL7-Clinical Document Architecture (HL7 CDA) as EHR messaging standard for easy integration, interchange, sharing and retrieval of information across different clinical information systems.”

• cites [26]Not checked yet

  Not checked in the free run.

May combine two claims.

HL7 version 3 resolved much of the problems of previous versions but could not resolve the incompatibility issue raised because of a variety of sub versions.

“Although HL7 version 3 resolved much of the problems of previous versions, it could not resolve the incompatibility issue raised because of a variety of sub versions [31].”

• cites [31]Not checked yet

  Not checked in the free run.

May combine two claims.

Privacy standards such as GDPR, HIPAA, and MHR provide legislation to protect personal data but fast-paced advancement in Data Analytics and AI poses new challenges for such standards.

“These standards provide legislation to protect personal data but with fast paced advancement in Data Analytics (DA) and Artificial Intelligence (AI) [18], [19] poses new challenges for such standards.”

• cites [18]Not checked yet

  Not checked in the free run.

• cites [19]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

It is beyond the capacity of human to review clinical data of EHR in large volume.

“Furthermore, it is beyond the capacity of human to review clinical data of EHR in large volume.”

May combine two claims.

Data contained in EHR in the form of clinical notes is often noisy, incomplete and inconsistent as well as it contains grammatical errors and misspelled words.

“Data contained in EHR (in the form of clinical notes) is often noisy, incomplete and inconsistent as well as it contains grammatical errors, misspelled words etc.”

• AssumptionRests on an assumption: Data contained in EHR in the form of clinical notes is often noisy, incomplete and inconsistent as well as contains grammatical errors and misspelled words.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

With technology advancements, EHR have become more informative sources than ever before.

“In short, with the technology advancements, at one side EHR have become more informative sources than ever before”

May combine two claims.

Manually reviewing EHR by experts using text charts or data abstraction methods is time consuming and not reliable to capture all the structured information.

“However, these methods are time consuming and not reliable to capture all the structured information.”

• cites [35]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

DL models' performance gets better on large datasets and further improves as data grows in size.

“3) their robustness against high complex functions, and 4) their performance gets better on large datasets and it further improves as data grows in size [47].”

• cites [47] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Unstructured data elements are not represented in any standard coding scheme such as ICD codes, therefore their retrieval, reporting and aggregation is not easy like structured data using commonly available database tools.

“Such data elements are not represented in any standard coding scheme such as ICD codes, therefore, their retrieval, reporting and aggregation is not easy like structured data using commonly available database tools [34].”

• cites [34]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

PHS is a process of collecting, analyzing and interpreting data related to a specific disease for administering and assessing public health on the whole.

“PHS is a process of collecting, analyzing and interpreting data related to a specific disease for administering and assessing public health on the whole [64].”

• cites [64] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Clinical research holds a pivotal role in tackling some of the hard pressed medical issues.

“Thus, clinical research holds a pivotal role in tackling some of the hard pressed medical issues.”

Probably not a substantial claim: may not pass S4 (based).

With new advancements in medical testing, the nature of EHR data, especially its unstructured elements, is getting complex.

“but with new advancements in medical testing, nature of EHR data (its unstructured elements) is getting complex.”

Probably not a substantial claim: may not pass S2 (checkable).

For effective management of advanced and vast data contained in EHR, more efficient tools are required.

“Therefore, for the effective management of advanced and vast data contained in EHR, more efficient tools are required.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Successful utilization of EHR information for research purposes requires development of new and emerging research infrastructures capable of exchanging information based on latest published standards.

“Successful utilization of this information for research purposes requires development of new and emerging research infrastructures capable of exchanging information based on latest published standards.”

Classified as probably not a substantial claim. May combine two claims.

EHR is an essential part in clinical research because it is a basic information source and a possible way of exchanging clinical information with different stakeholders.

“In the domain of clinical research, EHR is an essential part because it is a basic information source and a possible way of exchanging clinical information with different stakeholders.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When data is shared across different healthcare organizations, it raises different security and privacy concerns.

“However, when data is shared across different healthcare organizations, it raises different security and privacy concerns.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

With time EHR will contain such pieces of data or information that was never used before.

“With time EHR will contain such pieces of data/information that was never used before.”

Probably not a substantial claim: may not pass S3 (load-bearing).

DL approaches have opened new avenues to extract and use information contained in EHR for different real world applications.

“but on the other hand, DL approaches have opened new avenues to extract and use information contained in EHR for different real world applications.”

May combine two claims.

Manual PHS is not a reliable method as there are chances of errors due to manual handling of data.

“It is also not a reliable method as there are chances of errors due to manual handling of data.”

May combine two claims.

Manual PHS is time consuming, requires large manpower and needs huge efforts to record, store and analyze the data.

“This method of PHS is time consuming, requires large manpower and needs huge efforts to record, store and analyze the data.”

Probably not a substantial claim: may not pass S2 (checkable).

It is an important need of present day automated surveillance systems to use data from EHR.

“Thus, it is an important need of the present day automated surveillance systems to use data from EHR.”

Classified as probably not a substantial claim. May combine two claims.

In order to perform quality clinical audits, the clinical data must be easily available as well as the available data must be reliable.

“In order to perform quality clinical audits, the clinical data must be easily available as well as the available data must be reliable to perform clinical audit.”

Probably not a substantial claim: may not pass S3 (load-bearing).

During the ongoing COVID-19 outbreak, the importance of digital data recording systems like EHR has been clearly revealed and demonstrated to the whole world.

“During the ongoing COVID-19 outbreak, the importance of digital data recording systems (like EHR) has been clearly revealed and demonstrated to the whole world [79].”

• cites [79]Not checked yet

  Not checked in the free run.

May combine two claims.

Patients do not always trust a single healthcare organization and may visit several such organizations to get a sense of satisfaction.

“It is because patients do not always trust a single healthcare organization and may visit several such organizations to get a sense of satisfaction.”

• AssumptionRests on an assumption: Patients do not always trust a single healthcare organization.

May combine two claims.

Out of 1.1 million adult patients, 31% visited two or more hospitals, whereas one percent patients visited five or more hospitals for acute care during a five year period.

“Study conducted in [88] showed that out of 1.1 million adult patients, 31% visited two or more hospitals, whereas, one percent patients visited five or more hospitals for acute care during a five year period of their study.”

• cites [88]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based).

EHR data is collected through routine clinical practices during which the clinicians' priority is to collect the patients' data according to their own point of interest and according to different administrative needs but not according to their various secondary uses.

“EHR data is collected through routine clinical practices during which the clinicians priority is to collect the patients data according to their own point of interest and according to different administrative needs but not according to their various secondary uses (refer Section V).”

Classified as probably not a substantial claim.

The quality of collected clinical data is a serious concern of the researchers.

“The quality of collected clinical data is a serious concern of the researchers.”

May combine two claims.

Patients miss follow up visits suggested by the physicians or sometimes due to the perfunctory of the concerned medical staff, incomplete records are stored in EHR.

“Patients also miss follow up visits suggested by the physicians or sometimes due to the perfunctory of the concerned medical staff (who records patient related data), incomplete records are stored in EHR.”

Probably not a substantial claim: may not pass S2 (checkable).

Improvement in accuracy of EHR is essential to make it equally beneficial for primary as well as secondary uses.

“Improvement in accuracy of EHR is essential to make it equally beneficial for primary as well as secondary uses.”

May combine two claims.

EHR data is handled by various individuals and at different locations, and multiple persons are involved in entering, storing and processing the data.

“EHR data is handled by various individuals and at different locations.Multiple persons are involved in entering, storing and processing the data, therefore, data contains several definitions.”

May combine two claims.

In cyber attacks such as ransomware and DDoS, a big population can be affected at once, leading to losses much beyond financial losses, because EHR data contains more detailed information than other sources.

“Since, the data in EHR contains more detailed information than the other sources, therefore, in case of cyber attacks (Ransomware, Distributed Denial of Service (DDoS) etc.), a big population can be affected at once that can lead much beyond the financial losses [95].”

• cites [95]Not checked yet

  Not checked in the free run.

May combine two claims.

EHR data contains highly confidential data including physicians' personal notes, neuroimaging data, X-rays, ultrasounds, lab reports, lab results of HIV and other sexually transmitted diseases, mental disorders, personality disorders, contagious diseases, and doctors' sensitive comments.

“Other than personal and financial information, EHR data also contains patient's highly confidential data in the form of physicians' personal notes, neuroimaging data [98], [99], X-rays, ultrasounds as well as lab reports.This data may include lab results of HIV and other sexually transmitted diseases [100], mental disorders [101], personality disorders [102], contagious diseases as well as doctors”

• cites [98]Not checked yet

  Not checked in the free run.

• cites [100]Not checked yet

  Not checked in the free run.

• cites [101]Not checked yet

  Not checked in the free run.

May combine two claims.

Involvement of different individuals in preparation and processing of EHR leads to an inconsistent form of data, meaning data present in EHR is not uniform.

“Involvement of different individuals in preparation and processing of EHR leads to an inconsistent form of data.It means, data present in EHR is not uniform.”

May combine two claims.

Criminals sell valuable data taken from EHR to the darkweb and achieve high financial gain.

“Criminals sell valuable data taken from EHR to the ''darkweb'' [92] (darkweb refers to the content on the web that is not indexed by search engines and thus remains hidden from the general public) and achieve high financial gain.”

• cites [92]Not checked yet

  Not checked in the free run.

May combine two claims.

Most EHR data is present without mentioning proper units, because units are often remembered by medical staff and they can understand language written by each other.

“Most of the data is present without mentioning proper units as units are often remembered by the medical staff and they can understand language written by each other.”

May combine two claims.

For patients monitored at home, data is collected through a distributed network of sensors, and securing such data is a big challenge because there are greater chances of spying and skimming.

“In case of patients monitored at home, the data from patients is collected through a distributed network of sensors.Securing such data is another big challenge because there are greater chances of spying and skimming [104].”

• cites [104]Not checked yet

  Not checked in the free run.

May combine two claims.

With increased use of smart healthcare services, e-health solutions, and digital record systems, EHR data generates a sheer volume of data, and most EHR data is stored on cloud services.

“With the increased used of smart healthcare services, e health solutions [107], [108], and digital record systems, EHR data generates sheer volume of data (Alone in US 48% growing annually [109]), therefore, most of the data of EHR database is stored on cloud services [110].”

• cites [109]Not checked yet

  Not checked in the free run.

• cites [110]Not checked yet

  Not checked in the free run.

May combine two claims.

Cloud storage of EHR is beneficial but opens new doors for threats and breaches because highly sensitive and confidential patient information is stored on a third-party server where the owner does not have direct access.

“Cloud storage of EHR is beneficial in many ways like it provides cost effective storage, easy access as well as processing and updating of information is achieved with improved effectiveness and efficiency but on the other hand opens new doors for the threats and breaches [111].It is because highly sensitive and confidential patients' information contained in EHR is stored on a third party server”

• cites [111]Not checked yet

  Not checked in the free run.

• cites [112]Not checked yet

  Not checked in the free run.

May combine two claims.

All such confidential EHR data is stored in hospital local databases connected across other hospitals' or health providers' databases via wired or wireless connections for sharing, and transfer over the internet creates security risks by giving hackers and attackers a chance to access the data.

“All such data is stored in the hospital's local database (each hospital may have its own local electronic database), which is connected across other hospitals' or health providers' databases via wired or wireless connections for sharing purposes.Transfer of such confidential data over the internet creates several security risks.It provides a chance to hackers and other harmful attackers to access”

• cites [103]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

As healthcare technology and its inter-connectivity continually evolve, exchange of patient information over large interconnected networks is beneficial but has increased existing security risks.

“As the technology in healthcare is continually evolving, its inter connectivity is also evolving.With the help of interconnected networks, patients' information is made broadly available to the relevant organizations and staff to provide quality healthcare.Exchange of patient information over the large inter connected network is beneficial in many ways but has increased existing security risks.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Although different cryptographic, non-cryptographic and hybrid access control models have been developed to securely access EHR data, securing data in EHR is more challenging than ever before with technological advancements, so there is a high need to secure EHR data over networks and cloud servers.

“Different cryptographic, non cryptographic and hybrid access control models have been developed to securely access EHR data [115], [116], but with the advancements in technology, securing data in EHR is more challenging as it was ever before.Therefore, there is a high need of securing data in EHR over the network and on cloud servers [117].”

• cites [115]Not checked yet

  Not checked in the free run.

• cites [116]Not checked yet

  Not checked in the free run.

• cites [117]Not checked yet

  Not checked in the free run.

May combine two claims.

Although blockchain technology has been introduced in healthcare and provides a range of benefits over cloud computing, it does not provide fine-grained control of access over EHR; in blockchain, only the patient's private key can decrypt the encrypted EHR.

“In order to overcome such deficiencies of cloud based storage, recently blockchain chain technology has been introduced in the healthcare sector [121], [122].Although blockchain technology provides a range of benefits over the cloud computing technology, it does not provide finegrained control of access over EHR.In blockchain technology, only the patient's private key can decrypt the encrypted EHR”

• cites [121]Not checked yet

  Not checked in the free run.

• cites [122]Not checked yet

  Not checked in the free run.

• cites [123]Not checked yet

  Not checked in the free run.

May combine two claims.

With the adoption of EHR, multiple gateways opened for accessing patients' information remotely, and EHR contains more detailed information in a single source compared to previous paper-based records distributed among different hospital departments.

“Furthermore, The patient's EHR contains more detailed information all together in a single source as compared to the previous paper based medical records, which were distributed among different departments of hospitals.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Ambiguity arises when different healthcare organizations have different perspectives on who owns the data, including whether data belongs to the patient, physician, health insurance organization, healthcare organization, social security agency, or is jointly owned.

“Usually consent of an individual is necessary for sharing of data but ambiguity arises when different healthcare organizations have different perspectives on the question of ''who owns the data?''.Does data belong to the patient, his/her physician, health insurance organization, healthcare organization, social security agency or is it jointly owned by all [104], [127]?”

• cites [104]Not checked yet

  Not checked in the free run.

• cites [127]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Adoption of EHR has not only provided a range of benefits but also introduced potential risks of cyber attacks.

“In short, adoption of EHR has not only provided the range of benefits but also introduced potential risks of cyber attacks.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

With the adoption of EHR, it is now easy for criminals to attack millions of people at a time and steal their valuable information because EHRs are interconnected with numerous networks; in the case of paper-based records this was not possible.

“With the adoption of EHR it is now easy for the criminals to attack millions of people at a time and to steal their valuable information (because EHR are interconnected with numerous networks.In the case of paper based records it was not possible to steal millions of patients records at a time).”

May combine two claims.

Disclosing a patient's sensitive private information such as sexually transmitted diseases or mental illness in the public domain can negatively impact an individual's reputation, and in extreme cases such individuals can face social boycott.

“For example, disclosing a patient's sensitive private information such as sexually transmitted diseases or mental illness in the public domain can negatively impact an individual's reputation.In extreme cases such individuals can face social boycott as people start avoiding an individual if they know that he/she has sexually transmitted diseases like HIV, chlamydia etc., [128].”

• cites [128]Not checked yet

  Not checked in the free run.

May combine two claims.

Advanced encryption methods such as ABE, KP-ABE and CP-ABE are not of much help because cloud-hosted data is vulnerable not only to external hackers' attacks but also to internal attacks from authorized people such as database administrators and key managers, and advanced access control cannot provide support when key managers are attackers.

“Even though, researchers have introduced a few very advanced encryption methods such as Attribute Based Encryption (ABE) [118], Key Policy Attribute Based Encryption (KP-ABE) [119] and Cipher text policy Attribute Based Encryption (CP-ABE) [120] but these are not of much help because the data hosted on clouds is not only vulnerable to external hackers' attacks but also to the internal attacks from”

• cites [118]Not checked yet

  Not checked in the free run.

• cites [119]Not checked yet

  Not checked in the free run.

• cites [120]Not checked yet

  Not checked in the free run.

May combine two claims.

Medical insurance companies usually calculate premium/cost of insurance based on medical history and life events, and in such cases they can increase their premium.

“Another dimension to this issue is financial impact on an individual's life as medical insurance companies usually calculate premium/cost of insurance based on medical history and life events.In such cases insurance companies can increase their premium [130], [131].”

• cites [130]Not checked yet

  Not checked in the free run.

• cites [131]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Privacy concerns linked with exchange and sharing of EHR data are usually raised because patients' data recorded for individual care is shared or linked without consent or knowledge of the individual.

“These privacy concerns are usually raised due to the fact that when the patients data (which was recorded for the purpose of patient individual care) is being shared or linked without consent or knowledge of a particular individual.”

• AssumptionRests on an assumption: Consent of an individual is necessary for sharing of EHR data.

May combine two claims.

Many patients try to conceal their sensitive information because of lack of confidence in the system's security retaining their data and mistrust of medical staff, thinking that staff might disclose their confidential information to the public and create embarrassment.

“In order to protect sensitive data many patients try to conceal their sensitive information.It is because of the lack of confidence in the system's security retaining their data.It also shows mistrust of patients' on medical staff (doctors, nurses and the others) because patients think that they might disclose their confidential information to the public that may create embarrassment for them in”

• cites [135]Not checked yet

  Not checked in the free run.

May combine two claims.

Hiding facts and information from physicians and medical staff can lead to treatment failure, and such challenges may have severe consequences for patients, healthcare providers and governments.

“Hiding facts and information from the physicians and the medical staff can lead to treatment failure.Thus, such challenges may have severe consequences for patients, healthcare providers and even for the governments.”

• AssumptionRests on an assumption: Hiding facts and information from physicians and medical staff can lead to treatment failure.

May combine two claims.

Patients' privacy can be affected when their data is used for clinical research or secondary use; for example, a blood sample given by a patient and stored in a laboratory, when analyzed again for clinical research, violates data privacy because the patient's control over his/her data is lost even if the sample is returned undamaged.

“Privacy of patients can be affected when his/her data is used for clinical research or secondary use, refer Section V for discussion on secondary uses of EHR.For example, a blood sample given by a patient is stored in a laboratory and after carrying out requested analysis the same sample is analyzed again for the purpose of clinical research.Even though the sample is returned back to the”

• cites [127]Not checked yet

  Not checked in the free run.

• cites [132]Not checked yet

  Not checked in the free run.

May combine two claims.

Clauses (b-f) of Article 5 of GDPR have a contradictory nature in the context of EHR data concepts: they limit the quantity of data collection and enforce deletion soon after the purpose is achieved, while healthcare organizations encourage collecting more and more data and saving it for longer periods for detailed analysis, mining and predictions.

“If analyzed critically, clauses (b-f) of Article 5 have contradictory nature in the context of EHR data concepts.The regulations mentioned in these clauses (such as data minimization, purpose limitation) limits the quantity of data collection and enforces its deletion soon after the purpose has been achieved.On the other hand, healthcare organizations encourage collecting more and more data and to”

• cites [147]Not checked yet

  Not checked in the free run.

May combine two claims.

It has been difficult to determine how much clinical data belongs to the patient and how much may belong to healthcare organizations, and whether the consent of the data owner is needed when data is used for research.

“The privacy of clinical data has been subject to a lot of research and it has been difficult to determine how much of the data belongs to the patient and how much of it may belong to healthcare organizations and whether the consent of the owner of data is needed, in case the data is to be used for the research purpose [127], [132], [133].”

• cites [127]Not checked yet

  Not checked in the free run.

• cites [132]Not checked yet

  Not checked in the free run.

• cites [133]Not checked yet

  Not checked in the free run.

May combine two claims.

Obtaining explicit consent for every secondary use of EHR data is a time-consuming, costly and exhausting process.

“Obtaining explicit consent for every secondary use is a time consuming, costly as well as an exhausting process [149].”

• cites [149]Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

According to Spiekermann et al., if individuals knew about today's healthcare business model and how third parties use personal private data, they would be surprised and feel betrayed.

“According to Spiekermann et al. [151], if individuals knew about today's healthcare business model and how third parties use personal private data, they would be surprised and feel betrayed.”

• cites [151]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable).

Re-identification pulls down the illusion of privacy policies promised by technologists.

“Re-identification pulls down the illusion of privacy policies, which are promised by technologists.”

• cites [154] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Although Article 25 enhances protection of personal data by demanding privacy by design from controllers, it is difficult to implement because of its broader definition and the requirement of additional implementation cost and resources.

“Although, this Article enhances protection of personal data by demanding privacy by design form the controllers but it is difficult to implement because of its broader definition and due to the requirement of additional implementation cost and resources.”

May combine two claims.

HIPAA with HITECH and Cures regulations has not advanced itself with fast-growing technology and does not completely fulfill patients' expectations of immediate availability of their health data electronically when needed and robustly securing personal data.

“In short, HIPAA with HITEC and Cure regulations have not advanced itself with fast growing technology.It does not completely fulfill patients' expectations of immediate availability of their health data electronically when needed [168] and robustly securing personal data.”

• cites [168]Not checked yet

  Not checked in the free run.

May combine two claims.

HIPAA provides comprehensive guidelines for using technology to collect, store and transmit PHI and focuses on streamlining procedures for implementing security measures, but it does not elaborate on how to practically implement such measures.

“HIPAA provides comprehensive guidelines to understand the use of technology for the collecting, storing and transmitting PHI.It focuses on streamlining procedures for implementation of different security measures but on the other hand it does not elaborate on how to practically implement such measures.”

Probably not a substantial claim: may not pass S2 (checkable).

Under circumstances where patients are unaware of data use, obtaining broad consent is not logical.

“Obviously, under such circumstances, obtaining broad consent is not logical.”

• AssumptionRests on an assumption: At present, most patients are not aware (or do not want to be aware) about what happens to their data once it has been taken from them and do not know about the data processing procedures undertaken by healthcare providers.

Probably not a substantial claim: may not pass S3 (load-bearing).

The conclusive outcome of debates on obtaining specific consent is to shift specific consent into a broader consent of data processing that covers the range of its future uses, such as secondary uses of EHR.

“The conclusive outcome of all such debates is to shift specific consent into a broader consent of data processing that covers the range of its future uses (such as secondary uses of EHR) [150].”

• cites [150]Not checked yet

  Not checked in the free run.

May combine two claims.

After its legislation in 1996, HIPAA has not undergone any major iteration, so its rules have been outdated and cannot provide much help in safeguarding against the vague threats of the present digital age.

“After its legislation in 1966, HIPAA has not undergone any major iteration, therefore, its rules have been outdated and cannot provide much help in safeguarding against the vague threats of the present digital age [164].”

• cites [164] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In the context of healthcare data where decision support and predictive systems are made by archiving patients' personal data, Article 17 creates huge controversy because logically no more backups or archives of data would be applicable by organizations.

“According to concept of healthcare data where decision support and predictive systems are being made by archiving the patients' personal data (consider case of public health surveillance or clinical research, refer Section V), this article creates huge controversy because logically no more backups or archives of data would be applicable by the organizations.”

May combine two claims.

A major issue with HIPAA is that its protection applies only to covered entities such as healthcare providers, clinicians, pharmacies, healthcare facilities and clearinghouses, but not to non-covered entities such as information sharing platforms like social media posts, so it can cause personal information leak and does not provide protection when patient information is released from uncovered e-

“Another major issue with HIPAA regulations is that its protection applies only on covered entities i.e. health care providers, clinicians, pharmacies, health care facilities and healthcare clearinghouses but not on the non covered entities i.e. different types of information sharing platforms like social media posts [166].Therefore, it can cause personal information leak [167].In case of releasing”

• cites [166]Not checked yet

  Not checked in the free run.

• cites [167]Not checked yet

  Not checked in the free run.

May combine two claims.

Unstructured EHR data elements are not represented in any standard coding scheme such as ICD codes, so their retrieval, reporting and aggregation is not as easy as structured data using commonly available database tools.

“Such data elements are not represented in any standard coding scheme such as ICD codes, therefore, their retrieval, reporting and aggregation is not easy like structured data using commonly available database tools[34].”

• cites [34]Not checked yet

  Not checked in the free run.

May combine two claims.

Manually reviewing EHR by experts using text charts or data abstraction methods is time-consuming and not reliable to capture all the structured information.

“One of the methods to convert unstructured data into structured data is manually reviewing EHR by the experts using text charts or data abstraction methods[35].However, these methods are time consuming and not reliable to capture all the structured information.”

• cites [35]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

EHR data contains highly personal and sensitive information such as ID/social security number, bank details, family information and medical history, and unauthorized access to EHR information can have devastating financial and social impact on individuals if such sensitive information is leaked in the public sphere.

“EHR data contains highly personal and sensitive information i.e.ID/social security number, bank details, family information and medical history.Unauthorized access to EHR information can have devastating financial and social impact on individuals if such sensitive information is leaked in the public sphere.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

It is beyond the capacity of humans to review clinical data of EHR in large volume.

“Furthermore, it is beyond the capacity of human to review clinical data of EHR in large volume.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Under GDPR Article 5(1)(e), personal data must be deleted after it has been used and is no longer needed, and data should be collected with a predefined timeline and removed once that timeline is reached.

“Storage limitations refer to the fact that personal data must be deleted after it has been used and no longer further needed.It means data should be collected with a proper predefined time-line and it must be removed after the timeline is reached.”

• cites Article 5(1)(e)Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

In the present technological era, adoption of EHR has positively impacted healthcare services, and with seamless data sharing an individual can avail instant healthcare services at their location of preference.

“In the present technological era, adoption of EHR has positively impacted healthcare services.With the help of seamless data sharing an individual can avail instant healthcare services at their location of preference.”

Probably not a substantial claim: may not pass S4 (based).

With evolving technology, risks of data security and compromise of privacy have significantly increased.

“However, with evolving technology, risks of data security and compromise of privacy have also been significantly increased.”