CoChat
Sign Up
Cited by 160Thoreau and American LiteratureElectronic Health Records SystemsPrivacy-Preserving Technologies in Data

The DOI matches its Crossref record; 178 of the 180 references it cites were found in a registry or an index; none of the 112 sources its claims cite is checked for support yet.

Secondary Use of Electronic Health Record: Opportunities and Challenges

Open access
Shah, Shahid Munir, Khan, Rizwan Ahmed·2020·IEEE Access
DOI 10.1109/access.2020.3011099
Open this paper in CoChat — free accountOpen PDF

Abstract

In the present technological era, healthcare providers generate huge amounts of clinical data on a daily basis. Generated clinical data is stored digitally in the form of Electronic Health Record (EHR) as a central data repository of hospitals. Data contained in EHR is not only used for the patients' primary care but also for various secondary purposes such as clinical research, automated disease surveillance and clinical audits for quality enhancement. Using EHR data for secondary purposes without consent or in some cases even with consent creates privacy issues. Secondly, EHR data is also made accessible to various stakeholders including different government agencies at various geographical sites through wired or wireless networks. Sharing of EHR across multiple agencies makes it vulnerable to cyber attacks and also makes it difficult to implement strict privacy laws as in some cases data is shared with organization that is governed by specific regional law. Privacy of individuals could be severely affected when their sensitive private information contained in EHR is leaked or exposed to the public. Data leaks can cause financial losses or an individual may encounter social boycott if his / her medical condition is exposed in public. To protect patients personal data from such threats, there exists different privacy regulations such as General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA) and My Health Record (MHR). However, continually evolving state-of-the-art techniques in Machine Learning (ML), Data Analytics (DA) and hacking are making it even more difficult to completely protect an individual's/patient's privacy. In this article, we have systematically examined various secondary uses of EHR with the aim to highlight how these secondary uses affect patients' privacy. Secondly, we have critically analyzed GDPR & HIPAA regulations and highlighted their possible areas of improvement, considering escalating use of technology and different secondary uses of EHR.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This review examines secondary uses of electronic health record (EHR) data—such as clinical research, public health surveillance, and clinical audit—and argues that these uses create privacy and security risks that current regulations only partly address. It critically analyzes GDPR and HIPAA, highlighting gaps around consent, data minimization, re-identification, cloud storage, and non-covered entities.

Key findings

  • EHR secondary uses include clinical research, public health surveillance, and clinical audit/quality assurance; these can expose sensitive data and create privacy, financial, and social harms.
  • EHR data quality is problematic for secondary use: reported accuracy ranges from 44% to 100%; in one study, 31% of 1.1 million adult patients visited two or more hospitals and 1% visited five or more; in another, only 48% of 3,068 pancreatic cancer patients had complete pathology records.
  • Security incidents cited include theft of 20,000 records from Catawba Valley Medical Center, 4.5 million patients affected by a hospital-group hack, and 80 million people affected by a health-insurance data loss; US EHR data is described as growing 48% annually.
  • GDPR principles such as purpose limitation, data minimization, storage limitation, and the right to be forgotten conflict with EHR archiving and secondary analysis; pseudonymisation can be defeated by re-identification. HIPAA is described as outdated, limited to covered entities, and unable to protect data in non-covered platforms such as social media or fitness trackers.

Methods

  • Design: narrative/systematic-style review that “systematically examined” secondary uses of EHR and “critically analyzed” GDPR and HIPAA.
  • Data/sample: no empirical sample; the paper reviews literature, EHR standards (HL7, FHIR), secondary-use domains, security/privacy challenges, and two regulations (GDPR and HIPAA).
  • Analysis: thematic synthesis of secondary uses, data-quality challenges, security/privacy risks, and regulatory gaps; no formal search protocol, inclusion criteria, or quantitative meta-analysis is reported.

Limitations

  • Stated: the research domain is interdisciplinary and “hard to find literature,” requiring more collaborative efforts from medicine, computing, and law.
  • Evident: the review does not report a systematic search strategy, database list, or inclusion/exclusion criteria, so its coverage and selection of sources cannot be assessed.
  • Evident: it critically analyzes GDPR and HIPAA but mentions My Health Record (MHR) only in passing, and it offers no empirical validation of the proposed regulatory improvements.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/access.2020.3011099

Cites

178 of 178 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 112 cited sources checked · 0 supported · 0 flagged

Show all 66 claims

  • Probably not a substantial claim. 49
  • It may state two separate claims as one. 58
91 of 91

  • The paper relies on this without support.

    Patients are often unwilling to share their private health data for secondary uses, sharing it only for personal care.

    “For all such uses, patients may not be willing to share their information as often patients share their private health data for their personal care and not for the other/secondary uses.”

  • The paper relies on this without support.

    EHR data has not been utilized to its full potential for secondary uses.

    “However, EHR data has not been utilized to its full potential for secondary uses”

  • The paper relies on this without support.

    Patients do not always trust a single healthcare organization.

    “It is because patients do not always trust a single healthcare organization and may visit several such organizations to get a sense of satisfaction.”

  • The paper relies on this without support.

    Data contained in EHR in the form of clinical notes is often noisy, incomplete and inconsistent as well as contains grammatical errors and misspelled words.

    “Data contained in EHR (in the form of clinical notes) is often noisy, incomplete and inconsistent as well as it contains grammatical errors, misspelled words etc.”

  • The paper relies on this without support.

    EHR data is the most vulnerable data to cyber threats.

    “EHR data is the most vulnerable data to the Cyber Threats.”

  • The paper relies on this without support.

    Healthcare organizations spend more on increasing their integration but do not spend much on their system protection.

    “Healthcare organizations spend more on increasing their integration but do not spend much on their system protection.”

  • The paper relies on this without support.

    At present, most patients are not aware (or do not want to be aware) about what happens to their data once it has been taken from them and do not know about the data processing procedures undertaken by healthcare providers.

    “At present, most of the patients are not aware (or do not want to be aware) about what happens to their data once it has been taken from them and also they do not know about the data processing procedures undertaken by the healthcare providers.”

  • The paper relies on this without support.

    Consent of an individual is necessary for sharing of EHR data.

    “Usually consent of an individual is necessary for sharing of data but ambiguity arises when different healthcare organizations have different perspectives on the question of ''who owns the data?''.”

  • The paper relies on this without support.

    Hiding facts and information from physicians and medical staff can lead to treatment failure.

    “Hiding facts and information from the physicians and the medical staff can lead to treatment failure.”

  • The paper relies on this without support.

    NLP-based machine learning models can convert unstructured data elements of electronic health records into structured codes and extract useful information for further analysis.

    “NLP based ML models give meanings to words and phrases in text and convert unstructured data elements of EHR into structured codes.In short, NLP captures unstructured data elements of EHR, analyzes the data elements with respect to their grammatical structures, obtains meanings from grammatical structures, and finally summarizes information to make it useful for further analysis.”
10 of 10

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Spiekermann attribution points to a different reference

    Minor

    The text attributes a claim to Spiekermann et al. at reference 151, but reference 151 lists Voigt and von dem Bussche; Spiekermann et al. appear at reference 150.

  • Article 6 requirements described as both one condition and all clauses

    Minor

    The paper first says lawful processing requires obeying one of the listed conditions, then says all the listed clauses must be followed.

  • HIPAA enactment year changes from 1996 to 1966

    Minor

    The paper says HIPAA was passed in 1996, but later dates its legislation to 1966.

3 of 3

Citations

Cites

Flagged first, then by citations

2 of the 180 references couldn’t be matched to a known paper.

Research works printed but not linked: 9

  1. wheeler, 2019, The Counselor and the Law A Guide to Legal and Ethical Practice
  2. mohammed, 2017, US healthcare industry: Cybersecurity regulatory and compliance issues, Journal of Research in Business Economics and Management, 9, 1771
  3. 2015, HIV Positive Couple Face Social Boycott
  4. 2012, Former Howard University Hospital Employee Pleads Guilty to Selling Personal Information About Patients
  5. 2019, Global Status Report on Alcohol and Health 2018
  6. 2017, Global Hepatitis Report 2017
  7. 1995, Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data
  8. davis, 2018, 3 Phishing Hacks Breach 20 000 Catawba Valley Patient Records
  9. 2016, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46

Cited by

Sorted by citations

See all 160

Related

See all

Metadata

Authors
Shah, S. M., & Khan, R. A.
Affiliations
Faculty of Information Technology, Barrett Hodgson University, Karachi, Pakistan
ORCID
Venue
IEEE Access
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2020
Volume
8
Pages
136947-136965
ISSN
2169-3536 (ISSN-L)
DOI
10.1109/access.2020.3011099
OpenAlex
W3002945543
Cited by
158
References
180
Citations by year
2026: 21 · 2025: 44 · 2024: 39 · 2023: 28 · 2022: 12 · 2021: 11 · 2020: 1
FWCI
12.23
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Access (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • arXiv (Cornell University)
Topics
  • Health Sciences › Health Professions › Health Information Management › Thoreau and American Literature
  • Health Sciences › Health Professions › Health Information Management › Electronic Health Records Systems
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
electronic health records, secondary use of health data, patient privacy, data privacy regulation, GDPR, HIPAA, My Health Record, data breaches, cyberattacks, health data sharing, clinical research, disease surveillance

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review