Analysis of the Security and Privacy Requirements of Cloud-Based Electronic Health Records Systems
Open accessAbstract
BACKGROUND: The Cloud Computing paradigm offers eHealth systems the opportunity to enhance the features and functionality that they offer. However, moving patients' medical information to the Cloud implies several risks in terms of the security and privacy of sensitive health records. In this paper, the risks of hosting Electronic Health Records (EHRs) on the servers of third-party Cloud service providers are reviewed. To protect the confidentiality of patient information and facilitate the process, some suggestions for health care providers are made. Moreover, security issues that Cloud service providers should address in their platforms are considered. OBJECTIVE: To show that, before moving patient health records to the Cloud, security and privacy concerns must be considered by both health care providers and Cloud service providers. Security requirements of a generic Cloud service provider are analyzed. METHODS: To study the latest in Cloud-based computing solutions, bibliographic material was obtained mainly from Medline sources. Furthermore, direct contact was made with several Cloud service providers. RESULTS: Some of the security issues that should be considered by both Cloud service providers and their health care customers are role-based access, network security mechanisms, data encryption, digital signatures, and access monitoring. Furthermore, to guarantee the safety of the information and comply with privacy policies, the Cloud service provider must be compliant with various certifications and third-party requirements, such as SAS70 Type II, PCI DSS Level 1, ISO 27001, and the US Federal Information Security Management Act (FISMA). CONCLUSIONS: Storing sensitive information such as EHRs in the Cloud means that precautions must be taken to ensure the safety and confidentiality of the data. A relationship built on trust with the Cloud service provider is essential to ensure a transparent process. Cloud service providers must make certain that all security mechanisms are in place to avoid unauthorized access and data breaches. Patients must be kept informed about how their data are being managed.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Data tampering is one of the most crucial security risks.
“Data tampering is one of the most crucial security risks [3].”
From Tamper-Resistant Mobile Health Using Blockchain Technology. (2017) · cites this paper as [3]
The Results section on security and privacy issues treats data integrity as important: it recommends digital signatures to avoid false data transactions and audit logs to track changes to medical records. It does not identify data tampering as one of the most crucial security risks or rank it against other risks. (LLM, conf=0.78)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 19
- [1]Furth B Escalante A Handbook of Cloud Computing 1st Edition 2010 London Springer
- [2]Chen YY Lu JC Jan JK A secure EHR system based on hybrid clouds J Med Syst 2012 10 36 5 3375 84 10.1007/s10916-012-9830-6 22351166 22351166 · DOI
- [3]Low C Hsueh Chen Y Criteria for the evaluation of a cloud-based hospital information system outsourcing provider J Med Syst 2012 12 36 6 3543 53 10.1007/s10916-012-9829-z 22366976 22366976 · DOI
- [4]Poulymenopoulou M Malamateniou F Vassilacopoulos G Emergency healthcare process automation using mobile computing and cloud services J Med Syst 2012 10 36 5 3233 41 10.1007/s10916-011-9814-y 22205383 22205383 · DOI
- [6]Bateman A Wood M Cloud computing Bioinformatics 2009 25 12 1475 19435745
- [7]Armbrust M Fox A Griffith R Joseph AD Katz R Konwinski A A view of cloud computing Commun ACM 2010 53 4 50 58
- [8]Creeger M CTO roundtable: cloud computing Commun ACM 2009 52 8 50 56
- [9]Kuo AM Opportunities and challenges of cloud computing to improve health care services J Med Internet Res 2011 13 3 e67 10.2196/jmir.1867 21937354 21937354 PMC3222190 · DOI
- [10]Anderson NR Lee ES Brockenbrough JS Minie ME Fuller S Brinkley J Tarczy-Hornoch P Issues in biomedical research data management and analysis: needs and barriers J Am Med Inform Assoc 2007 14 4 478 88 10.1197/jamia.M2114 17460139 17460139 PMC2244904 · DOI
- [12]Fernández-CardeñosaG De la Torre-Díez I López-Coronado M Rodrigues JJPC.Analysis of cloud-based solutions on EHRs systems in different scenarios J Med Syst 2012 36 6 3777 3782 22492177
- [13]Fernández-Cardeñosa G De la Torre-Díez I Rodrigues JJPC Analysis of the Cloud Computing Paradigm on Mobile Health Records Systems Proceedings of the Sixth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing 2012 Sixth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing July 2012 Palermo, Italy
- [14]De la Torre-Díez I Díaz-Pernas FJ Fernández-Cardeñosa G Antón-Rodríguez M Martínez-Zarzuela M González-Ortega D Boto-Giralda D Analysis of the benefits and constraints for the implementation of Cloud Computing over an EHRs system Proceedings of the 6th Euro American Conference on Telematics and Information 2012 6th Euro American Conference on Telematics and Information Systems May 2012 Valencia, Spain
- [15]Yellowlees PM Marks SL Hogarth M Turner S Standards-based, open-source electronic health record systems: a desirable future for the U.S. health industry Telemed J E Health 2008 4 14 3 284 8 10.1089/tmj.2007.0052 18570554 18570554 · DOI
- [16]Blanchet KD Electronic health records: are consumers riding or driving the car? Telemed J E Health 2008 4 14 3 210 4 10.1089/tmj.2008.9982 18570543 18570543 · DOI
- [17]Hargreaves JS Will electronic personal health records benefit providers and patients in rural America? Telemed J E Health 2010 3 16 2 167 76 10.1089/tmj.2009.0063 20082592 20082592 · DOI
- [19]Piette JD Mendoza-Avelares MO Ganser M Mohamed M Marinec N Krishnan S A preliminary study of a cloud-computing model for chronic illness self-care support in an underdeveloped country Am J Prev Med 2011 6 40 6 629 32 10.1016/j.amepre.2011.02.014 21565655 21565655 PMC3816581 · DOI
- [21]Tejero A de la Torre I Advances and current state of the security and privacy in electronic health records: survey from a social perspective J Med Syst 2012 10 36 5 3019 27 10.1007/s10916-011-9779-x 21947856 21947856 · DOI
- [23]Zhang R Liu L Security Model and Requirements for Healthcare Application Clouds Proceedings of the IEEE 3rd International Conference on Cloud Computing 2010 IEEE 3rd International Conference on Cloud Computing July 2010 Miami, Florida
- [27]Fledel Y Google Android: A Comprehensive Security Assessment IEEE Security & Privacy 2013 (forthcoming) 10.1109/MSP.2010.2. · DOI
Cited by
Sorted by citations
An overview of clinical decision support systems: Benefits, risks, and strategies for success
Sutton, R. T., Pincock, D., Baumgart, D. C., Sadowski, D. C., Fedorak, R. N., & Kroeker, K. I. (2020) · npj Digital Medicine · doi:10.1038/s41746-020-0221-y · Cited by 3,019 · see citing works
Tamper-Resistant Mobile Health Using Blockchain Technology.
Ichikawa, D., Kashiyama, M., & Ueno, T. (2017) · JMIR mHealth and uHealth · doi:10.2196/mhealth.7938 · Cited by 298 · see citing works
“Data tampering is one of the most crucial security risks [3].”
A blockchain-based medical data sharing and protection scheme
Liu, X., Wang, Z., Jin, C., Li, F., & Li, G. (2019) · IEEE Access · doi:10.1109/access.2019.2937685 · Cited by 239 · see citing works
eHealth integrity model based on permissioned blockchain
Hyla, T., & Pejaś, J. (2019) · Future Internet · doi:10.3390/fi11030076 · Cited by 49 · see citing works
- Authors
- JPC Rodrigues, J., de la Torre, I., Fernández, G., & López-Coronado, M.
- Affiliations
- Universidad de Valladolid (ES)
- Venue
- Journal of Medical Internet Research
- Publisher
- JMIR Publications Inc.
- Published
- 2013-08-21
- Volume
- 15
- Issue
- 8
- Pages
- e186
- ISSN
- 1438-8871 (ISSN-L)
- PMC
- PMC3757992
- OpenAlex
- W1990752442
- Cited by
- 209
- References
- 0
- Citations by year
- 2026: 6 · 2025: 12 · 2024: 19 · 2023: 12 · 2022: 13 · 2021: 8 · 2020: 18 · 2019: 23 · 2018: 15 · 2017: 21 · 2016: 25 · 2015: 23 · 2014: 14
- FWCI
- 60.41
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- cc-by
- Locations
- Journal of Medical Internet Research (publishedVersion, cc-by)
- Europe PMC (PubMed Central) (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- U.S. Social Security Administration
- Instituto de Telecomunicações
- Fundação para a Ciência e a Tecnologia (COMPETE, PEst-OE/EEI/LA0008/2013)
- Topics
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Health Sciences › Health Professions › Health Information Management › Electronic Health Records Systems
- Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
- Keywords
- cloud computing, electronic health records, health data privacy, data security, cloud service providers, role-based access control, data encryption, digital signatures, access monitoring, network security, PCI DSS, ISO/IEC 27001, FISMA, data breaches, patient confidentiality, e-health
- MeSH terms
- Medical Records Systems, Computerized, Computer Security, Privacy, Information Management
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
