Journal of the American Medical Informatics Association · 2002 · 157 citations · 10 references
Health ProfessionsBiomedical InformaticsHealth InformaticsClinical Information SystemsComputer SecurityHealth Information SecurityAccess To Medical RecordsData ProtectionDigital AccessElectronic Health Record SecurityPatient PrivacyProtected Health InformationHealth Record AccessInstitutional Review Board ApprovalPatient Access BarriersPatient Data SecurityRecord-keepingSecurity UsabilityUnauthorized Access DetectionUnauthorized Data Access
IRB concerns focused on unauthorized access, patient anxiety from information, and provider record‑keeping changes. The pcasso project seeks to apply state‑of‑the‑art security to online communication of clinical information. The authors deployed the system with legal and regulatory safeguards and evaluated its security and usability through objective and subjective measures. In its initial deployment, 216 physicians and 41 patients enrolled, 68 physicians and 26 patients used the system, no unauthorized access occurred, providers found it difficult to use, patients rated it favorably, and the study concludes that high‑assurance systems must balance security and usability.
Objective: The Patient-Centered Access to Secure Systems Online (pcasso) project is designed to apply state-of-the-art-security to the communication of clinical information over the Internet. Design: The authors report the legal and regulatory issues associated with deploying the system, and results of its use by providers and patients. Human subject protection concerns raised by the Institutional Review Board focused on three areas—unauthorized access to information by persons other than the patient; the effect of startling or poorly understood information; and the effect of patient access to records on the record-keeping behavior of providers. Measurements: Objective and subjective measures of security and usability were obtained. Results: During its initial deployment phase, the project enrolled 216 physicians and 41 patients; of these, 68 physicians and 26 patients used the system one or more times. The system performed as designed, with no unauthorized information access or intrusions detected. Providers rated the usability of the system low because of the complexity of the secure login and other security features and restrictions limiting their access to those patients with whom they had a professional relationship. In contrast, patients rated the usability and functionality of the system favorably. Conclusion: High-assurance systems that serve both patients and providers will need to address differing expectations regarding security and ease of use.
10
An overview of the CERC ARTEMIS project.
V. Jagannathan, Y V Reddy, Kankanahalli Srinivas et al. · PubMed · 1995 · 29 citations · Full text