IT Solutions for Australian Healthcare: EHR Case Study

This case study examines the implementation of IT solutions, specifically Electronic Health Record (EHR) systems, within the Australian healthcare sector. It explores the purpose of EHRs, the infrastructure for medical data storage, including prototype, assistance, and orientation modules, and network design standards. The study delves into privacy and security protection mechanisms, addressing potential risks and outlining policies for operational security. It emphasizes the importance of open-source EHR systems and their compliance with the Health Insurance Portability and Accountability Act, while also acknowledging potential security vulnerabilities. The analysis covers shared EHRs, network infrastructure, ontological isolation, and disaster recovery, providing a comprehensive overview of the challenges and opportunities in leveraging IT to enhance healthcare services and reduce costs. The study highlights the significance of patient data protection, interoperability, and the integration of various healthcare perspectives to improve patient care and streamline medical processes.

ABSTRACT
This case study intends to illustrate the IT solutions bestowed for healthcare organizations in
Australia. The Electronic Health Record (EHR) systems are offered for managing the patient’s
medical record in healthcare enterprises. Moreover, the EHR system is designed in such a way
that it complies with the requirements of Health Insurance Portability and Accountability act.
The utilization of open source EHR allows the healthcare stakeholders to access the patient’s
medical information at any time and any place when they want to access it. Even when the
proposed IT healthcare solution conforms to the Health Insurance Portability and Accountability
act, some potential security threats and vulnerabilities can be confronted.
Hence, this report discusses about the various information security vulnerabilities and threats and
suitable measures for alleviating the potential risks associated with it.
Keywords: Healthcare, Open source software, Electronic Health Record, medical information
system
1

Table of Contents
Abstract 1
1. Introduction 4
1.1. Purpose 4
1.2. Overview 4
2. Purpose of EHR 4
3. Medical Data Storage Infrastructure 4
3.1. Health Care Report 6
3.2. Shared EHR 6
4. Network Infrastructure 7
4.1. Network Design Standards 7
4.2. Ontological Isolation 7
5. Privacy and Security Protection Mechanisms 8
5.1. Dangers to singular Privacy 9
5.2. Mechanisms for ensuring security and privacy 9
5.2.1. Secured Information: Covered Entities and Business Associates 9
5.2.2. Data gathering and Patient's Rights 10
5.2.3. Data revelation and Sharing 10
5.2.4. Security Breach Notification 10
6. Policies that ensure operations security 10
6.1. General 10
6.1.1. Permanence 10
6.1.2. Review trailing 10
6.1.3. Secrecy 10
6.2. Access Control 11
6.2.1. Access list 11
2

6.2.2. Access control of access settings 11
6.3. Security 11
6.3.1. Ease of use 11
6.3.2. Access logging 11
6.3.3. Record demerging 12
6.3.4. Record blending 12
6.3.5. Time-restriction of access 12
6.3.6. Non-denial 12
6.3.7. Affirmation 12
7. Potential risks 12
8. Disaster Recovery 13
9. Conclusion 14
10. Reference 14
1. INTRODUCTION
1.1. Purpose
3

At present, the exchange of medical data between the healthcare organizations for enhancing the
excellence of health care services are more convenient through the development of information
technology. The remedial intrusions are mostly reliable on the legitimate and the health
prominent history of the patients. The requirements of doctors, medical staff, healthcare
contributors, policy producers, patients, and insurance firms are met by the incorporation of EHR
systems.
1.2. Overview
The EHR proofers an environment in which only the legitimate personals are able to access the
medical records. The insufficient medical information of the patients results in impediments and
health care costs. According to Health Insurance Portability and Accountability act, “An
electronic medical record is described as a health-associated data on a patient that is formulated,
administered, and discussed with the approved health-care staff (Burnard, 2001).
Mainly in the health care organizations, open source solution can be employed for enhancing the
health care services and to decreases the expense of similar type conventional software. In this
report, an open source EHR is proposed for perking up the health care system and to reduce the
healthcare costs.
2. Purpose of EHR
From an all the more particularly clinical care viewpoint (instead of a record-keeping point of
view), the accompanying prerequisites have been recognized amid the improvement of
openEHR:
 The requirement for a patient-driven, long lasting electronic wellbeing record that
involves a comprehensive perspective of patient needs instead of specialty critical
thinking and choice help procedures for constrained analytic purposes.
Mix of various perspectives of the patient (GP, crisis and intense care, pathology, radiology,
automated patient-arrange passage, and so forth.) with the tremendous assortment of accessible
information assets (phrasings, clinical rules and modernized libraries) (Crowston, Annabi, and
Howison, 2003).
 Clinical choice help to enhance understanding security and diminished expenses through
rehashed therapeutic examinations.
 Access to guidelines based processing applications.
3. Medical Data Storage Infrastructure
4

The medical data storage infrastructure in the open source EHR system is depicted in Figure 1.
This system is intended for drafting the requirements in order to build the open source EHR
operational environment.
Between the parts of the registering stage and the determinations, the connections are
demonstrated on the diagram. The unique determinations, processable articulations, necessities,
conformance criteria, and usage innovation particulars are incorporated in undertaking
expectations (Dewey, 2003).
The Prototype Module (PM), Assistance Module (AM), and Orientation Module (OM) are
contained in conceptual details of the EHR.
Fig 1: Infrastructure diagram for medical data storage in open source EHR
 Prototype Module (PM)
This module describes the version managed interface for the digital health report of the
patients. Some portions of this module are employed for the purpose of server side
scripting. It involves returning the information like group of unique ids of doctors or
patients after executing the queries that instigates the big data processing.
 Assistance Module (AM)
The Assistance module formalizes the extension between data models and information
assets. It acts as an interface between the online support services. Moreover, it can be
utilized by both the EHR application and GUI applications.
 Orientation Module (OM)
5

It is a lower level module in which the data and software are constructed. For example in
this case, the data related to clinical trials like measurement of blood pressure, Blood
sugar level, etc. can be build up.
The numerous necessities outside the idea of “medical EHR” are fulfilled by the profoundly
blended design. For instance, a similar orientation framework can be utilized for veterinary
wellbeing or for the open foundation or recorded structures. This is because of the way that the
orientation module epitomizes just ideas identifying with "benefit and regulatory occasions
identifying with a matter of health concern". It is in models and layouts, which are explicit of the
sorts of healthcare occasions and matter of health concern, are characterized.
In an additional measurement, albeit one of the prerequisites for the open source EHR was
designed like "patient-driven, shared, and parallel healthcare EHR” (Donahue, 2006). It is not
constrained to this, and can be employed as a part of absolutely wordy, expert circumstances,
like as a radiology division record framework. Prerequisites for different kinds of "health
insurance record" can be arranged by the two measurements, extension, and sort of matter.
The openEHR necessities incorporate the accompanying, relating to a fundamental, nonexclusive
evidence of concern:
 Precedence of the carer collaboration (e.g. investigate utilization of medical report).
 Reasonable though could not care fewer settings (essential, intense and so forth.).
 Remedial-legitimate devotion, accountability, and review trailing.
 Innovation and information organize autonomy.
 Exceptionally viable and adaptable programming.
 Bolster for medical information constitution: records, time-arrangement, registers,
inclusive of the point and interim occasions.
3.1. Health Care Report
The accompanying necessities tended to in open EHR related to a nearby medical record:
 Assistance for all parts of physiology information, inclusive of the typical extents,
elective frameworks of units and so on.
 Assists every characteristic dialect, and in addition interpretations between dialects in the
medical report.
 Amalgamate with different medical terms.
3.2. Shared EHR
The accompanying prerequisites tended to in open EHR relate to a coordinated distributed
healthcare EHR:
6

 Bolster for understanding protection of the patient information, inclusive of the
mysterious EHRs.
 Encourage the revelation of health records by means of interpretability at information and
learning stages.
 Bolster partially mechanized and computerized conveyed work processes.
4. Network Infrastructure
The openEHR administrations are appended to the current IT framework for offering a mutual,
protective medical report for the sufferers, which can be viewed by any number of care suppliers
in their group setting. The open source EHR empowered frameworks can likewise be utilized to
give EMR usefulness at supplier areas.
By and large, various vital classifications of framework can be actualized utilizing open EHR
embracing the accompanying:
 Mutual concerned group or territorial wellbeing administration EHR.
 Outline EHRs at a regional, territory, country, or comparable level.
 Little desktop common practitioner frameworks.
 Healing center EMRs.
 Combined and outline health records in alliance situations.
 Inheritance information cleansing and approval portals.
 Online assured EHR frameworks for portable sufferers/patients.
4.1. Network Design Standards
The openEHR way to deal with displaying data, administrations and space information depends
on various plan standards, depicted underneath. The utilization of these standards prompt a
partition of the modules of the open source EHR framework, and thusly, an abnormal state of
classification. This prompts efficient practicality, coverage, and adaptable arrangement (Emam,
Simon, Rousseau, and Jacquet, 2008).
4.2. Ontological Isolation
Generally, the essential sort of qualification in any arrangement of modules is ontological, that is
in the deliberation stages of depiction of this present reality. All the modules convey some sort of
morphological substance, yet not all morphologies are the same, or even of a similar class. For
instance, certain piece of the XYZ-CT wording depicts sorts of viral infections, locales in the
human body, and side effects. The data model may indicate a consistent sort Quantity. A
substance model may characterize the model of data gathered in a stake natal investigation by a
doctor (Feller, and Fitzgerald, 2000). These sorts of "data" are subjectively unique, and should be
produced and kept up independently inside the general model framework. The diagram
7

underneath represents these refinements, and demonstrates what portions are incorporated
specifically with programming and medical databases.
Fig 2: Network Infrastructure Diagram
This diagram demonstrates an essential division between "ontologies of data" that is the models
of data substance, which are the portrayals and characterizations of genuine marvels. These two
classes must be isolated on the grounds that the sort of creators, the portrayal and the reasons for
existing are totally unique. From the perceptions of medical informatics, this partition as of now
prevails all things considered, because of the improvement of terms and arrangements.
By plainly isolating the three classifications - data models, space content models, and wordings -
the open source EHR framework empowers each unit to have an all around characterized,
restricted degree and obvious interfaces (Henningsson, and Wohlin, 2004). Hence, a restriction is
imposed on the reliance of one unit on the other, prompting more viable and versatile
frameworks.
5. Privacy and Security Protection Mechanisms
According to National Health Information Network, a work in progress through an open –
private association will be utilized to give "whenever, anyplace medicinal services data and
8
Programming Languages XML Schema Languages Open Source EHR Epitome
Model

choice help through a complete learning based system of inter-functioning frameworks” (Lee,
Jung, Chung, and Jeong, 2001).
Based on the examination conducted by RAND organization, “90% of healing facilities and
specialists embraced HIT more than 15 years, the medicinal services framework could spare
practically $77 billion per year from productivity picks up, and an outcome predictable with
different examinations.
5.1. Dangers to singular Privacy
In spite of the advantages of the open source EHR implementation, its acknowledgment and
execution might not be accomplished until its dangers are alleviated. Maybe the most intricate
arrangement of dangers is to persistent protection and information security. Actually, a
noteworthy hindrance to open acknowledgment of EHRs is the worry over the protection and
security of individual medical data.
According to a survey on implementation of EHR, 55% of people in general said "the utilization
of electronic restorative records makes it more troublesome to guarantee patients' security," on
the other hand, "comparable extents perceived the possibility for EHRs in expenditure and
mistake declination and expanded patient’s information security (Mockus, Fielding, and
Herbsleb, 2000)."
Having procured some information regarding the "system to furnish individuals having access to
individual medical data on the web," survey respondents told that they were "exceptionally
worried" regarding 81% about therapeutic data fraud, 78% on promoting organization access,
57% on information retrieval by staff, and 54% about insurance agency retrieval of the data
(Researchandmarkets.com, 2009).
5.2. Mechanisms for ensuring security and privacy
Note that these enormous potential reserve funds in human services costs are just achievable
assuming all, or about all, human services associations take part in sharing EHRs. The
proficiency increases could twofold, bringing about reserve funds of around 7% of the nearly $4
trillion spent on social insurance every year.
5.2.1. Secured Information: Enveloped Entities and Business Partners
With a specific end goal to unveil personal health data to business partners, a secured substance
should have confirmations that the utilization of the data will be restricted for which purpose it
was exchanged, that the element has adequate safety to ensure the data, and that it will
collaborate with the secured substance to ensure the data as needed under the data privacy law.
Those confirmations should be incorporated into the assertion between the secured element and
the business partners (Schach, Jin, Wright, Heller, and Offutt, 2002).
9

5.2.2. Data gathering and Patient's Permissions
The security standards deals with "the security of user medical data from the essential
viewpoints: suitable access, ideal exactness, and the most elevated guidelines of protection and
security for everybody." fundamental to "enable social insurance customers to turn out to be
more practical in dealing with their medical record and data (Sunset Systems, 2009).
5.2.3. Data revelation and Sharing
Tolerant approval is not required to distribute the medical data when it is being utilized for
medical treatment, device installment or to perform medicinal services operations, and the
element has found a way to secure the data sensibly, which relies upon the technique used to
convey that data. Specialized strategies incorporate verbal, composed, phone or fax
correspondence.
5.2.4. Security Breach Warning
Notwithstanding reinforcing existing necessities, the proposed IT solution additionally
established another security prerequisite: a rupture warning method that pertains to both secured
substances and business partners (Trotter, Roller, and Valdes, 2008).
6. Policies that ensure operations security
All by own self, open source EHR forces just a negligible safety approach outline that can be
viewed as essential, however for the most part not adequate for a conveyed framework. The
accompanying arrangement standards are epitomized in open-source EHR.
6.1. General
6.1.1. Permanence
Medical report data could not be erased. Sensible erasure is accomplished by denoting the
information so as to influence it to show up erased (executed in version administration).
6.1.2. Review trailing
All progressions performed in EHR inclusive of the information protests and also the EHR
category and retrieved administration objects are review trailed with client id, period-stamp,
purpose, alternatively advanced signature and applicable rendition data. One special case is the
place the adapter is the patient, in such case, a representative identifier can be utilized (Yu,
Schach, Chen, and Offutt, 2004).
6.1.3. Secrecy
10

The substance of the medical record is isolated from distinguishing statistic data. This can be
arranged with the end goal that robbery of the EHR gives no immediate piece of information to
the character of the patient (round about intimations are obviously complicated to manage).
Taking a recognized EHR includes burglary of information from 2 servers, or still the robbery of
two physical PCs, contingent upon organization design.
6.2. Access Control
6.2.1. Access list
The superseding rule of retrieval management should be "pertinence" both as far as client id
(who is conveying consideration to the sufferer) and period (amid the present scene of healthcare
provision, and for some sensible, constrained period thereafter). An entrance management
rundown can be characterized for the EHR, demonstrating both distinguished people and classes,
the last of which may be part sorts, or specific staff gatherings.
6.2.2. Access control of access settings
An authorized individual manages the EHR access settings. That individual is allocated during
EHR formulation being one of the ids seen in EHR, for the most part the patient for rationally
equipped grown-ups, generally a parent, legitimate gatekeeper or other dependable individual.
The guard figures out who can roll out improvements to the entrance control list. All
progressions to the rundown are review trailed with respect to ordinary information.
6.3. Security
The patients can check constitution in the EHR as possessing one of various levels of security.
The meaning of the protection levels is not hard-wired in the open source EHR modules yet
rather is characterized by guidelines or understandings inside purviews of utilization.
6.3.1. Ease of use
The common mindset of information retrieval control is the main "confidential evades" which
operate for a large portion of the data in the EHR, more often than not. Evades for the EHR can
be generated by the patient, characterizing retrieval management conduct for the dominant part
of information retrieval choices. Special cases to the default arrangement are then included. This
method limits the requirement to consider the safety of each thing in the EHR independently.
Another security strategy rule that ought to be actualized in even a negligible EHR sending yet
are not straightforwardly indicated by open source EHR incorporate the accompanying.
6.3.2. Access logging
The read admission by application clients to EHR information ought to be signed in the EHR
framework. At present, the proposed open source EHR does not determine such log prototypes,
11

but rather may do as such later on. Many researchers have demonstrated that making clients
mindful of the reality of access monitoring is a powerful obstacle to improper access. There are a
few defenders of the contention that even read-get to logs ought to be made piece of the
substance of the EHR legitimate. From now open source EHR does not bolster this method.
6.3.3. Demerging of Records
At the point when information for a patient is observed to be in other patient's EHR, the entrance
logs for that EHR ought to be utilized to figure out who has retrieved that information,
essentially to decide whether consequent clinical considering (e.g. analyze, drug choices) have
been progressed in light of wrong data.
6.3.4. Record blending
At the point when more than one EHR is found for a similar sufferer, and must be converged into
a solitary record, the entrance control records must be re-assessed and converged by the patient
and possibly pertinent health care providers.
6.3.5. Time-restriction of access
The instruments ought to be executed that point of confinement the time amid which given
wellbeing experts can see the patient report. Scene beginning and termination are recorded in
open source EHR as examples of ADMINISTRATOR_ENTRANCE class, comprising
affirmation and release points of interest.
6.3.6. Non-denial of Service
In the event that computerized marking of changes to the record is made required, non-disavowal
of substance can be bolstered by an open source EHR framework. The computerized marking of
interchanges is additionally bolstered in open source EHR. Combined with logging of
correspondence of extorts, this can be utilized to ensure non-revocation of data in between
frameworks.
6.3.7. Affirmation
A component ought to be given to enable a confidence level to be formally connected with client
marking passwords.
7. Potential risks
Security dangers expected by open source EHR incorporate the accompanying aspects:
 Manual blunder in tolerant distinguishing proof, prompting mistaken relationship of
medical information of one patient with other. Mis-distinguishing proof of sufferers can
make individual information for one patient go into the record of another patient.
12