Analysis of Security and GDPR Issues in Healthcare Records Databases

This report provides a comprehensive analysis of security and GDPR issues and concerns within healthcare organizations, specifically focusing on health records databases. The research, based on a study of the Royal London Hospital, aims to analyze these issues to improve the safety and effectiveness of health record systems. The literature review examines ways to reduce GDPR issues, enhancing the security of health records. A qualitative research approach, employing interpretivism, descriptive research design, and an inductive research approach, was used to conduct the study. Secondary data collection and thematic data analysis were utilized, with a random sampling of 50 individuals. The findings highlight the use of effective techniques and methods to secure health records databases, in accordance with GDPR principles. The report addresses the importance of maintaining patient privacy, the significance of secure information systems, and the need for healthcare organizations to establish robust policies and practices to protect patient data, ultimately ensuring that patient information is handled securely and responsibly.

Security and GDPR issues and concerns in
healthcare organizations: the case of health
records databases

ABSTRACT
The given dissertation is based on 'Security and GDPR issues and concerns in healthcare
organizations: the case of health records databases' which is significant to determine related
problems to solve them properly. It is helpful to identify related issues which are created in
healthcare organisations to find effective ways to sort out them in order to improve safety of
health records databases. However, this investigation has an aim of 'To analyse the security and
GDPR issues and concerns in healthcare organizations regarding the case of health records
databases”. A study on Royal London Hospital'. In addition to this, the literature review consist
analysis of ways of reducing GDPR issues for improving safety of health records and
maintaining effectiveness of related systems. Moreover, the qualitative research and
interpretivism method is used to conduct the study properly. Meanwhile, descriptive research
design and inductive research approach has been preferred to gain correct findings. Basically, the
secondary data collection is utilised and thematic data analysis is done by using random
sampling with sample size of 50 individuals. The present research found that effective techniques
and methods are used to secure health records databases along with following principles of
GDPR for securing the patient information in appropriate manner.

Table of Contents
ABSTRACT.....................................................................................................................................2
TITLE..............................................................................................................................................5
CHAPTER 1: INTRODUCTION....................................................................................................5
1.1 Overview of the research..................................................................................................5
1.2 Background of the research..............................................................................................6
1.3 Research Aim...................................................................................................................7
1.4 Research objectives..........................................................................................................7
1.5 Research questions...........................................................................................................8
1.6 Significance of the research..............................................................................................8
CHAPTER 2: LITERATURE REVIEW.......................................................................................10
2.1 Concept of security and GDPR issues in health organizations......................................10
2.2 Analyse the concern of health records databases in healthcare organizations...............12
2.3 The ways of reducing GDPR issue in order to improve the security of health records
databases...............................................................................................................................14
2.4 The effectiveness of different health records systems to maintain the security of health
records..................................................................................................................................16
2.5 The measures can healthcare organisations take for improving safety of health records18
CHAPTER 3: RESEARCH METHODOLOGY...........................................................................20
3.1 Types of Investigation....................................................................................................20
3.2 Research philosophy.......................................................................................................21
3.3 Research design..............................................................................................................21
3.4 Research approach..........................................................................................................22
3.5 Data collection Method..................................................................................................23
3.6 Data analysis...................................................................................................................24
3.7 Sampling.........................................................................................................................24
3.8 Ethical Considerations....................................................................................................25
CHAPTER 4: DATA ANALYSIS................................................................................................26
4.1 Questionnaire..................................................................................................................26
4.2 Findings..........................................................................................................................32

4.3 Analysis..........................................................................................................................47
4.4 Discussion.......................................................................................................................53
CHAPTER 5: CONCLUSION AND RECOMMENDATIONS...................................................57
5.1 Conclusion......................................................................................................................57
REFERENCES..............................................................................................................................59
APPENDIX....................................................................................................................................63

TITLE
“Security and GDPR issues and concerns in healthcare organizations: the case of
health records databases”.
CHAPTER 1: INTRODUCTION
1.1 Overview of the research
Security of health records is an important aspect in health care organizations as it is very
essential to maintain the privacy of data related to patients. It is necessary to establish an
effective health records systems in order to maintain patient information safe. However, it has
been analyzed that the privacy of patients and the security of their information can be considered
as the most imperative barriers to entry when considering the adoption of electronic health
records (Zerlang, 2017). In addition to this, there are different types of medical information
which requires privacy including radiologic images, lab test results, medications, allergies, and
other clinical data which are stored and views on computers to determine specific health issue or
cause of the disease. Moreover, information security is required to be ensured because disclosing
to other people regarding specific health issue of individuals impacts negatively on their image
on society and create a number of social problems for them.
Meanwhile, the fact is that a minor medical issue may develop a major societal problem
due to lack of medical knowledge of people living in a society. It is necessary to ensure proper
safety of information related to patients because someone can misuse the same which become
really troubling for an individual (Panjwani and Jäntti, 2017). The GDPR stands for general data
protection regulation which consists of a new set of rules that has been designed to provide more
control to EU citizens over their personal information. It involves the criteria of harmonizing
data privacy laws across Europe, protect & empower all EU citizens data privacy and reshape the
way organizations across the region approach data privacy.
The present investigation will focus on an aim to analyze the security and GDPR issues
and concerns in healthcare organizations regarding the case of health records databases. This
study is based on the Royal London Hospital which is known as a large teaching hospital in
Whitechapel, London and it is a part of Barts Health NHS Trust. The given research will focus
on the concept of security and GDPR issues in health care organization including important to
maintaining the privacy of patient information as along with related problems (Rodrigues And et.

al., 2016). It is essential to maintain medical information including pathological reports of
several tests like CT Scan, MRI, blood test & ECG and other recorded data about prescriptions
involving given medications. It will also include concern of health records databases in
healthcare organizations because previous information is a help to make immediate and accurate
decision to provide appropriate treatment while the patient is not the conscious state. The
effective ways for decreasing GDPR in context of increasing security of health records databases
which is an important aspect in terms of maintaining the privacy of patients in an appropriate
manner are given here. It consists of the criteria for putting efforts for preparing more effective
as well as efficient strategies for ensuring accurate safety of patient information which cannot be
accessed by any other person. Moreover, it involves the effectiveness of different kinds of health
records systems to maintain the security of health records. It also includes appropriate policies
and rules of healthcare organizations for improving the safety of patient information and other
relevant data.
1.2 Background of the research
The present report is based on Royal London Hospital which is a large teaching
healthcare organization situated in White-chapel, London and it is associated as a part of Barts
Health NHS trust. It was founded in the years around 1740, almost 279 years ago. However, this
care organization conducts clinical practices in order to provide distinct general hospital services
for the city, Tower Hamlets and specialist tertiary care facilities for patients from across London
and elsewhere.
Meanwhile, it consists of approximately 110 wards, 26 operation theatres and 845 beds
which are used for providing proper care and medical facility to sick people in respect of
improving their health condition. Moreover, this care institution focuses on actual needs and
desired of ill people and establish an appropriate care plan for providing accurate services to top
them so that they will become disease free and comfortable (Romanou, 2018). Additionally,
there are a number of healthcare organizations which used different electronic systems to store
and process required information related to patient properly. It involves the different criteria of
maintaining records of the overall information and get easy access to specific data in order to
make the immediate decision of medication for the welfare of the specific patient.
The given investigation will focus on the concept of security and GDPR issue in the
context of maintaining proper safety of health records. It is necessary for hospital administration

to do not disclose any single information about their patients to other people. However, it
involves the fact that common people do not have proper knowledge about health problems and
they can make a big issue of any specific disease which is not favorable for an individual.
Additionally, other people can misuse the medical information of patients which is harmful to a
person then it is mandatory for care professionals working in hospitals to maintain the privacy of
patients information (Hunter And et. al., 2018).
It will include concern of health records in hospitals including understanding the health
of public and pattern of illness and determine cost-effective services. This given investigation
also discuss appropriate policies and rules of healthcare organizations which are helpful to boost
up the safety of health records. It is essential for every care institution to establish effective
strategies and norms which should be followed by every staff members in respect of securing
overall information related to patients for maintaining privacy. Moreover, it will include the
effectiveness of strict rules and norms to make sure about the safety of health records as that
nobody can misuse it (Bauder, Khoshgoftaar and Seliya, 2017). In addition to this, it will go to
evaluate the effectiveness of different health records systems to maintain the security of health
records. It consist the criteria to analyze features of particular health record systems and
implement it by determining its efficiency to secure overall database of the healthcare
organization.
1.3 Research Aim
“To analyze the security and GDPR issues and concerns in healthcare organizations
regarding the case of health records databases”. A study on Royal London Hospital.
1.4 Research objectives
 To determine the concept of security and GDPR issues in health organizations.
 To analyze the concern of health records databases in healthcare organizations.
 To evaluate the ways of reducing the GDPR issue in order to improve the security of
health records databases.
 To identify the effectiveness of different health records systems to maintain the security
of health records.
 To ascertain the measures can healthcare organisations take for improving safety of
health records.

1.5 Research questions
 What is the concept of security and GDPR issues in health organizations?
 How to analyze the concern of health records databases in healthcare organizations?
 What are the ways of reducing the GDPR issue in order to improve the security of health
records databases?
 How to identify the effectiveness of different health records systems to maintain the
security of health records?
 What measures can healthcare organisations take for improving safety of health records?
1.6 Significance of the research
The significance of conducting this investigation is to analyze the related issue of security
and privacy of health records in care organizations. It is necessary to determine problems
relevant to the safety of data which facilitate to establish more effective as well as an efficient
information system to ensure the privacy of the desired collection of information. However, it is
important to evaluate issue related to maintaining the security of data in hospitals so that specific
methods or techniques can be applied to solve them all. In addition to this, it will also provide
support to analyze the risk of an occurring problem for an individual while their related
information has been misused by someone else (Flaumenhaft and Ben-Assuli, 2018). Meanwhile,
this research is helping to identify that current policies and regulations are much sufficient or not
to make sure the privacy of patients data in a proper manner. It will facilitate to gain an
appropriate idea for preparing more accurate strategies and rules in respect of ensuring accurate
safety of data related to sick individuals in healthcare organizations.
The rationale of this investigation is to determine the number of issues related to GDPR
and focus them to sort out the incorrect way. It is necessary to initially find the specific problem
behind desired aspects then only appropriate solutions can be prepared accordingly (Kuchinke
and et. al., 2016). However, the analysis regarding the concern of GDPR issue is helpful to
determine accurate methods and technique which can improve the security of health records
databases in health care organizations respectively. Moreover, it is significant to conduct an
investigation in respect of boosting up the effectiveness of the information system and other
regulations to improve the security of healthcare records databases. It will facilitate to analyze
the more effective health records system in order to secure a database of patients in an

organization. Meanwhile, appropriate health records system is required to establish in the
hospital to records, manage and process patients information in a proper way.

CHAPTER 2: LITERATURE REVIEW
Literature review can be described as a review which identifies, evaluates and synthesises
related information within specific area of study. It is a kind of descriptive and analytic summary
of existing material relating to specific topic or field of investigation. However, the literature
can be considered as an effective procedure which is responsible for involving a systematic
examination of prior scholarly works (Bolognini and Bistolfi, 2017). It is helpful to understand
the particular topic of a study along with establishing significance of the same. In addition to
this, literature review provide support to develop own ideas and enhance knowledge which is
helpful to conduct research in appropriate way.
2.1 Concept of security and GDPR issues in health organizations
Security of healthcare records can be known as an important criterion which is focussed
by every healthcare organization. It involves the criteria of maintaining the privacy of data
related to patients and administrative information which can be misused by other people.
Moreover, GDPR can be described as a regulation in EU law on data protection and privacy for
all individuals within the European Union (EU) and the European economic area (McLoughlin,
Garrety and Wilson, 2017). In addition to this, it has been analyzed that organizations like Royal
London Hospital much establish a GDPR compliance program and demonstrate compliance. It
includes several elements of accountability which are required to be applied to gain complete
GDPR compliance.
According to the views given by Aditya Vats (2017), it is necessary to understand key
players involved in GDPR before analyzing related issues. However, it consists of Data Subjects
can be considered as people whose personal data is being stored but healthcare organizations in
respect of operational purposes. Meanwhile, it involves Personal Information that considered
any identification data of data subjects including name, location, identification no., I.P address or
via information related to physiological, physical, genetic, mental, social, cultural and economic
identification of an individual. In addition to this, Controller can be considered as an entity
including public authority, agency, individual, company or any other body alone or jointly. It
will facilitate to determine actual reason and means of processing personal data of data subjects.
Moreover, the Processor can be considered as an organization, personal or public authority

which are responsible for processing personal information on behalf of the controller.
Furthermore, there is a number of GDPR issue which is described below.
Most stuff is changing, however not the entire thing – This consist the act that GDPR
is responsible for making a number of changes in Data protection law of European Union which
are necessary for securing overall information of healthcare organizations. As mentioned by
Jesper Zerlang (2019), it is observed that there is not an entire departure from existing principles
and only make various modifications in past regulations.
A DPO should be designated – This involves the fact that it is required for Royal
London Hospital to appoint Data Protection Officer (DPO) in context of monitoring data subjects
or method sensitive personal knowledge on an outsized scale.
Many new requirements – This consist that overall organizations are required to boost
up their accountability of an individual in the context of processing personal information. As
mentioned by Shu and Jahankhani (2017), it includes the imposing responsibilities and required
to demonstrate compliance therewith at all times. However, one more new thing is improved
rights of data subject like the right to data portability and the right to be forgotten which impacts
on internal procedures of Royal London Hospital.
The introduction of mandatory Privacy Impact assessment (PIAs) – This consists of
the compulsory criteria of GDPR that it makes mandatory to carrying out PIAs for the controller
of data when risks of privacy are high. It includes that Royal London Hospital should conduct
privacy risk assessments before beginning projects involving personal data and work with DPO
to ensure they are in compliance as projects progress.
Rights of Data Subjects – The GDPR take steps for reinforcing few of the rights of data
subjects i.e. right to object and some of the fresh rights are developed including the right to
information portability. It has been analyzed that these rights might build it more durable for
organizations like Royal London Hospital to lawfully process personal data.
Geographic application – The GDPR regulations can be implemented on Non-EU
organizations of they render goods or facilities to EU residents and monitor behaviors of EU
residents (Bates And et. al., 2018). Moreover, the companies which do not seem to be subject to
existing EU data protection law are subject to the GDPR particularly online businesses.
Notifying a data breach within 72 hours – As per the regulation of GDPR, it is
necessary for businesses including Royal London Hospital to report information breaches to

related DPA within seventy-two hours of detection. Chen and Benusa (2017), states that it is
needed for some of the companies to have radical changes to internal detailing as well as
investigating structures.
Fines – This consist of the penalty structure of GDPR for organizations who failed to
mistakes is a tiered one. Basically, it includes fines and penalties for Royal London Hospital of
they failed to fulfill the overall criterion of GDPR regarding data protection.
Consent – The consent becomes more difficult for institutions to gain and place
confidence in. As per views are given by Jane Dixon and Carol Richards (2018), it has been
analyzed that consent is not considered to be valid when there is a clear imbalance is observed
between controller and data subject as per GDPR criterion.
Compliance obligations for controllers to be increased – The GDPR provide
regulations that are responsible for imposing fresh and hyperbolic compliance obligations on
controllers. For example, it includes keeping records of process activities, privacy on reasons &
by default, applying acceptable policies and so on.
Direct compliance obligations for processor – This can be described as direct legal
compliance obligations contains by processors under the GDPR. It is studied that DPAs will take
social control action against processors and DPAs are capable to take enforcement control,
actions against processors.
2.2 Analyse the concern of health records databases in healthcare organizations
The health records database plays an important role in hospitals as it will facilitate to
improve the accuracy of decision making of treatment procedure for an individual. According to
the opinion of Alexandra Pacurariu (2019), it is necessary for every health care organization to
record all the information related to patients and store it in a proper way because it can be helpful
in future. However, it is required for Royal London Hospital to analyze more effective as well as
efficient health records system in respect of to store and manage patient information in a safe
manner. In addition to this, if the patient is not in conscious states their previous health records
provide support to care professionals to provide immediate and appropriate medication to them
there making them well being.
As per views of Zeadally, Isaac, and Baig (2016), proper storage of health records is
supportive to enhance complete documentation, legible and streamlined coding, accurate and
billing. Furthermore, it helps to increase privacy, security, productivity and work-life balance