Comprehensive Report: Healthcare Information Systems Security in KSA

This report provides a comprehensive overview of healthcare information systems security in the Kingdom of Saudi Arabia (KSA). It explores the critical role of electronic health systems in improving health outcomes and the importance of patient trust in these systems. The paper delves into the security requirements for electronic protected health information (ePHI), evaluating the HIPAA security administrative, physical, and technical safeguards. It discusses the significance of privacy, confidentiality, and security in building patient trust and ensuring compliance with HIPAA rules. The report outlines the administrative safeguards, including security management processes, personnel, and access control. It also describes the physical safeguards, such as facility access controls, and the technical safeguards, which include software, hardware, and technologies limiting access to e-PHI. The report highlights the challenges faced by the e-health sector in KSA, such as the lack of human resources, privacy and confidentiality concerns, and non-centralized procurement. The study also provides recommendations to improve e-health initiatives and ensure HIPAA privacy rule compliance. The conclusion emphasizes the need for a national body for e-health and a unified plan for e-health initiatives to enhance the security and efficiency of healthcare in KSA.

Running head: HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
HEALTHCARE INFORMATION SYSTEMS PRIVACY AND SECURITY IN KSA
Name of the Student
Name of the university
Author’s note

1HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
Introduction
The role of the electronic health system or the digitalization of the health information is
to gain good health outcomes, healthier people, facilitate smarter spending, and healthier
spending. If the patient lacked trust in the electronic health information system, then the patient
might not disclose health information to the health care professionals. Withholding the health
information can have adverse and life threatening conditions (Tipton, Forkey& Choi, 2016).
Again when the breach of the health information occurs, that can have serious consequences on
the reputation of the healthcare organization. In order to ensure the privacy of the information,
certain safe guards have been created, that are the protections which are either administrative,
physical or technical. This paper will describe the security requirements for electronic protected
health information (ePHI) by evaluating the HIPAA security administrative, physical, and
technical safeguards.
Privacy, Confidentiality, and Security
Privacy and the security of the electronic health information is the main component to
build trust among the patient. This is also required by the patient, to understand the potential
usefulness of the electronic health system exchange. Each of the health care organization have
their own privacy and the safety rules, except that it is ensured that they comply with the HIPAA
rules (Tipton, Forkey& Choi, 2016).
The health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and
Security Rules helps to protect the security and he privacy of the individual identifiable health
information (Tipton, Forkey& Choi, 2016). The HIPAA rules establishes the National standards

2HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
for the use and the disclosure of the identifiable health information by the covered entities. It
also set standards for providing the individuals with the privacy rights and helping out the
individuals to understand and control how the health information is being used.
HIPAA Security Model
The HIPAA rules had set up some standards for protecting the Electronic protected health
information or for protecting any health information that is being held or transferred in electronic
form. The security rules helps to operationalize the process of protections present in the privacy
rule. This is done by strengthening the technical and other non-technical safeguards that a health
care organizations refers as “covered entities” that should put in place to secure people’s
electronic protected health information” (e-PHI) (Coughlan & Matthews, 2017).
The major goal of the Security rule is to safeguard the privacy of the individual patient
information, while permitting the covered entities for the adoption of new technologies for
improving the quality and the efficiency of the patient care (Ministry of Health, KSA, 2018).
The security rule is applicable to the health plans, the health care clearing houses and the
health service providers that communicates health information in the electronic form. The
security rule helps in highlighting and protecting against the anticipated threats to the security
and the integrity of the information (Ebad, Jaha& Al-Qadhi, 2016). It gives protection against the
reasonably anticipated and the impermissible use or disclosures.
The HIPAA policies should be re-evaluated for ensuring that they are adequate and
appropriate for the HIPAA agreement. This is necessary for bringing change in the general
security climate as well as modifications in the covered entity’s use of the electronic protected
health information. It is always necessary to perform a technical and non –technical evaluation,

3HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
based on the HIPAA standards. Preparation of the materials and the information takes in
advance of a HIPAA policy evaluation.
Administrative Safeguards
The administrative safeguards occurs at an administrative level of an organization and
mainly includes the procedures and the policies constructed to protect the patient information. A
designated security official generally protects the information of the patient by the
implementation of the office wide policies, enforce them and then train the employees on the
HIPAA measures (Mehraeen, Ayatollahi & Ahmadi, 2016). Some of the other administrative
functions included the conduction of the risk assessment, regularly evaluating the effectiveness
of the security measures of the entity and keeping a close watch on the type of information
disclosed, like another physician where the patient is referred to.
Administrative Safeguard Components
Security Management Process Risk assessments & security measures
Security Personnel Appointing a security official for creating and implementing
policies
Information Access
Management Access authorization to medical records
Workforce
Training/Management Training programs for staffs
Evaluation Detecting the effectiveness of security measures
Physical Safeguards
The physical safeguards refers to the physical protections that are put in place for
protecting the electronic system, the workplace devices and the equipment and the patient
information. This includes the facility access controls like the alarms and the locks, cable locks
and computer monitoring privacy filters, for ensuring only the authorized person gets access to

4HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
the health care information. These type of safe guards assists in restricting the unauthorized
access , ensuring that the patient data is safe or the information that are not required is disposed
off properly (Park, Kim & Park, 2017). The physical safe guards used for the protection of the
data are not sufficient and hence should be reviewed.
Technical Safeguards
These safe guard includes the software, hardware and the other technologies limiting the
access to the e-PHI. Some of the technical safe guards includes controlling to restrict the access
to the PHI, auditing control to screen the activity on the systems containing the e-PHI, like the
electronic health records. Alharbi,Atkins and Stanier, (2017) have argued that there are mainly
two security concerns related to the preservation of the data- the transmission security and the
access security.Alharbi,Atkins and Stanier, (2017) have also confessed that most of the medical
organizations face security threats in the transmission process, thus permitting unauthorized
access and breach of the HIPAA. Cloud computing had been the most popular trend in the field
of e-health records. However, the reliability and validity are the two issues that has to be
addressed before cloud computing.
Healthcare Organization Security Program
The ministry of health of KSA have decided to deliver digital solutions for bringing
transformative changes to the KSA’s health care sector. These involved the cloud-based
Electronic Medical Records (EMR), a comprehensive hospital information system enhancing the
care experience for both the doctors and the patients through an improved access and quality.
Currently, the EM is applicable to three MOH hospitals. Hence, EMR system has to be
introduced in to the other hospitals of CSA as well. A well-established digital system in

5HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
compliance with the HIPAA rules can act as a significant step in the transformation of the health
care sector of the KSA (Ministry of Health, KSA, 2018).Mahfuth, Dhillon and Drus, (2016)
have reported that there is a lack of human resources for the implementation of the e-health
systems. One of the important challenges faced by the e-health of KSA is the privacy and the
confidentiality challenges. Some of the organizations wanted to protect the identity of the female
patient, when they were dealing with the hospital employees because of the cultural and the
religious considerations. Most of the women do not have photo IDs, due to their attire and other
religious considerations. In order to mitigate such challenges, biometric verification system
could be introduced (Mahfuth, Dhillonand Drus, 2016). Furthermore, there are security and the
technical challenges related to the security and the database management. The health
informational professionals in some of the health care organization in Saudi Arabia has identified
a non-centralized procurement of the e-health system as a challenge. Each of the health care
organization in KSA should have an encrypted data, for preventing unauthorized access
(Chikhaoui, Sarabdeen & Parveen, 2017). Furthermore, in order to comply with the HIPAA
regulation, it is also necessary to have a good idea about how the data flows in an organization.
Furthermore, it is also necessary to construct the road maps for the implementation of the
standards.
Conclusion
In conclusion, the study had examined the existing challenges and the trends and the
recommendation to improve the e-health challenge and also to review that HIPAA privacy rules
are being complied with. It is necessary to make a national body for the e- health and to develop
a unified plan for the e-health initiatives.

6HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA

7HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
References
Alharbi, F., Atkins, A., &Stanier, C. (2017). Cloud computing adoption in healthcare
organisations: a qualitative study in Saudi Arabia. In Transactions on Large-Scale Data-
and Knowledge-Centered Systems XXXV (pp. 96-131). Springer, Berlin, Heidelberg.
Chikhaoui, E., Sarabdeen, J., &Parveen, R. (2017). Privacy and security issues in the use of
clouds in e-health in the Kingdom of Saudi Arabia. Vision 2020: Innovation
Management, Development Sustainability, and Competitive Economic Growth, 2016,
Vols I-Vii, 1574-1589.
Coughlan, R., & Matthews, F. M. (2017). U.S. Patent Application No. 15/281,496.
Ebad, S. A., Jaha, E. S., & Al-Qadhi, M. A. (2016). Analyzing privacy requirements: a case
study of healthcare in saudiarabia. Informatics for Health and Social Care, 41(1), 47-63.
Mahfuth, A., Dhillon, J. S., &Drus, S. M. (2016). A SYSTEMATIC REVIEW ON DATA
SECURITY AND PATIENT PRIVACY ISSUES IN ELECTRONIC MEDICAL
RECORDS. Journal of Theoretical & Applied Information Technology, 90(2).
Mehraeen, E., Ayatollahi, H., & Ahmadi, M. (2016). Health information security in hospitals:
The application of security safeguards. Acta informatica medica, 24(1), 47.
Ministry of Health, KSA, (2018).Saudi Health Information Exchange Policies.Access date:
6.3.2019. Retrieved from:
https://www.moh.gov.sa/en/Ministry/eParticipation/Policies/Pages/Policy.aspx?PID=1

8HEALTHCARE INFORMATION SYSTEMS SECURITY IN KSA
Park, E. H., Kim, J., & Park, Y. S. (2017). The role of information security learning and
individual factors in disclosing patients' health information. Computers & Security, 65,
64-76.
Tipton, S. J., Forkey, S., & Choi, Y. B. (2016). Toward Proper Authentication Methods in
Electronic Medical Record Access Compliant to HIPAA and CIA Triangle. Journal of
medical systems, 40(4), 100.