A Comprehensive Review of Current Developments and Future Outlook Pertaining to Electronic Medical Records in the Context of Saudi Arabia, Aimed at Enhancing the Healthcare System

1. Introduction

The aging and expanding population are putting increased pressure on healthcare facilities and providers. Globally, there is a growing use of Technologies and Health Information Systems (HIS), which are believed to enhance patient care and hospital efficiency [1,2,3]. These HIS enable healthcare professionals to record essential patient data and provide improved healthcare services [4]. Examples of such systems include Electronic Medical Records (EMR), Computer Based Patient Records (CBPR), Automated Health Records (AHR), and Electronic Patient Records (EPR), all of which facilitate electronic patient data recording, contributing to better outcomes for healthcare organizations [5]. For the purpose of this study, any of these systems are considered as EMRs.

The adoption rates of EMR systems have varied across different countries, with developing nations generally lagging behind more affluent ones. The concept of electronically storing patient health records globally emerged in the 1960s [6]. In Saudi Arabia, EMR systems were introduced in 1988 to enhance the country’s healthcare system and services, aligning with the objectives set by the Saudi Ministry of Health (MOH) [7]. The MOH has prioritized the nationwide adoption of EMRs as a means to enhance the flow of patient information, reduce errors, and prevent record duplication [8]. Several successful instances of EMR adoption are evident in Saudi Arabia, with some hospitals even receiving recognition for their achievements in this area [9].

However, the literature highlights that the adoption of EMRs in Saudi hospitals is not widespread due to implementation challenges. These implementation issues act as significant barriers to the uptake of EMRs. This article aims to assess the existing literature to gauge the progress of EMR deployment in Saudi Arabia, along with identifying the factors that have either facilitated or hindered its implementation in this context. The potential of EMRs to handle substantial real-time big data quantities, leading to quicker disease diagnosis and improved healthcare strategy at a global level, is also considered.

2. Current status of HMR

In the realm of Healthcare 4.0, digital enabling technologies like blockchain, the Internet of Things (IoT), artificial intelligence, cloud computing, telemedicine, and big data have emerged as significant trends [10,11]. Blockchain, specifically, is characterized as a distributed database that maintains a continuously expanding chronological record of transactions. This framework allows control over digital transactions, data records, and executables. Notably, blockchain technology offers advantages in enhancing traceability, transparency, privacy, and security across both tangible and intangible operations. This versatility has led to its diverse applications [7]. In various domains, multiple blockchains are employed to facilitate innovative value processes [9,12]. For instance, industries like chemicals and pharmaceuticals employ blockchain to streamline machine-to-machine communication and tap into new markets [13,14]. This technology aids in tracking products along supply chains and facilitating more efficient transactions.

Blockchain has gained traction across different sectors, including energy supply companies, tech startups, financial institutions, national governments, and academic circles. In the domain of health and medicine, blockchain holds the potential to revamp health services for patients and the entire ecosystem. It achieves this by enhancing the storage of medical information and facilitating the exchange of data through the creation and management of a distributed database of a significant scale [15,16]. As a result, blockchain technology is progressively finding applications within the medical and health sectors.

2.1. The Saudi Healthcare System

To enhance the well-being of its populace, Saudi Arabia, among the emerging nations, is endeavoring to align itself with global trends and technological progress [17,18]. The nation currently boasts a total of 244 hospitals, with the Ministry of Health overseeing approximately 60% of these as public healthcare institutions [19]. The remaining 40% are furnished by private enterprises, academic medical centers, and governmental bodies such as the Ministry of Defense and Aviation. Saudi citizens are entitled to complimentary access to primary, secondary, and tertiary healthcare services within the public hospitals managed by the Saudi Ministry of Health.

In the year 2007, the budget allocated to the Saudi Ministry of Health accounted for 5.6% of the overall government budget, amounting to an expenditure of $277 per individual on an annual basis. An integrated Electronic Health Record (EHR) system with the capability to facilitate the exchange of health-related data across multiple institutions was initially developed during the 1980s. However, the deployment of EHR systems across Saudi Ministry of Health hospitals has exhibited a sluggish pace [20].

Research highlights a range of factors contributing to the gradual adoption of Electronic Medical Records (EMRs) within Saudi Arabia. Additionally, it has come to attention that numerous initiatives aimed at EMR implementation and enhancement lacked synchronization and collaboration [21] Despite encountering setbacks in progress, the Ministry of Health has acknowledged the paramount importance of introducing an information system within hospitals that would ultimately interconnect all healthcare facilities across the nation.

The progression of EMR implementation in Saudi Arabia is the central aspect of this study [22] . The study identified the intricate issues holding back the adoption of EMRs in Saudi hospitals.

Figure 1. Diagram for Saudi healthcare system [24].

Figure 1. Diagram for Saudi healthcare system [24].

2.2. Current settings of integrative medicines

The present state of Saudi Arabia’s healthcare system does not encompass the practice of integrative medicine. The existing legislative and regulatory structures, along with the training of traditional medical practitioners, the organizational setup of healthcare, infrastructure availability, and the financial and insurance landscapes collectively underscore the considerable distance that remains to be traversed in establishing a comprehensive integrated healthcare framework. [24,25].

2.2.1. Guidelines and rules

The strategy and policy of the Ministry of Health (MOH) in relation to integrative medicine and health do not explicitly outline rules and regulations. However, the establishment of the National Center for Complementary and Alternative Medicine (NCCAM) within the MOH, as indicated by Resolution 367-9-11-2009, signified a willingness to incorporate Traditional and Complementary Medicine (T&CM) into the healthcare framework [26,27]. In Saudi Arabia, the NCCAM serves as a comprehensive hub for various aspects of T&CM. Its scope includes promoting research, training, public awareness, and the validation of Islamic medicine, along with overseeing the regulation and licensing of T&CM practices.

The NCCAM collaborates with other health regulatory bodies in Saudi Arabia, such as the Saudi Food and Drug Authority (SFDA), the Saudi Commission for Health Specialties (SCHS), and local and regional MOH authorities, to effectively carry out its regulatory responsibilities. At present, acupuncture, osteopathy, chiropractic, naturopathy, and cupping are the sole five therapies that have received licenses in Saudi Arabia. The SFDA not only regulates herbal products but also exercises oversight over products associated with these five professions. [13,28,29].

2.2.2. Education and training

In terms of training for practitioners in Traditional and Complementary Medicine (T&CM), the National Center for Complementary and Alternative Medicine (NCCAM) is the sole entity offering an official course tailored specifically for cupping practitioners. This course is a prerequisite for obtaining a license as a cupping practitioner. However, for other licensed T&CM practices, the training provided is often not characterized by rigorous standards [30].

The Saudi Commission for Health Specialties (SCFHS) has the authority to accredit foreign courses for practices licensed in Saudi Arabia, contingent upon meeting specific criteria. Despite the emergence of T&CM courses within various Saudi institutions, particularly within undergraduate medical schools, there remains a lack of dedicated education in integrative medicine for T&CM providers.

At present, the organizational and healthcare infrastructure of the Ministry of Health (MOH) is inadequate to support comprehensive integrative healthcare. While a limited number of clinics offering complementary therapies can be found within the MOH, universities, and military hospitals, these clinics primarily focus on research endeavors. In some cases, they also extend services to patients.

Illustrating an example of integrative medicine, the Saudi NCCAM/MOH initiated the establishment of three integrated cupping clinics within separate secondary care hospitals situated in different cities. This model, which was implemented for the purpose of study and evaluation, was ultimately abandoned after a year of operation. [31,32].

2.2.3. Insurance and funding

The five licensed Traditional and Complementary Medicine (T&CM) disciplines are predominantly offered as distinct, unconnected services within the private sector. Patients are required to directly cover the costs of these services, as reimbursement is not extended to them. Notably, the national insurance policy in Saudi Arabia, as stipulated by the Council of Cooperative Health Insurance, does not encompass coverage for traditional and complementary medical procedures. [33,34].

3.0. Saudi Arabia’s current state of healthcare

3.1. Disease burden

In 2010, the landscape of health concerns in Saudi Arabia underwent a significant transformation. Noncommunicable diseases and traffic accidents superseded infectious diseases as the leading contributors to mortality and disability [35]. Among the culprits driving this change were major depressive disorder, auto accidents, and diabetes, which emerged as the primary causes of Disability Adjusted Life Years (DALYs). This marked a shift from the previous prevalence of premature birth issues as the chief source of DALYs in 1990. The evolving disease pattern in Saudi Arabia closely mirrored the adjustments in lifestyle spurred by the nation’s recent economic advancement.

This transformation was characterized by sedentary behaviors, unhealthy dietary practices, and a prevalence of smoking—a set of contemporary lifestyle features. Key risk factors associated with DALYs in 2010 encompassed high body mass index, dietary risks, elevated fasting blood glucose levels, and insufficient physical activity.

Anticipated trends indicate that Years Lived with Disability (YLD) in Saudi Arabia will continue to rise, driven by the shifts in the epidemiological profile of diseases influenced by existing lifestyle patterns. Recent health data reveals that between 2005 and 2016, the incidence of conditions such as neck and back pain, migraines, diabetes, and depression and anxiety disorders escalated within Saudi Arabia [38]. The current healthcare system is confronted with the challenge of effectively managing the present and anticipated burden of lifestyle-related illnesses. Addressing this challenge requires heightened investments upstream and an all-encompassing healthcare approach, as depicted in Figure 2.

Figure 2. Current health care system [35].

Figure 2. Current health care system [35].

2.2. System of healthcare

In the past few decades, the healthcare system of the Kingdom of Saudi Arabia (KSA) has undergone remarkable advancement [38,39]. Presently, the national healthcare system has transitioned into a modernized Western-style structure. The Ministry of Health (MOH) and other governmental or semipublic healthcare entities predominantly own and operate this system. The MOH oversees about 60% of healthcare services, while the remaining 40% are managed by various semipublic services and the private sector [41,49]. A depiction of the existing organization of Saudi Arabia’s healthcare system can be found in Figure 3.

In recent years, a trend has emerged towards restructuring the healthcare system with the aim of privatizing public hospitals and introducing insurance coverage for both citizens and foreign workers. It is anticipated that the private sector’s involvement in the healthcare system will grow in the near future. To ensure the provision of high-quality healthcare services and prevent potential shortages, Saudi Arabia’s healthcare system must confront multiple challenges [22,42,43]. The system faces significant hurdles due to the expanding population and the increasing demand for free medical treatments, particularly given the constraints of its financial resources. The healthcare system is grappling with the mounting burden of non-communicable diseases, which presents a major concern. In order to establish equitable and efficient healthcare, reforms in its financing approach are imperative. The primary objectives of Saudi Arabia’s healthcare transformation encompass enhancements in healthcare indicators and a reduction in out-of-pocket expenses.

Figure 3. Transformation of Saudi health care system[42].

Figure 3. Transformation of Saudi health care system[42].

A structured traditional healthcare system is absent, yet a substantial portion of Saudis continue to engage with the traditional healing practices, effectively operating as an informal healthcare system.

2.3. The state of conventional and alternative medicine in Saudi Arabia at the moment

In Saudi Arabia, a diverse array of traditional regional healing practices have emerged from various geographic and cultural origins, in contrast to the singular traditional healing systems found in countries like China, Korea, and India [45]. Nonetheless, the terms "Islamic Medicine" and "Prophetic Medicine" are employed in Saudi Arabia and other Muslim societies to encompass a range of treatment approaches influenced by Islamic religious teachings within the context of the Arab and Islamic worlds. "Islamic Medicine" allows for any methods that align with Islam’s teachings, whereas "Prophetic Medicine" is confined to those remedies explicitly mentioned in the sayings and traditions of the Islamic Prophet.

To circumvent confusion between the terms "Arabic Medicine" and "Islamic Medicine," the phrase "Traditional Arabic and Islamic Medicine" [46,47] is sometimes employed to encompass all medical traditions within the Arab realm. Analyzing various regional surveys systematically unveiled that a substantial portion, ranging between 60 to 75 percent of the population, engage in traditional medicine (TM) practices. Among the prevalent forms of traditional medicine in Saudi Arabia are religious healing, herbal therapy, cupping therapy, and honey therapy. Additionally, customary treatments such as cautery and the utilization of camel milk are widely embraced. Traditional healers constitute the primary sources of traditional medicine [48,49].

3. The global burden of musculoskeletal

Trauma is a widespread and escalating issue, and the World Health Organization (WHO) has pinpointed it as the leading cause of mortality among individuals above the age of five. It claims more lives than a combination of malaria, tuberculosis, and human immunodeficiency virus/acquired immunodeficiency syndrome (HIV/AIDS) [50,51]. Hand trauma specifically poses a considerable burden on morbidity and offers an important avenue for intervention due to its detrimental effects on both quality of life and economic productivity.

Previously considered costly and less worthwhile, surgical treatments have now gained recognition as cost-effective measures to address global health challenges. However, in low- and middle-income countries (LMICs), where more than a third of the global population resides, merely 6% of surgical procedures are conducted. This disparity hinders the provision of essential surgical care. To mitigate this, organizations from high-income countries (HICs) financially support numerous medical missions each year, incurring expenses exceeding $250,000 [52,53]. For instance, the Touching Hands Project has carried out 41 missions across 13 different countries, performing 2,467 procedures specifically focusing on the hands and upper extremities. Similarly, ReSurge International has conducted over 105,000 procedures during missions spanning more than 15 nations. Despite the impressive figures, these statistics might not accurately convey the true impact of these endeavors. Critical questions remain unanswered, such as the long-term functional status of each patient and their ability to resume work and provide for their families. Additionally, the handling of regional challenges by the local healthcare system remains uncertain. Due to limited data collection and relatively short follow-up periods during most missions, these important aspects often go unaddressed. Nonetheless, the availability of such information is pivotal for gauging the effectiveness, value, and overall impact of international outreach missions, as well as their contribution to the sustainability of local healthcare systems [54,55].

Over recent decades, a multitude of therapies has been implemented globally to improve the health of millions of individuals, extending beyond the scope of surgical diseases. Examples encompass the utilization of antibiotics, enhanced nutrition, and enhanced road safety measures to prevent accidents. Despite the success of these initiatives in reducing global morbidity and mortality, a new challenge emerges in ensuring the provision of quality care. Kruk et al. report that inadequate healthcare systems contribute to over 8 million annual fatalities and economic losses of $6 trillion. In light of this, the authors assert that poor-quality care has become a greater obstacle to reducing mortality compared to the issue of limited access.

Drawing parallels between the quality gap present in both the United States’ healthcare system and that of low- and middle-income countries (LMICs), it becomes crucial for outreach efforts in LMICs to embrace a culture change towards quality assessment and improvement similar to what has occurred in high-income countries (HICs). Prioritizing high-quality health systems, Kruk et al. and the Lancet Global Health Commission outline key objectives, including measuring and analyzing quality, enhancing quality through educational innovations, and developing effective methods and tools such as measurement surveys and patient-reported outcomes. The integration of electronic health records (EHRs), designed to be context-sensitive, cost-effective, and adaptable, can facilitate the achievement of these goals [56].

This review aims to emphasize the advantages of EHRs in HICs, explore their potential benefits in LMICs, and assess their current utilization by outreach organizations. Additionally, a guide for implementing EHRs during outreach missions for hand surgery is provided. In HICs, data collection and documentation through EHRs form the cornerstone for safety, quality, accountability, and efficiency. The advantages of data gathering extend across clinical, organizational, and social realms, offering a deeper and more precise comprehension of the required and delivered treatments. EHRs establish a framework for communication, ensuring accessible care plans that prevent redundant or incompatible therapies while facilitating treatment harmonization. Clinically, EHR utilization has been widely documented to yield numerous benefits, such as decreased infant mortality, reduced adverse medication reactions, increased rates of postoperative outcome assessment, and adherence to evidence-based recommendations [57].

The utilization of clinical decision support and electronic health records (EHRs) offers the potential to curtail costs associated with personnel and human resources as well as to eliminate redundant testing, presenting organizational benefits. Prior research has demonstrated enhanced compliance with legal and regulatory standards through heightened data security and improved patient confidentiality achieved via controlled and auditable processes. Evidenced by results from the Joint Commission on Accreditation of Healthcare Organizations, these measures contribute to improved quality assurance.

EHRs hold significant potential in enhancing patient treatment through avenues like root cause analysis, research, and outcome tracking. While their societal benefits may not be immediately apparent, EHRs serve as valuable tools for public policy and health services researchers. These systems facilitate investigations into epidemiology-related questions, guiding resource allocation, evaluating intervention effectiveness, and offering insights that steer future outreach initiatives. For instance, research on the impact of public policies on COVID-19 rates was made feasible through the aggregation of digital data collected from laboratory and county systems [58,59].

Information regarding EHR usage and quality assessment can be extracted from World Health Organization (WHO) data and other outreach organizations, although a comprehensive analysis of all such organizations remains pending. Notably, adoption rates are lower in lower-middle (35%) and low-income (15%) countries compared to more than 50% in high-income countries (HICs) that have established national EHR systems. Existing literature, as seen in a systematic review addressing basic surgical care standards in LMICs, tends to be single-center, observational, and lacking crucial details like follow-up periods. Inconsistencies in quality assessment methods are also evident, indicating a lack of measurement standardization [60,61]. Furthermore, existing quality measurement approaches for surgical missions in LMICs tend to focus disproportionately on systems and structures rather than outcomes.

To bridge this gap, the Global-QUEST (Quality in Upper Extremity Surgery and Training) initiative, comprising ten hand surgeons dedicated to advancing secure and high-quality care in LMICs, has developed quality standards for hand surgery outreach. These standards align with the WHO’s approach to monitor essential care components. However, for these measurements to be effectively benchmarked and utilized, reliable data collection processes are vital, mirroring the practices implemented in HICs (including structured workflows for data collection and analysis). Presently, data collection during outreach activities is predominantly done manually, often on paper or electronic spreadsheets. These methods pose challenges in accessibility, legibility, and retrospective use. Their limitations in effectively utilizing critical patient data for clinical care, guiding staged treatments, and acting as reference points for future surgeons are at the crux of these constraints. Empirically, data gathering before, during, or after missions is uncommon [64,65].

A recent survey involving 22 hand surgeons and outreach administrators revealed that a significant proportion-maintained records of the number of patients assessed (73%) and surgeries conducted (82%). However, the majority did not document crucial metrics such as the proportion of patients requiring reintervention (32% did not record, 23% were unsure), the post-surgery functional status of patients (68% did not record), or patient-reported outcome measures (77% did not record). This presents an opportunity to improve outcomes collection, aligning more closely with the intentions of outreach participants, which primarily involve enhancing patient function, akin to advancements observed in high-income countries (HICs).

Implementation of electronic health record (EHR) systems could offer a structured framework to enhance data collection and tracking rates, addressing this shortfall. This notion is supported by insights from qualitative interviews with surgeons and administrators from the same study, as well as from other sources. Increasingly, businesses are recognizing the paramount importance of utilizing EHR systems to gather data. An illustrative example is the charity organization Operation Smile, which provides surgical care across more than 30 countries. In 2014, they introduced a digitized patient assessment process. During a single mission to Vietnam, this transition enabled them to streamline their workflow by storing data from almost 300 patient evaluations in an EHR [67].

Similarly, another group established the Surgical Services Quality Assessment Database (SQUAD) to collect information from the Mbarara Regional Referral Hospital in Uganda. Nonetheless, the utility of this infrastructure at the point of treatment was limited, primarily serving a retrospective purpose of evaluating surgical priority, perioperative complications, and program development [68,69].

When considering the shift toward global outreach approaches that mirror those of HICs, various organizational and cultural factors warrant attention and consideration. These elements play a crucial role in shaping the transition to care delivery that is aligned with the standards observed in HICs.

Top of Form

(a) Supportive leadership and culture

The effectiveness of implementation hinges on the presence of shared values within organizations and partnerships, coupled with a strong commitment to cultivating a culture centered on measurement, quality, and transparency. Effective leadership is essential in promoting viewpoints that prioritize excellence and involving all relevant stakeholders. The establishment of a culture that fosters both measurement and continuous improvement is vital to ensuring the adoption and utilization of measuring tools by the staff.

(b) The redesign of trip processes

The benefits of data collection through an EHR system become evident during patient care. However, for this to be effective, designated team members authorized to handle detailed data collection and utilization should be responsible for these tasks during outreach missions. Accomplishing this may involve adapting existing workflows to accommodate a reduced number of cases and redistributing responsibilities to ensure that conducted cases are both safely managed and properly documented. The implementation of an EHR system, for instance, should not overly burden staff, but could potentially require task shifting – the delegation of certain responsibilities from more experienced personnel to those with less advanced training.

(c) Collaborating for sustainability

Travel experiences that prioritize bidirectional exchange (both teaching and learning) are driven by specific needs and tailored to the local context. For example, efforts should be directed towards enhancing the capabilities of the local healthcare system to effectively manage prevalent illnesses. The approach to outreach should be centered around the requirements of the community and the learners, taking into account the variations that arise based on location and country. By identifying and addressing local needs, this strategy prevents misunderstandings where local surgeons might perceive HIC surgeons as replacing them, instead fostering an environment for training local surgeons to perform similar procedures safely. In a similar vein, just as certain EHR data elements, such as mortality rates, may remain constant, others that reflect the impact on the local community may change, such as the poverty probability index.

While this review primarily focuses on EHR utilization among outreach practitioners, even greater benefits could be reaped by facilitating collaboration between visiting surgeons and those who are already adept at using an EHR, or alternatively, by implementing a local EHR system.

(d) Results-driven

Surgical procedures conducted on patients in high-income countries (HICs) aim to improve function and alleviate pain. Similar approaches and evaluation methods should be applied to healthcare in low- and middle-income countries (LMICs). Efforts should be driven by objective outcomes that prioritize patients and communities, with a keen focus on long-term effects and the broader implications for patients and communities. These facets of care need to be integrated into the processes of incorporating electronic health records (EHRs), determining aspects like who is responsible for gathering outcomes data and how it is done. The outcomes should provide actionable insights, such as identifying patients who miss follow-up appointments or experience worsening pain. Such attributes enhance sustainability and the development of capacity, thereby fostering trust within both patient and community contexts.

(e) Public reporting

Integrating data into systems with a learning-oriented culture facilitates continuous quality improvement. This not only allows for benchmarking and sharing of best practices but also has the potential to drive initiatives for increased investment, improved quality and safety, and the establishment of international collaborations. Similar to the way public reporting encourages treatment enhancement in high-income countries (HICs), mechanisms for reporting could support the exchange of best practices among surgeons and outreach organizations. While HICs have already incorporated electronic health records (EHRs) into surgical procedures as a routine for patient safety and high-quality care, implementing such measures in low- and middle-income countries (LMICs) presents greater challenges due to factors like financial constraints, time limitations, and security concerns.

Despite these hurdles, we argue that well-implemented EHRs can elevate patient safety and the quality of care provided. They have the potential to more thoroughly review perioperative complications, enhance preoperative optimization and resource utilization, and glean insights to inform subsequent outreach efforts.

4. Concerns on privacy and security of electronic health records

Numerous surveys have highlighted concerns related to the privacy of health information. For instance, Win [65] found that only 39% of respondents believed their health information to be safe and secure, with over two-thirds expressing worries about the privacy of their personal health records. In another study, respondents exhibited both concerns for data security and a lack of confidence in its safety [47]. Perera et al. [54] conducted a survey where half of the participants expressed apprehension about data security, particularly when data is transmitted over the internet. Ancker et al. [9] reported that almost half of their research participants thought that sharing health information might compromise its privacy.

Meanwhile, privacy concerns have been identified as a significant factor influencing the successful development of electronic health records technology. The unique characteristics of Internet of Things (IoT) networks, which distinguish them from other systems, form the foundation of privacy and security concerns associated with IoT. These characteristics include heterogeneity, an unpredictable environment, limited resources, and the need for scalability. Even platforms with minimal processors now possess robust crypto engines and sufficient program memory for implementing essential security functions.

In light of these distinctive features, Lafky & Horan [47] suggest that security requirements for IoT systems can be grouped into the following categories: identity management, network security, resilience and trust, and privacy. The authors assess a range of designs proposed for IoT in the academic community and analyze their compatibility with necessary security measures. Although no single architecture fully addresses all security requirements, careful consideration has been given to several security needs [47], with special emphasis on trust and privacy requirements.

The widely accepted model for information technology security, based on the principles of confidentiality, integrity, and availability (commonly referred to as CIA), has been a consistent framework for evaluating security measures. These three principles have been represented as vertices of a triangle in this model. While the model has evolved over time to include additional primary characteristics, its core elements of CIA have remained constant. It’s important to note that these three characteristics cannot be fully achieved simultaneously, as they are often considered mutually exclusive. For example, enhancing overall availability within the same resource constraints may necessitate compromising accuracy, confidentiality, or both.

Figure 4. Security and privacy in Electron Health record [73].

Figure 4. Security and privacy in Electron Health record [73].

The primary focus of security measures in traditional computer systems has largely been on maintaining overall confidentiality. However, in the case of embedded and Internet of Things (IoT) systems, it could be argued that the other two aspects—integrity and availability—hold even greater significance than in typical office information systems [40]. A noteworthy observation is that variations in approach often negatively impact collaboration between conventional IT systems and control system managers.

Studies have explored the relationship between individuals’ confidence in the confidentiality and security of their medical records and their willingness to engage with electronic health records. For example, Whetstone & Goldsmith [63] found that trust in the confidentiality of medical records positively influenced individuals’ motivation to adopt electronic health records. Conversely, concerns about privacy hindered people’s willingness to share health information online [13]. Anderson & Agarwal [8] discovered that individuals’ willingness to provide access to their health information was negatively affected by concerns about privacy. On the other hand, Dinev et al. [24] observed a limited correlation between attitudes towards electronic health records and concerns about privacy related to health information.

Worries about privacy have been shown to influence patients’ willingness to share medical data in cloud computing approaches [27]. Privacy considerations are also crucial in determining trust when selecting healthcare providers. In fact, studies have highlighted that patients express concerns about health information privacy through various responses, including refusing to provide personal information, fabricating information, requesting data removal, and lodging complaints [46]. Specific medical histories have been found to increase privacy concerns among consumers [56]. Additionally, individuals’ preferences for sharing electronic health information depend on the type of information disclosed [66].

These privacy concerns have significant implications for the development of electronic health records technology. IoT networks possess distinctive characteristics that give rise to privacy and security concerns, such as heterogeneity, unpredictable environments, limited resources, and scalability needs. While even platforms with minimal processors now include advanced crypto engines and sufficient program memory for security functions, these characteristics necessitate careful categorization of security requirements into identity management, network security, resilience, trust, and privacy for IoT systems [47]. While no single architecture fully addresses all security demands, thorough analysis demonstrates that several security needs are being adequately considered [47].

The notion of a widely accepted information technology security model, often abbreviated as CIA (Confidentiality, Integrity, and Availability), has persisted over time. These three characteristics have been visualized as vertices of a triangle, and while the model has evolved with additional primary characteristics, the core elements of CIA remain fundamental. It’s important to note that achieving all three characteristics simultaneously can be challenging due to their potential trade-offs.

6.1. Security and privacy features of current EHR systems

Several studies have examined security measures through the lenses of three primary safeguard categories: physical, technical, and administrative security. These categories encompass various security strategies employed by healthcare organizations to enhance the protection of sensitive health information contained within electronic health records.

The first area of focus is administrative safeguards, which involve practices like conducting audits, designating an information security officer, and establishing contingency plans [64]. This category emphasizes the adoption of compliant security practices and guidelines. The second category, physical safeguards, aims to physically secure health information to prevent unauthorized access to hardware or software. It encompasses the organizational protective measures mentioned earlier [64]. Notably, breaches in physical security are a significant contributor to security breaches overall, ranking second [49]. Assigning specific security responsibilities exemplifies a physical safeguarding approach [48].

The third category, known as technical safeguards, revolves around safeguarding the entire information system within a healthcare organization’s network [49]. The critical role of this aspect in maintaining overall organizational security is underscored by the fact that a majority of security breaches involve computers and portable electronic devices [49]. This category encompasses security measures such as firewalls, encryption, virus scanning, and methods for information authentication [74]. Among these measures, firewalls and cryptography were identified as the most commonly used security methods. However, their implementation is often influenced by budget constraints. Other significant security measures include antivirus software, Chief Information Security Officers, and cloud computing [29]. Research by Liu et al. [75] revealed that firewalls and encryption serve as technical safeguards against electronic breaches, while physical safeguards, such as physical access control, prevent theft through mechanisms like locks on computers. Similarly, Amer’s study [76] on the ethical use of electronic health records and genomic data indicated that while administrative safeguards de-identified samples or research, encryption provided technical protection. Technical safeguards involve elements like firewalls, encryption, and decryption, while administrative safeguards are achieved through education and security plans, Chief Information Security Officer roles, and thorough training [76].

Wikina [77] pointed out that physical safeguards encompass security camera installation, while administrative safeguards entail managerial authorization for the release of paper-based patient data and training on lost document handling. With advancing technology, healthcare institutions are becoming increasingly susceptible to security breaches. Organizations like the Clinical Engineering Information Technology Community, the American College of Clinical Engineering, and the Healthcare Information and Management Systems Society recognize the importance of risk management and staying abreast of technological advancements and threats. These organizations, alongside the risk assessment and management phases, ensure healthcare institutions are at the forefront of patient information protection within electronic health records.

The adoption of RFID (Radio-Frequency Identification) technology is gaining traction within healthcare organizations for enhanced security and privacy. This technology involves data storage within RFID tags and the establishment of access restrictions, thereby limiting data access to authorized personnel. Employing a Chief Information Security Officer can aid in overseeing and coordinating security methods and initiatives for electronic medical records [78]. Among the technologies used to safeguard healthcare IT systems, Firefox is notable. Firefox effectively shields a company’s network and ensures the security of networks containing patient information. Its application spans both internal and external contexts, safeguarding the company’s information network from potential threats. These technologies come in diverse forms, each playing a role in fortifying information security.

The third category of firewalls is known as a level gateway. These firewalls act as gatekeepers for an organization’s network by inspecting IP web pages for threats before delivering them to end users. They facilitate external network connections for status inspection firewalls and prevent external networks from entering the organization’s intranet. This approach has effectively protected electronic health records by creating barriers that deter hackers from direct access to the system and private health data. However, implementing this type of firewall is challenging due to its complexity and high costs. Therefore, a comprehensive assessment of the organization’s internal and external factors is essential to determine the practicality and suitability of using this firewall.

The network address translator is the final group of firewalls. It conceals the intranet IP addresses of the organization, preventing external users from accessing them and potentially causing harm. This firewall configuration separates the organization’s intranet and local area networks. While firewalls significantly contribute to the security of electronic health records, it’s important to employ all four security methods: service control, direction control, user control, and behavior control, in that sequence. Prior to implementing any firewall type, organizations should conduct thorough needs, budget, and threat analyses both internally and externally. Neglecting these evaluations or the four security strategies could jeopardize the security of patients’ electronic health records and the organization’s overall information system.

The use of cryptography has successfully protected electronic health records, enhancing the security of health information transmission. Encryption has contributed to the secure exchange of health information, adhering to established guidelines for recording encryption activation or deactivation during data exchange. Encryption is supported by the Health Insurance Portability and Accountability Act (HIPAA), which expanded its security requirements through the 2003 Concluding Rule [58]. The Concluding Rule broadened HIPAA’s scope to encompass the creation, reception, storage, and transmission of protected health information (PHI). Decryption has been instrumental in ensuring patient electronic health records’ security. Digital signatures have addressed the issue of compromised protected health records during patient access, effectively mitigating security breaches.

Implementing controls through username and password security methods is advantageous. Role-based restrictions limit data access for users through system administrators’ assigned usernames and passwords. However, this approach may not fully safeguard electronic health record data from internal threats, necessitating proper logging out after system use. Other commonly utilized security techniques include antivirus software, cloud computing, preliminary risk assessment sequencers, Chief Information Security Officer hiring, and radio frequency identification (RFID). Remote patient monitoring (RPM) is another innovative tool employed to secure data confidentiality and integrity in electronic health records. This approach uses various sensors to monitor patients’ vital signs remotely, alerting healthcare professionals when deviations from normal limits occur. Diabetes, congestive heart failure, and dementia are conditions well-suited for remote patient monitoring. The introduction of new technologies, despite legal frameworks like HIPAA, raises privacy concerns and presents breakthroughs in healthcare.

With the increasing use of technology, extensive research has explored the integration of cloud computing into EHR systems. Cloud computing allows organizations to rent storage space and computing power, as well as share information electronically. This approach reduces ownership and maintenance costs while integrating cryptographic protocols into EHR systems. However, antivirus software remains a more commonly employed security solution. Achampong [1] also highlights concerns related to storing medical records on remote servers operated by independent cloud service providers [35]. The 2009 HITECH Act emphasized mandatory reporting of data breaches and specified protocols for such incidents. It requires entities to provide specific information in case of data breaches affecting more than 500 individuals. [64] Under the HITECH Act, Centers for Medicare and Medicaid Services (CMS) beneficiaries were required to use EHRs by 2015 to qualify for full reimbursements. The Office of the National Coordinator (ONC) established three "meaningful use" phases for EHR utilization by healthcare organizations. Meaningful use evaluates the effective utilization of EHRs compared to older documentation methods [49]. Health care providers using Health Information Technology (HIT) must establish a robust security system due to ongoing IT-related security concerns. This system comprises security controls aligned with a security policy, which includes regulations governing security-related behaviors [12]. An information technology security strategy ensures the confidentiality, integrity, and availability of an organization’s IT assets, including data, hardware, software, and personnel, in compliance with established requirements [54].

5. Three decades of bibliometric research productivity analysis

The process of digitalization or digital transformation has been ongoing in various regions and countries, even amid the global economic downturn and financial crisis. This transformation, driven by factors like growing digital demands, evolving technologies like Information and Communication Technology (ICT), and the pressures from the so-called IRV4, has significantly impacted industries, including healthcare. Over the past thirty years, the healthcare sector has experienced a digital revolution that has reshaped many aspects of healthcare delivery systems. This transformation has aimed to enhance healthcare outcomes and practices, optimize resource utilization, and increase patient satisfaction. The recent COVID-19 pandemic has further emphasized the need for digitization in modern healthcare, challenging leaders in digital transformation to find solutions that adhere to health mandates, accommodate remote interactions, and meet heightened healthcare demands.

EHR and EMR adoption is often considered the initial step in the broader digital transformation of healthcare. While numerous success stories have highlighted improved outcomes through EHR deployment, challenges and limitations, such as the digital divide, have also been recognized. The adoption of EHRs has gone through various stages over the past two decades, with adoption rates gradually increasing. In the United States, for example, recent surveys indicate an adoption rate of 88%. However, achieving successful EHR adoption necessitates coordinated and integrated efforts due to the complexity of the process. This complexity is reflected in the American healthcare system’s Meaningful Use (MU) project.

The impact of MU-driven EHR adoption on healthcare performance metrics, including quality of care, patient safety, and satisfaction, has been well-documented in the literature. Different nations, including Saudi Arabia, India, Australia, Europe, and Arab and African countries, have shared their experiences and findings on this journey. The dedication of stakeholders, including governments and healthcare providers, has played a unifying role in these outcomes. However, challenges such as resistance to change and lack of support from healthcare and governmental bodies have also been noted.

The integration of EHRs with advanced technologies like blockchain, cloud computing, big data, mobile health apps, AI, and IoT has been extensively explored in literature. Comprehensive reviews of literature have also examined various aspects of EHR systems, underscoring their diversity and expansion. These evaluations have addressed specific issues like adoption barriers, perceptions, and utilization across different healthcare specializations.

In light of both specific and broader concerns surrounding EHRs, this study aims to uncover patterns and gaps in research from the last three decades. The rest of this article presents the organized findings of the study, analyzing the existing literature on EHRs and engaging in an in-depth discussion of these findings. Additionally, the article offers suggestions for further research in this field.

6.0. Conclusion and future work

This study focuses on the security and privacy aspects of electronic health record (EHR) systems. The research delves into numerous security and privacy concerns associated with the utilization of EHRs and explores potential solutions. EHRs have proven to be a useful tool in facilitating the sharing of medical data among healthcare professionals, ultimately enhancing the quality of patient care. The adoption of EHRs encourages a broader perspective on health and fosters collaboration among healthcare providers. EHRs allow for the seamless exchange of patient information, ensuring accessibility and updates throughout the course of treatment.

However, the convenience of EHRs also raises critical privacy and security concerns. The potential for unauthorized access to sensitive patient information becomes more significant, leading to potential breaches if private data falls into the hands of third parties. The study reveals that a variety of rules and requirements are in place to address privacy and security concerns related to EHR use. However, there is a need for harmonization among these standards to resolve potential discrepancies.

Numerous organizations have proposed various encryption techniques to enhance the security of EHRs. The implementation of effective encryption methods is strongly recommended to ensure the protection of both patient and medical professional data. Access control is a vital consideration in EHR systems, with Role-Based Access Control (RBAC) being the preferred control paradigm. Authentication methods, such as passwords, logins, and electronic signatures, play a pivotal role in managing EHRs. The effective management of EHRs requires a multidisciplinary approach involving technology, computer science, and communications to facilitate the secure exchange of medical information across wide geographical areas.