Health Service Executive
(HSE)
EHR – Electronic Health Records
Contents
Introduction……………………………………………….3
Introduction to the organisation……………………………………3
EHR – Electronic Health Records……………………………………4
Review of current organisation/sector………………………………..4
Vision/ Goals of Organisation……………………………………..5
EHR – a pillar of eHealth Strategy…………………………………..5
Key components of the EHR………………………………………6
ICT within healthcare reform……………………………………..7
IT structure and approach to IT (estimate)………………………………7
PESTEL…………………………………………………..8
SWOT Analysis………………………………………………9
Stakeholder Analysis…………………………………………..9
The key stakeholders are:……………………………………….9
Risks…………………………………………………..10
The below key risks have been identified, with the risk to data security being the main one…10
Risk Review /mitigation / controls / effectiveness of controls ………………….12
References……………………………………………….18
Appendixes……………………………………………….20
a)E-Health org structure……………………………………….20
Information Management Systems (IMS) offer many advantages and opportunities if they are set up properly and managed and controlled effectively and are supporting an organization’s work. The scope of the IMS is determined by the needs and expectations of the stakeholders.
As laid out in detail on their website http://www.ehealthireland.ie/, the HSE’s new e-health strategy includes the setup of an IMS of Electronic Health Records (EHR) nationwide i.e. for the whole of Ireland.
Availability of personal data, in this case patient health records, offers a lot of benefits but at the same time puts the security of this data at risk. The bigger the volume of data and the higher the number of people accessing the personal data of individual patients, the higher the risk to data security and the exposure to external threats. Increased benefits for patient healthcare, socio-economic benefits and new opportunities go hand in hand with increased risks and vulnerability of the system.
An IMS of that scale i.e. on the national level, creates a challenge for Information Management System Security (IMSS) and IT. It requires an architecture that champions data security and compliance with GDPR.
Such a system requires buy in from management, stakeholders and staff as well as expert solution architects and substantial, continuous government funding during the length of the project.
As the HSE is a public service organization, compromised data and data leaks will result at least in loss of faith in the EHR IMS amongst the public and potentially also in a loss of trust in any medical evaluations and treatment programs designed which are based on electronic patient records. In the worst case scenario compromised health records can result in loss of life.
Therefore, data security is the most important concern which if compromised will destroy the public’s trust in the HSE and its new e-Health strategy irreparably and will jeopardize the vital buy-in from management and stakeholders.
According to a research study commissioned by McAfee (Samani, 2016) patient records are a most wanted commodity in the dark web and the EHR IMS will need to prevent and address such external threats if it is to succeed in supporting the organization’s work.
This paper will discuss benefits, opportunities and the cost associated with EHR as well as the risks which will, if not controlled, cancel out any possible benefits and advantages. It is this aspect of looking into benefits and gains versus high risk to data security that makes the EHR so interesting from an IT perspective.
As the general public / patients are amongst the stakeholders the HSE’s eHealth initiative should be of concern and interest to everyone.
The HSE is responsible for providing all public health services in Ireland in hospitals as well as local communities throughout Ireland.
Goals of the HSE:
Providing health services as well as social care services all over Ireland
Deliver the best health services and medical care to everyone in the country
Ensuring access for everyone in Ireland to save and quality care
In response to advances in technology and increased internet usage as well as demographic and other factors, changes in healthcare are required urgently to support the goals set by the HSE.
A new strategy for the healthcare sector is required to address these changes and also to meet the challenge set by the EU’s task force report “European Union eHealth Action Plan 2012-2020”(2012). The aim of this study and EU strategy is to provide access to high level healthcare for all European citizens.
Part of the organisation’s new strategy is eHealth, with the EHR (Electronic Health Record) initiative at its core. Patient records will be available online for all medical professionals in order to increase efficiency of the healthcare delivery systems as well as to drive economic growth and development by providing better care for the individual patient.
In the centre of the new healthcare delivery system is the patient and the patient will be empowered to pursue their health and wellbeing and the provision of the healthcare services.
What is eHealth (Electronic Health)? It demands the integration of all the information and sources of information which are involved with the delivery of healthcare through technology Information Management Systems.
Amongst others, this includes patients and their health records as part of a digital supply chain which involves a high level of automation as well as the sharing of information.
Organisation Structure
The HSE employs over 100,000 people, whose job it is to run all of the public health services on a national level in Ireland. As patients are at the centre of this organization, the HSE manages its services through a structure that is designed to support that. An overview of the principles, policies, procedures and guidelines can be found in the HSE Code of Governance.
It’s by these Policies and Guidelines that the HSE directs and controls its functions and oversees its business. This code is meant to guide the Directorate, leadership groups/teams and everybody else working with the HSE as well as the agencies funded by the HSE, in doing their duties to the greatest standards of responsibility, integrity and propriety.
Representatives from city and county councils are organized respectively in four Regional Health Forums. The below org chart (Figure 1) which can be found on the HSE website (https://www.hse.ie/eng/about/who/) gives a more detailed insight into the HSE structure.
Figure 1 – HSE org chart – https://www.hse.ie/eng/about/who/ – last accessed 23-12-2018
Strategy of Organization
Introduction of a national EHR (Electronic Health Records) system / IMS (Information Management System)
This is part of the Integrated Services Framework (ISF) to bring standardization to the HSE’s specialised, application and information architectures. This is also part of the e-Health strategy for Ireland.The access to high quality, accurate and timely information is essential to efficient medical staff and patient relationships resulting in improved results.
EHR – a pillar of eHealth Strategy
The production and sharing of crucial patient data lie at the center of the national EHR solution. This alternative will unite core operational options (with functions like ePrescribing and Case Management), in addition to the aggregation of information from such systems into a comprehensive nationwide document, which is available to health and healthcare professionals, service users and carers. The availability and accessibility of patient information across the various organizations with the remit of the HSE – this opportunity will be offered by the EHR system as one of the pillars of the eHealth strategy.
The programme is currently focused on the design of the overall implementation strategy and roadmap that:
Combines pragmatic use of existing systems
Meets Special needs like the Introduction of the Children’s Hospital Group as a ‘Electronic/digital hospital’ at 2019
Supports HSE reform’s broader objectives
Extends the capability offered across care settings and organisations in A phased strategy.
This design stage will require extensive consultation with clinical, administrative, managerial and technical stakeholders to make sure the layout is directed by the requirements of those groups with the required support to guarantee success in future installation. This is a complicated and large transformation programme, requiring a substantial investment within 10 – 15 decades.
As outlined in the National Business Case (9), the below 4 key components constitute the National EHR for Ireland:
Community Operational Systems
Acute Operational Systems
Integration Capability
Benefits of EHR
There are a number of potential benefits of a national EHR IMS. Amongst these are increased patient safety and high quality of care, lower risk of error in diagnostics and treatments as well more efficient administration and socio-economic benefits. This valuable knowledge database based on the collection of data facilitates advanced medical knowledge and so much better management of disease and healthcare planning.
Figure 2 – EHR benefitshttp://www.ehealthireland.ie/Strategic-Programmes/Electronic-Health-Record-EHR-/
Background
The HSE has experienced serious issues in the past with for example long waiting lists for medical care by patients and increased costs (, EHR-Vision-and-Direction)
According to a recent article in the Irish Times (https://www.irishtimes.com/news/ireland/irish-news/rcpi-calls-for-implementation-of-electronic-health-records-1.3504892), the Royal College of Physicians of Ireland (RCPI) has supported the call for the full implementation of electronic patient records, stating such a move would help to protect patient privacy. Data privacy has and still is an issue as patient records exist in paper format, are at times exposed to staff who have no need to access these.
Future delivery of health care
A new thing called “eHealth Ireland” will be created, originally in an administrative basis inside the System Reform Group (SRG) of the HSE. The Chief Information Officer (CIO) who will work closely with each one the major business organisations within the healthcare, so as to push the eHealth strategy and make sure that key IT systems have been implemented on time and to budget.
A new IT strategy for the health system as by state and government Health Information and Quality Authority (HIQA) a including financing, legal agencies like the Health Services Executive ICT Directorate and SRG, the Empowering, public awareness, stakeholder participation and construction the eHealth Ecosystem.
Figure 3 – national EHR system – http://www.ehealthireland.ie/Strategic-Programmes/Electronic-Health-Record-EHR-/
A national Electronic Health Record (EHR) has been identified by HSE while technology solutions are a key component, the national EHR programme represents a substantial transformation in the use National Directors and clinical leaders as a key component requirement for the future delivery of healthcare. There’ll be a main focus on the way clinicians and administrative personnel utilise this technology in a manner that closely aligns with and underpins the ambition for Integrated care and other national healthcare reform priorities.
Get Help With Your Essay
If you need assistance with writing your essay, our professional essay writing service is here to help!
Essay Writing Service
ICT within healthcare reform
ICT is going to be an element in healthcare reform. Ireland is put within an ambitious journey at the reform of health care in recognition of their need to radically alter health provision to meet with the challenge of providing sustainable high excellent care for the whole population. Knowledge and information are a core strength of the health systems and the development and application of the advantage in an efficient manner is vital to improving performance throughout the system. The capacity to document and discuss crucial information on individuals’ and service users’ interaction across businesses and care settings is an integral part of eHealth and provides advantages for individuals, service users, carers, health and social care professionals and broader stakeholders from the healthcare. The programme intends to exploit the capacity of ICT to become consistent in our delivery of better, safer and more, personalised care.
IT resources
IT Manager, Technical and Solution Architects, IT Project Manager, IT engineers
3rd party software development / implementation vendors (vetting in progress)
Facilities
Hospitals, starting with the National Children’s Hospital
Equipment
Smartphones
Laptops
Tablets
Budget
The HSE / EHR is dependent on government funding and budgets will be allocated as below over the next couple of years:
The Minister for Health has vowed to bring proposals to government in coming months about how to move this program forward and it’s planned that the first hospital setting to get an electronic health record (EHR) will be the New Children’s Hospital in Dublin.
The Government will spend $60 million on health IT at 2018, $70 million in 2019, $85 million in 2020, $87 million in 2021.
The Government Intends to spend $55 million on health Services Information and communications technology (ICT) in this year and next year The HSE recently filed a business case for a national EHR for Ireland, which can offer for a digital platform round the acute, community and primary care places, allowing the connectivity required to support models of integrated care, €412 million will be spent over six years.
Definition: A PESTEL, PEST or PESTLE analysis is a framework or tool used to analyze and monitor the macro-environmental factors that have an impact on an organization. The result of which is used to identify threats and weaknesses which is used in a SWOT analysis.
PESTEL Analysis
Political
Economical
Social
Technological
Environmental
Legal
Government funding
EU
Services from 3rd party vendors
general public, medical staff, HSE admin staff
ever changing technology
external factors such as natural disaster
GDPR*
ROI
IT expertise
system architecture
digitalization, broadband
*GDPR: “General Data Protection Regulation 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA areas.” (https://www.dataprotection.ie/en)
Definition: SWOT analysis is a strategic planning technique used to help an organization identify strengths, weaknesses, opportunities, and threats related to project planning.
SWOT
Strenghts
Weaknesses
Opportunities
Threats
qualified and experienced healthcare admin staff & medical professionals (GPs etc.)
dependency on government funding
co-operation with other departments/organizations for better services
rapidly changing technology
nationwide network
no such system exists yet
new funding initiatives for improved IT infrastructure
budget deficits
extra ordinary IT infrastructure
delays in implementing system fully
efficient training and educational programs for staff & medical professionals
un-necessary political intervention
efficient & fast service e.g. access to patient health records
delayed ROI
initiatives for better management
data security leaks
improved treatment/ health of patients
Dependency on 3rd party vendors
economic opportunity through the use of technology enabled solutions
data integrity issues
Office of the Chief Information Officer (IT etc.)
General public (patients)
Medical Professionals (Hospitals, GPs, Ambulances etc.)
Admin / Clerical
Department of Health / Minister of Health
PR / Head of PR & marketing
Confidentiality
Information security breach
Integrity
Incorrect and /or missing data / data quality issue
Availability
Project delays / system not ready when needed
External & functional threats resulting in loss of data/ unavailability of data
Insufficient architecture
Loss / disruption of funding
Lack of competence of 3rd party vendors
Risk / Effect review
Confidentiality
Cause: Information security breach
There is a high demand for medical records on the black market as they are more valuable than financial records. Electronic health records can sell for as much as €40, compared to just €1 for credit cards in the dark web. Medical records are more valuable because their theft is harder to detect and more difficult to resolve and medical history cannot be cancelled.
Effects:
Individual patient data is available to others – GDPR violation by the organization (legal) as well as identity theft (criminal); loss of reputation of organization as well as possibly loss of funding
Integrity – Data Quality Issue
Cause: Human error due to unskilled resources/sabotage; lack of buy-in; due to external hacking
Effects:
Results in potentially wrong medication/treatment of patients caused by compromised data Blackmail/ phishing attempts threatening data integrity
Availability – external threats
Effects:
• Loss of data; data not accessible when needed affects patient care / service provision
• System failure
• IT architecture issues i.e. IT not delivering expected outcome
• Technology not up to date; technical vulnerability
• Planning, delay of implementation i.e. system not available when needed = financial impact
• Loss or disruption of funding & ROI issues
To ensure risks are reviewed, controlled and measured on a regular basis it is essential to create and maintain a risk register.
A risk register should state the risk, the controls in place and the measuring of the effectiveness of these controls.
Management support and buy-in are essential in managing risks and controls / improvements as lack of support filters down to other stakeholders and negatively affects the whole IMS implementation and maintenance process.
Please find the three main risks plus controls and how the effectiveness of these is measured below:
Confidentiality – Information security breach
Risk Mitigation: Set up a system of user access controls
Data security education of users
Set up system of controls
Create access control policy
Circulate access control policy amongst all users as compulsory reading
Raise awareness regarding unauthorized access requests, e.g. Phishing emails
Measuring of effectiveness of controls
Send fake phishing emails to see who clicks on the links
Get all users to docu sign the access policy and certify awareness
Visual inspection – check for exposed / written passwords
Implementation of user access control system
Set up system of controls
Register IP addresses and associated passwords to check if a different IP address is used
Password encryption – minimum of 2 passwords
Requirement to change passwords once a week
Privacy screens on laptops & monitors
Limited network access on a per need basis which is password restricted
Technology always up to date to prevent vulnerability i.e. unauthorized external access
Sophisticated / best of anti-virus software / malware protection in use
Measuring of effectiveness of controls
Run log file to check passwords used against IP addresses
Visual inspection at facilities – check hardware in use for privacy screens
Engage professional hacker to test vulnerability of system / network and performance of malware protection when simulating a zero day attack
Send regular updates to users of the latest security threats and how to avoid them
Continuous improvement
Learn from any security breaches and constantly review and adjust controls
Integrity – Integrity Issue
Set up system of controls:
Staff competency – training of users entering and managing data on system use
Create quality and security objectives (management) and circulate tom raise awareness
Ensure buy in of staff to provide high quality of data into the system
Completeness of data / timeliness of data in system – funding to be secured
Planning for contingencies timewise
Management buy in
Enough resources no overworked staff etc
Raise awareness regarding unauthorized access requests, e.g. Phishing emails
Raise awareness of blackmail to corrupt data
Measuring effectiveness:
Send fake phishing emails to see who clicks on the links
Quarterly financial reports (P&L)
Status reports (weekly) to check if project implementation milestones are being met
QA data entered to ensure quality & integrity of data
Send regular updates to users of the latest security threats to data integrity and how to avoid them
Continuous improvement:
Retrain users, run refresher sessions of training
Update / improve training documentation
Availability – external threats
Set up system of controls:
• Monitor project milestones
• Manage & monitor financials
Facility inspections / test – check for vulnerabilities to environmental threats such as flooding, defect facility equipment, fire hazards physical e.g. water damage
Create emergency response plan & engage all necessary stakeholders to ensure awareness
Ensure systems are fully functioning
Manage Hardware functionality & to ensure latest OS appliance and performance
Trigger regular OS updates to ensure latest security protection patches & upgrades are applied
Implement sophisticated malware protection system
Effectiveness of resolution
Run log files to identify users that haven’t installed latest updates
Simulate an emergency and test emergency contingency plan effectiveness e.g. fire drill
Test system functionality and run performance reports to be aware of any deviations that could indicate an upcoming malfunctioning
Keep inventory of hardware and users assigned to as well as life time of hardware devices
Install intrust detection systems
Password policy in place
Install VPN systems, encrypt Wi-Fi and general hospital traffic and use firewall technology where needed.
Continuous improvement
Simulate different scenarios of emergency and try to increase response time
Constantly compare malware protection options available to ensure you have the best one
All three categories have an impact on the overall success of the IMS EHR system. Effectiveness results in cost reduction, better health care and patient satisfaction as well as a sophisticated IT infrastructure and expert resources.
Summary
If risks are properly managed the EHR offers immense opportunities to digitalize and improve the Irish National healthcare system in a sustainable way. The scale of the project is a concern and a huge challenge for Solution Architects and IT but as well as HSE management and key stakeholders but even if challenges occurr improvement from the current decentralized system will be achieved.
1) https://www.hse.ie
2) https://www.hse.ie/eng/about/who/
3) Samani, Raj (2016) Health Warning Report, https://www.mcafee.com/enterprise/en-us/assets/reports/rp-health-warning.pdf
4) http://www.ehealthireland.ie/Strategic-Programmes/Electronic-Health-Record-EHR-/
5) http://www.ehealthireland.ie/Knowledge-Information-Plan/eHealth-Strategy-for-Ireland.pdf
6) Carroll, Aine and Corbridge, Richard (2015) National Health Record – Vision and Direction.
http://www.ehealthireland.ie/Library/Document-Library/EHR-Vision-and-Direction.pdf
7) https://www.imt.ie/
8) https://www.imt.ie/news/e412-million-it-spend-due-by-2022-14-12-2016/
9) https://www.hse.ie/eng/services/publications/pp/ict/access-control-policy.pdf
10) https://www.dataprotection.ie/en
11) eHealth Action Plan 2012-2020: Innovative Healthcare for the 21st Century. European Commission 2012, Com (2012)
Carroll, Áine and Corbridge, Richard, (2016), National Electronic Health Record – Strategic Business Needs
1) Caselet-1-Risk-Identification_res_Eng_0415
2) Caselet-2-Risk-Assessment_res_Eng_0415
3) Caselet-3-Risk-Response-and-Mitigation_res_Eng_0415
4) Caselet-4-Risk-and-Control-Monitoring-and-Reporting_res_Eng_0415
Figure 4 – (Carroll & Corbridge 2015)
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Contact Essay is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Essay Writing Service Works
First, you will need to complete an order form. It's not difficult but, in case there is anything you find not to be clear, you may always call us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download