The Kingdom of Saudi Arabia is focused on expanding use of biometric technologies
and it is a matter of time before this expansion includes medical institutions. However
there is a lack of research on Electronic Health Records (EHRs) in Saudi Arabian
hospitals, especially on the staff views and attitudes in relation to confidentiality,
privacy, and security policies in the context of Saudi society, which is governed largely
by culture and Islam. This research utilised an online survey tool to ask doctors,
managers, and IT professionals, at the King Fahad Specialist Hospital (KFSH) about
these aspects and explored if they recommend the classic non-biometric access method
over the rather intrusive, yet more advanced, biometric patient identification (BPI)
technology. Encouragingly, all the participants recommended BPI methods with the
least favoured method being the facial recognition method for Saudi female patients.
This study also focused on whether staff believed that religious and cultural issues
influence EHR privacy and confidentiality, as the literature showed that in certain cases
unauthorised revelation of an EHR could lead to honorary killing of the patient.
Implications of this research include the need for comprehensive staff training on being
culturally aware, as well as training on EHR security policy, privacy, and
confidentiality

Khwaji, Adel Abdulrahman

English

Massey Research Online

Copyright is owned by the Author of the thesis.  Permission is given for a copy to be downloaded by an individual for the purpose of research and private study only.  The thesis may not be reproduced elsewhere without the permission of the Author.       EHRs at King Fahad Specialist Hospital: An overview of professionals’ perspectives on the use of biometric patient identification for privacy and confidentiality, taking into consideration culture and religion   A thesis presented in partial fulfilment of the requirements of the degree of Master in information science Massey University Albany, Auckland New Zealand        Adel Abdulrahman Khwaji © A. A. KHWAJI, 2016  ii  Abstract  The Kingdom of Saudi Arabia is focused on expanding use of biometric technologies and it is a matter of time before this expansion includes medical institutions. However there is a lack of research on Electronic Health Records (EHRs) in Saudi Arabian hospitals, especially on the staff views and attitudes in relation to confidentiality, privacy, and security policies in the context of Saudi society, which is governed largely by culture and Islam.  This research utilised an online survey tool to ask doctors, managers, and IT professionals, at the King Fahad Specialist Hospital (KFSH) about these aspects and explored if they recommend the classic non-biometric access method over the rather intrusive, yet more advanced, biometric patient identification (BPI) technology.  Encouragingly, all the participants recommended BPI methods with the least favoured method being the facial recognition method for Saudi female patients. This study also focused on whether staff believed that religious and cultural issues influence EHR privacy and confidentiality, as the literature showed that in certain cases unauthorised revelation of an EHR could lead to honorary killing of the patient. Implications of this research include the need for comprehensive staff training on being culturally aware, as well as training on EHR security policy, privacy, and confidentiality.      iii  Acknowledgments  I would like to acknowledge and thank my supervisor Dr. Brian Whitworth who assisted me with defining the research problem. He later retired before the completion of the research.  I take this opportunity to express my profound gratitude and deep regards to Dr. Kuda Dube for his exemplary guidance, monitoring, and constant encouragement from the time my supervisor retired until the end of this research. I would also like to take this opportunity to express a deep sense of gratitude to my brothers Yahya Khawaji, Mohammed Khawaji, Bassam Jawad, Zeiad Masfar and Abdulrahim AlGhamdi for their cordial support, valuable information, and guidance, which helped me in completing this task through various stages. Lastly, I thank my father Abdulrahman Khawaji, my mother Maryam Khawaji, brothers, sisters, and friends for their constant encouragement without which this project would not be possible.        iv  Table of Contents Abstract ........................................................................................................................ ii Acknowledgments ....................................................................................................... iii Table of Contents ......................................................................................................... iv List of Tables ............................................................................................................... vi List of Figures .............................................................................................................. vi Abbreviations ............................................................................................................ viii Introduction .................................................................................................................. 1 Research problem ......................................................................................................... 4 2.1 Key Concepts ............................................................................................. 4 2.2 Research Problem ....................................................................................... 6 2.3 Research Aim ............................................................................................. 7 2.4 Research Objectives ................................................................................... 8 2.5 Significance of the Research Problem ......................................................... 8 2.6 Expected Research Contributions ............................................................... 9 2.7 Summary .................................................................................................. 10 Literature Review ....................................................................................................... 12 3.1 Electronic Health Records ........................................................................ 12 3.2 The Benefits of EHRs ............................................................................... 13 3.3 Limitation to EHRs ................................................................................... 14 3.4 Background of EHRs in Saudi Arabia ....................................................... 15 3.5 EHRs: Confidentiality and Privacy ........................................................... 16 3.5.1   EHR Confidentiality and Privacy in Saudi Arabia. .................................... 18 3.6 EHR Security Policy ................................................................................. 21 3.7 Methods of Accessing EHRs .................................................................... 22 3.7.1 Biometrics ................................................................................................... 22 3.7.2 Different BPI techniques ............................................................................. 30 3.7.3 Non-Biometrics ........................................................................................... 37 3.8 Review of the Research Questions Based on Findings of the Literature Review 38 3.9 Summary and Findings of Literature Review ............................................ 40 Methodology............................................................................................................... 41 4.1 The Research Design ................................................................................ 41 4.1.1 Survey Participants ..................................................................................... 42 v  4.1.2 Data Collection ........................................................................................... 43 4.1.3 Survey Structure.......................................................................................... 45 4.2 Sampling Method ..................................................................................... 46 4.2.1 Sample Size ........................................................................................... 47 4.3 Data Analysis ........................................................................................... 49 4.4 Ethical Considerations .............................................................................. 49 4.5 Summary .................................................................................................. 50 Results ........................................................................................................... 51 5.1 Validity of Results .................................................................................... 51 5.2 Survey Results .......................................................................................... 52 5.2.1 Participants’ Backgrounds at KFSH (Section A) ......................................... 52 5.2.2 EHR Current Access Patterns at KFSH (Section B) ..................................... 55 5.2.3 Existing access control mechanism at KFSH (Section C) ............................ 57 5.2.4 Views/ Recommendations on Biometric Access Control (Section D)........... 60 5.2.5 Staff views on risks of EHR Security and Privacy Breaches and policies in the KFSH (Section E). ............................................................................................... 66 5.2.6 Perception of Staff on the Impact of Religion and Culture on privacy and confidentiality of EHRs (Section F). .................................................................... 71 5.3 Summary of Chapter ................................................................................. 76 Findings and Discussion ............................................................................................. 77 6.1 The Background of the Cohort .................................................................. 77 6.2 The Perception of EHR Security Among the Respondents in KFSH ......... 78 6.3 Staff Awareness on Data Access Technologies and Policies ..................... 80 6.4 Security Concerns and Staff Confidence on the New Technology ............. 81 6.5 The Impact of Saudi Culture and Religion on Biometrics .......................... 82 6.6 EHR Policy .............................................................................................. 85 6.7 Unauthorised Revelation of EHRs ............................................................ 86 6.8 The Impact of Culture and Religion on EHR Privacy and Confidentiality . 87 6.9 Recommendations .................................................................................... 89 Conclusion, implications and limitations ..................................................................... 90 References .................................................................................................................. 97 Appendix A: Covering letter and questionnaire ......................................................... 104 Appendix B: Ethics approaval received from MUHEC.............................................. 116  vi  List of Tables Table 1 Reason for selection ...................................................................................................43 Table 2 Number of each stratum .............................................................................................48 Table 3 Calculation of the required sample size .......................................................................49 Table 4 Number respondents and sample size .........................................................................51 List of Figures Figure 1 Biometric facial recognition technique (All internet security, 2015). ............. 30 Figure 2 Biometric iris scanning technique (Le & Jain, 2009). .................................... 31 Figure 3 Finger on sensor device, a scanner (RightPatient, 2015) ................................ 32 Figure 4 Fingerprinting: spoofing versus real (Rowe, 2005). ....................................... 34 Figure 5 Hand palm vein scanning technique (Ruiz-Blondet, 2014). ........................... 35 Figure 6 Proximity card (Ultra Electronics, 2015). ...................................................... 37 Figure 7 Survey structure ............................................................................................ 45 Figure 8 Different professionals at KFSH (Q A1)........................................................ 53 Figure 9 Number of Saudi and non-Saudi participants (Q A2). .................................... 53 Figure 10 Length of service/ work experience of participating staff in health care (Q A3). ............................................................................................................................ 54 Figure 11 Experiencing using EHRs of KFSH staff (Q A4). ........................................ 54 Figure 12 Level of access of different staff to EHRs (QB2). ........................................ 56 Figure 13 Overall access to EHRs (QB2). ................................................................... 56 Figure 14 Reason for accessing EHRs by different staff members (Q B3). .................. 57 Figure 15  Method used to access EHRs at KFSH (QC1). ........................................... 58 Figure 16 Biometric techniques at KFSH (Q C2). ....................................................... 59 Figure 17 Non-biometric techniques used at KFSH (Q C3). ........................................ 59 Figure 18 Opinion on whether BPI systems are more efficient in providing access security (Q D1: SQ1). ................................................................................................. 60 Figure 19 Opinion on preferable techniques (Q D1: SQ2). .......................................... 61 Figure 20 Opinion between BPI systems and paper-based techniques (Q D1: SQ3). .... 62 Figure 21 Opinion on whether Saudi culture has an impact on BPI (Q D1: SQ4). ........ 63 Figure 22 Opinions of Saudi and non-Saudi participants on whether Saudi culture has an impact on BPI (Q D1: SQ4). ....................................................................................... 63 Figure 23 Opinion on whether religion would have an  impact on BPI system usage (Q D1: SQ5). ................................................................................................................... 64 Figure 24 Biometric techniques suitable for Saudi men (Q D2). .................................. 64 Figure 25 Biometric techniques suitable for Saudi women (Q D3). ............................. 65 Figure 26 Responses of the KFSH staff on whether they received any EHR security policy document (E1). ................................................................................................. 67 Figure 27 Opinion of the respondents on whether the policy protects the privacy of EHRs (E2). ................................................................................................................. 67 vii  Figure 28 Opinion of the respondents on whether the policy is efficient in protecting EHR confidentiality (E3). ........................................................................................... 68 Figure 29 Opinion of the respondents on whether the security procedures are fully understandable to them (QE4: SQ1). ........................................................................... 69 Figure 30 Opinion of the respondents on whether EHR data can be revealed to patient’s family (QE4: SQ2). ..................................................................................................... 69 Figure 31 Opinion of the respondents on whether EHR data can be revealed to patient’s friends (QE4: SQ3). .................................................................................................... 70 Figure 32 Opinion of the respondents on whether cultural issues have an impact on EHR privacy and confidentiality (QF1: SQ1). ............................................................. 71 Figure 33 Opinion of the respondents on whether religion has an impact on EHR privacy and confidentiality (QF1: SQ2). ...................................................................... 72 Figure 34 Opinion of the respondents on whether health staff show responsibility for protecting patients’ EHR privacy and confidentiality (QF1: SQ3). .............................. 73 Figure 35 Opinion of the respondents on whether Saudi patients are fully committed to cultural issues related to privacy and confidentiality (QF1: SQ4). ............................... 73 Figure 36 Opinion of the respondents on whether Saudi patients are fully committed to religious issues related to privacy and confidentiality (QF1: SQ5). .............................. 74 Figure 37 Opinion of the respondents on whether revealing Saudi EHRs might expose patients’ life to danger (QF1: SQ6). ............................................................................ 75 Figure 38 Saudis and non-Saudis opinions (QF1: SQ6). .............................................. 75           viii  Abbreviations BPI Biometric Patient Identification EHRs Electronic Health Records  HIE Health Information Exchange HIPAA Health Insurance Portability and Accountability Act HIPs Health Information Professionals HIS Health Information System HITECH Health Information Technology for Economic and Clinical Health ICTs Information and Communication Technologies  KFSH King Fahad Specialist Hospital  MOH Ministry of Health MUHEC Massey University Human Ethics Committee PHC Primary Health Care SANHS Saudi Arabia’s National Health Services          

EHRs at King Fahad Specialist Hospital : an overview of professionals' perspectives on the use of biometric patient identification for privacy and confidentiality, taking into consideration culture and religion : a thesis presented in partial fulfilment of the requirements of the degree of Master in Information Science, Massey University, Albany, Auckland, New Zealand

https://mro.massey.ac.nz/bitstream/10179/11198/1/01_front.pdf

Abstract

Similar works

Full text

Available Versions

Massey Research Online