Patients' Perception of Privacy and Security Information in Patient-Accessible Electronic Health Records: an analysis on HelseNorge

Abstract

This study delves into patients’ privacy and security concerns regarding HelseNorge, a prominent patient-accessible electronic health records (PaEHR) system in Norway. It offers an empirical analysis of patients’ awareness of information privacy and security when using the PaEHR. By surveying 315 patients, this study examines their awareness of (i) existing and desired information privacy and security features, (ii) challenges related to information privacy and security, and (iii) methods patients use to enhance their knowledge of information privacy and security. The results showed that many patients are aware of the information privacy and security features in PaEHR; however, they desire advanced information privacy features. Information privacy features include selective data sharing, revocation, deletion, Role-Based Access Control (RBAC), differentiated access levels, and data minimization. The desired information security features include transparent access logs, end-to-end encryption, context-aware authentication, and session safeguards. Furthermore, information privacy and security awareness can be enhanced through the institutional resources provided by the PaEHR, such as its webpage. Drawing on empirical data, this study examines human-centered knowledge and proposes guidelines for designing next-generation PaEHRs.