Standards and Guidelines for Electronic Medical Record Systems in ...

The recommendations in this section are derived from the ISO 27799 15 and ISO/IEC 27002 16
standards. Both offer guidance on how best to protect the confidentiality of personal health
information. Reference is made to the UNAIDS interim guidelines. 6 This document, Volume 1 of the
Standards and Guidelines for EMR Systems in Kenya, is limited to defining how information security
can be in-built into EMR systems.
Requirements
EMR systems must have in-built security controls including:
1. Access Control
2. Audit Trails and
3. Back up procedures
Implementation Guidance
Access Control
This is a system of controlling entry and use of the EMR system, in part or in its entirety. Depending
on one’s assigned roles and responsibilities, access can be limited to specific areas such as reports
or the performance of specific functions, such as viewing, editing or deleting patient data.
· EMR systems must provide a means to authenticate user identity using a user name and
password before enabling the user to perform any functions. The system should allow for
the allocation of area-specific access rights. .
· Password length should be a minimum of six characters. Where feasible, 10-12 characters
strengthen password security. The length of the password shall be enforced by the system.
· User account passwords should be changed every ninety days at minimum. The system shall
automatically enforce the regular changing of passwords.
15 Health informatics — Information security management in health using ISO/IEC 27002
16 Information technology — Security techniques — Code of practice for information security management
Standards and Guidelines for Electronic Medical Records Systems in Kenya 29