Completed
Thesis' Author:  Hugo André Malheiro Rodrigues
Course description: MSc in Medical Informatics (MIM)
Supervisor(s):
Co-supervisor(s):
Abstract:
Introduction: The deployment of the SPE (Electronic Prescription System) constituted an important evolutionary step for the Portuguese Health system, as it promoted the dematerialization and better control of the emitted prescriptions. Before the SPE, medical prescriptions were handwritten and where thus very difficult to read and potentially very vulnerable to fraud. The last decades massive evolution of medical knowledge, the generalization of preventive medicine practices and new drugs developed by the pharmaceutical industry have led to an exponentially increase in the number of prescriptions, whose verification and certification has thus become a very hard and expensive task for the health service. The Electronic Prescription System (EPS) is a National Health Service (NHS) resource that has proved time and again to be an invaluable asset, not only by its high level of healthcare professionals acceptance and adherence, but also by the provided increased level of management and control with the associated reductions in prescription costs and levels of fraud. Problem: Since 2011, in Portugal it is mandatory to prescribe through an electronic system. The NHS institutions may use the Internal Health Network (RIS-Rede Interna da Saúde) to transmit electronic prescriptions. Because private institutions are not allowed to connect with RIS, the health ministry negotiated with approved software companies to provide prescription software/interfaces and act as gateways to relay prescription data from the private practitioners to the Health Ministry information systems. We contend the use of those companies in this circuit weakens the security level of the national EPS and can severely compromise the doctors’ trust in the system and the patients’ privacy. Aim: Our main aim is to extend the current EPS model to protect prescription integrity, increase its level of confidentiality and to strongly authenticate its main actors and provide the EPS with strong non-repudiation properties. To better understand and achieve these objectives, we start by describing in detail the current Portuguese prescription system in order to better identify security vulnerabilities that may compromise personal sensitive data and potentiate fraud. We will also provide a comparison survey of the main European prescription systems to better understand how they have dealt with similar problems and use this knowledge and experience to improve upon the Portuguese EPS. Methods: The description of the actual prescription system has been based on information provided by medical practitioners, legislation and normative documents published by the Health Ministry. We have also employed one questionnaire to determine the perceived security doctors have about of the actual prescription systems and another to better categorize other countries prescribing systems. Our proposal is based in current best of breed security protocols and best security practices, conductive of practical and pragmatic implementations. Expected Results: During the course of this work we have identified several security problems and privacy issues related with the current PEM model. They comprise excessive personal information demanded from the medical professionals by the services companies, weak authentication procedures, weak integrity and validity mechanisms, easily replicable prescriptions, non-real-time validation of prescription data, potential misuse of patients’ information by software companies and lack of confidentiality during the dispensation process at the pharmacies. These are some of the problems we want to tackle with the proposed model described by this document.