Use of Affordable Open Source Systems by Rural and Small-Practice Health Professionals

The use of technology in health care has the potential to impact the quality, safety, effectiveness, and efficiency of care. While adoption of these systems has rapidly increased, high costs can make them unobtainable to rural and small-practice ambulatory heath care providers. One solution to this may be the adoption of open-source electronic health record (EHR) applications. However, these applications must be trusted, meaning that they need to be functional, affordable, reliable, available, secure, privacy-preserving, standards/regulations-based, and able to interoperate and be integrated with other health care systems.     

For this project, software engineering practices were developed in order to guide others in the development of trustworthy EHR applications. In addition, the project team developed techniques to evaluate the trustworthiness of EHRs, using these techniques to evaluate six products, five open-source and one proprietary. The five open-source applications were chosen because of their popularity, their diversity, and the variety of programming languages used. The applications were both Web-based and client/server applications. A needs interview protocol was developed and used to interview small-practice doctors and their information technology staff and a re-usable test-bed was built so that the open-source applications could be installed and used by other researchers and practitioners.  

The main objectives of this project were to:

• Conduct an assessment of the needs of rural and small-practice doctors with regard to the capabilities, strengths, and limitations of existing open-source EHR applications. 
• Identify and evaluate promising open-source EHR applications.
• Develop and disseminate a process for evaluating the functionality, trustworthiness, interoperability, performance, compliance, and affordability of existing open-source EHR applications.
• Advance software engineers’ understanding of best practices for developing new or enhancing existing EHR applications. 
• Implement servers using open-source EHR applications that enable rural and small medical practices to obtain the benefits of EHR technology as they run their offices and securely store, utilize, and share patient data. 

During evaluation of the EHRs, the project team quickly discovered that one of the biggest trust issues is security. These security vulnerabilities were considered to be significant and serious. The project team noted that current EHR certification criteria do not detect these vulnerabilities, such that even applications that are certified may be insecure. In addition, privacy-preserving attributes were found to be inadequate. The project team concluded that they could not recommend the open-source EHRs they evaluated be used by small and rural medical practices. In addition, they recommended that security certification to meet the Centers for Medicare & Medicaid Services EHR Incentive Program meaningful use criteria be evolved to detect more security problems.