Processo de certificação de sistemas de registro eletrônico de saúde no Brasil: uma abordagem abrangente e os principais desafios

Abstract

The paper aims to present an overview of the process of certification of Electronic Health Record Systems in Brazil, and list the major challenges that are faced currently. Due to the growing number of automated processes that were previously done manually, there is a constant search for security when it comes to data and the processes involved. Systems that handle sensitive or confidential information or electronic documents that should have legal validity, must assure users Authentication, Confidentiality, Integrity and Non-repudiation to data. Thus, several techniques are currently used, including digital certification. This technique consists of the emission of a digital certificate with information that ensures the authenticity of one of the entities of the communication, serving as an electronic identification document. In Brazil, digital certificates are issued by ICP-Brazil. This method is already in use in health care, for example, the Digital CRM, which consists of a smart card that stores a certificate with information that identifies the physician. However, this technique is not enough for validating health care systems in the hospital environment. Apart from data security, it is necessary to ensure that the functionalities are in full operation, as they relate to important information and procedures on patients' health, and any mistake can compromise such patients. From this, it is proposed the creation of the Certification Process for Electronic Health Record Systems, which consists of a compliance verification for such systems based on Conformance Requirements defined by the Federal Council of Medicine and the Brazilian Society of Health Informatics