Background
Hospital informatization centered on Electronic Medical Records (EMRs) is a key component of healthcare reform.
China has issued several policies such as the "Notice on Further Improving the Appointment Diagnosis and Treatment System and Strengthening Smart Hospital Development", the "Guidelines on Promoting High-Quality Hospital Development by the General Office of the State Council", and the "Notice on Issuing the Action Plan for Promoting High-Quality Hospital Development (2021–2025)". These policies propose an integrated framework for the development of smart hospital in China, encompassing smart healthcare, smart services, and smart management, thereby establishing a top-level policy design.
EMRs, as the core and foundation of smart hospitals, are a priority in hospital infrastructure development. The government has clearly mentioned that by 2022, the average EMR application level in tertiary public hospitals should reach Level 4. Based on the "Electronic Medical Record System Application Level Grading Evaluation Standards (Trial)", the nationwide evaluation of hospital EMR levels has been fully implemented, and it has become a key indicator in the performance assessment of tertiary public hospitals.
Customer Requirements
A tertiary hospital, while pursuing improvements in medical service quality, also faces challenges in EMRs management. With the rapid advancement of healthcare informatization, traditional paper-based medical record management methods can no longer meet modern healthcare demands. To enhance the efficiency and security of medical record management, the hospital has decided to implement a Level 5 electronic medical record system.
The EMR evaluation is a system launched by the National Health Commission to assess the current status and application level of medical institutions’ electronic medical record systems. It's not only an important indicator of a hospital’s informatization level but also a performance assessment metric for tertiary public hospitals.
The client places great emphasis on the construction of smart hospitals centered around the EMR system. The newly developed next-generation integrated dental EMR system achieves structured medical records, real-time data sharing, systematic specialty quality control, and intelligent clinical decision support. It strongly supports the development of intelligent medical services, refined medical management, and standardized medical data, while advancing the collaborative development of medical education, research, management, and services.
1. Electronic authentication and signature requirements: The evaluation requires that key electronic medical records have unified identity authentication functions. The final medical records related to key electronic medical records must include at least one type of reliable electronic signature function.
2. Infrastructure and security management requirements: Cyberspace assets must be clearly and explicitly identified. Independent network zones shall be established according to different business functions, accompanied by corresponding security operation and maintenance management systems.
Solution Overview
This solution, based on the "Electronic Medical Record System Application Level Grading Evaluation Standards (Trial)", combines general hospital construction experience and national laws and regulations to implement targeted security protection for the electronic medical record system.
A cryptographic service zone is planned within the hospital data center, where server cryptographic devices and signature verification systems are deployed to enable reliable electronic signatures throughout the EMR data generation process. A timestamp server is deployed to ensure that all electronic signatures on medical records have timestamps that comply with the EMR application management standards.
A cyber asset governance platform is deployed in the hospital's operation management area. This advanced platform enables refined management of the hospital's network assets. It provides comprehensive identification, classification, and monitoring of all network devices, software, data, and other critical assets, ensuring compliant use and effective protection.
The electronic medical record system is built in accordance with the Level 3 requirements of the Classified Protection of Cybersecurity. A log auditing system is deployed to enable centralized monitoring and alarm of core hardware and software devices, and to manage logs centrally, ensuring that logs are retained for no less than six months.
The log auditing function is enabled on network devices and servers, and the logs are transmitted to the log auditing system via methods such as syslog for unified storage, with a retention period of over six months.
Practical Application
Our solution for the Level 5 EMR implementation tertiary hospitals focuses on the following three key points:
1. Electronic Signature Function: An electronic signature system based on a signature verification server is deployed in the hospital to ensure that all final medical records of key electronic medical records have legally valid electronic signatures. The system allows doctors, nurses, and other medical staff to sign electronically after completing medical records, ensuring the authenticity and integrity of the records.
2. Cyber Asset Governance: A cyber asset governance solution has been implemented, which provides comprehensive identification, classification, and monitoring of the hospital's network assets through refined management. This not only improves asset utilization but also strengthens control over potential security risks.
3. Network Security Operation and Maintenance Management System: A comprehensive network security operation and maintenance management system has been established for the hospital, including access control, data protection, security incident response, and recovery plans. This system ensures the stable operation of the hospital's network environment while enhancing its defense against network attacks.
Project Value
Through the implementation of this plan, the tertiary hospital successfully passed the Level 5 EMR assessment, achieving electronic signature authentication for medical records, refined management of network assets, and standardized network security operation.
