ICT Security of an Electronic Health Record System: an Empirical Investigation : An in depth investigation of ICT security in a modern healthcare system

Sammanfattning: An empirical investigation of the security flaws and features of an in-use modern electronic health record system is performed. The investigation was carried out using dynamic analysis, manual testing and interviews with developers. The results indicate that in-use electronic health record systems suffer from serious authentication flaws, arising from the interaction of many different proprietary systems. The authentication problems are so severe that gaining access to any user’s computer on the hospital intranet would compromise a large database of patient medical records, including radiological data regarding the patients. Common web vulnerabilities were also present, such as injections and incorrectly configured HTTP security headers. These vulnerabilities were heavily mitigated by the use of libraries for constructing web interfaces.