Högskolan i Skövde

With the growing importance of cybersecurity, organizations are compelled to balance effective security controls using limited resources. Despite the existence of numerous economic models to support cybersecurity decisions, many stakeholders are unaware of their availability or lack criteria for the selection of models suited to their specific contexts. The present study addresses this gap by conducting a systematic literature review to establish a comprehensive taxonomy of cybersecurity economic models. From a corpus of 60 reviewed articles, 75 distinct cybersecurity economic model instances were extracted and analyzed using the established taxonomy development methodology, resulting in seven dimensions and 29 characteristics. This taxonomy provides a structured framework for classifying and comparing models, facilitating researchers and practitioners in identifying and applying the most appropriate approaches. In addition, the mapped collection provides a consolidated overview of existing models, highlighting their distinct characteristics and revealing underexplored areas. The present study serves as a foundational reference for future research on model development and supports informed decision-making in cybersecurity investment strategies.

Background: Patients’ access to their electronic health record (EHR) supports their participation and satisfaction with care. Despite the benefits, some patients have been upset after reading their EHR. Additionally, health care professionals are concerned that patients, particularly those with mental health conditions, may be offended, and they have expressed a need for further guidelines on how to write EHRs. Experiences among various patient groups are essential to support the relationship between patients and professionals. However, prior studies have often focused on single patient groups or specific clinical contexts, leaving a limited understanding of differences across multiple patient groups.

Objective: This study aimed to determine whether certain patient groups are more likely to feel offended while reading their EHRs and which information is perceived as offensive and to provide a comparison across multiple patient groups using a mixed methods approach.

Methods: A cross-sectional survey was conducted via the Finnish national patient portal using a web-based patient survey, adopting a mixed methods approach. The survey included multiple-choice and open-ended questions. The total sample comprised 4681 respondents. The survey respondents were placed into 4 patient groups: those who had received care for mental health, cancer, or other conditions and those who had received no care. Associations between the type of care and patients who felt offended were estimated using multivariate binary logistic regression. Inductive content analysis (n=502) was conducted to identify information perceived as offensive in the EHR.

Results: The patients who had received mental health care (166/654, 25.4%) or cancer and mental health care (9/39, 23.1%) were more likely to be offended by information in their EHR compared to the other groups (cancer care: 37/375, 9.9%; other conditions care: 383/3316, 11.6%; no care: 22/206, 10.7%; other conditions care: odds ratio 0.37, 95% CI 0.29‐0.46; P<.001; model A). Additionally, female patients, those with bad or very bad health conditions, and patients with bachelor’s or master’s degrees were significantly more likely to feel offended. Errors, the health care professionals’ disrespectful language, and perceived unnecessary information were the most frequently mentioned reasons for being offended. Patients with mental health care reported more often that unnecessary information and professionals’ opinions and word choices were experienced as offensive compared to other patients.

Conclusions: This study contributes new knowledge by identifying differences across multiple patient groups. Although a minority of patients felt offended by their EHR, health care professionals should consider that some patients, particularly those who have received mental health care or cancer and mental health care, may be offended by specific information or word choices in their EHRs. To address this, health care professionals should receive education on how to write their notes in a neutral tone and avoid potentially offensive topics. Improving the quality of EHRs could strengthen the relationship between patients and professionals.

Introduction: Patient-accessible electronic health records (PAEHRs) offer benefits, such as supporting self-management and care engagement. However, some patients, particularly those with mental health conditions, might experience negative emotions such as worry when reading unexpected or sensitive information in their PAEHRs.

Methods: A web-based survey of 4459 respondents distributed via the Finnish national patient portal included multiple-choice and open-ended questions. Respondents consisted of two patient groups who had received care either for 1) mental health or 2) other conditions. Inductive content analysis was performed to explore the kind of information that was perceived as sensitive in the PAEHR. Associations between sociodemographic factors including the type of care and reporting health information as sensitive were calculated via the multivariable binary logistic regression analysis.

Results: Mental health (61.3%), and intimate health (8.3%) were the most frequently mentioned as especially sensitive types of information among respondents, who also stressed that the sensitive nature of the health information depended on the context. Within the mental health information type, therapy or treatment was most often mentioned (3.5%) as sensitive. Respondents who had received mental health care were significantly more likely to perceive certain information as sensitive (53.2%) than other patients (28.8%; Adjusted OR=2.783, 95% CI=[2.333, 3.319], p<0.001).

Conclusions: This study delves into the sensitive character of mental health information within PAEHR. The sensitivity of information also depends on the consequences for the patients when data will be used in another context. Documenting sensitive information carefully and safeguarding it is recommended to maintain trust in electronic health records and healthcare. 

The study aimed to identify information security and privacy challenges concerning Personal eHealth Services (PeHS) via a systematic literature review. The result shows that there are several challenges to consider. In total, 8 themes of challenges were identified. Some examples of challenges are access control, patient trust, collaboration between multiple parties and the need for more knowledge. Further, to deal with the challenges, there is a need to improve governance and management of information security and privacy at the regional and national levels to include new services such as PeHS. Regardless of whether the patient information goes via the intra/inter-organizational e-health services or the Patient eHealth Services, the information is part of the patient's total information flow and must be included as a prominent part of healthcare's information security and privacy work to gain patient-centred and transparent care. 

The Nordic countries are, together with the United States, forerunners in online record access (ORA), which has now become widespread. The importance of accessible and structured health data has also been highlighted by policy makers internationally. To ensure the full realization of ORA’s potential in the short and long term, there is a pressing need to study ORA from a cross-disciplinary, clinical, humanistic, and social sciences perspective that looks beyond strictly technical aspects. In this viewpoint paper, we explore the policy changes in the European Health Data Space (EHDS) proposal to advance ORA across the European Union, informed by our research in a Nordic-led project that carries out the first of its kind, large-scale international investigation of patients’ ORA—NORDeHEALTH (Nordic eHealth for Patients: Benchmarking and Developing for the Future). We argue that the EHDS proposal will pave the way for patients to access and control third-party access to their electronic health records. In our analysis of the proposal, we have identified five key principles for ORA: (1) the right to access, (2) proxy access, (3) patient input of their own data, (4) error and omission rectification, and (5) access control. ORA implementation today is fragmented throughout Europe, and the EHDS proposal aims to ensure all European citizens have equal online access to their health data. However, we argue that in order to implement the EHDS, we need more research evidence on the key ORA principles we have identified in our analysis. Results from the NORDeHEALTH project provide some of that evidence, but we have also identified important knowledge gaps that still need further exploration.

Objective: The current understanding of the breadth of individual differences in how eHealth technologies are perceived as useful for different purposes is incomprehensive. The aim/purpose of the study is to improve the understanding of diverse perceptions of the usefulness of technologies by exploring older adults’ use of their patient-accessible electronic health records (PAEHRs).

Methods: The study applies and extends Affordance Theory based on an empirical analysis of data from the NORDeHEALTH 2022 Patient Survey on attitudes toward PAEHR in Norway, Sweden, Finland, and Estonia. Responses from 3964 participants in Sweden, aged 65 + years were analysed. Data included demographics and agreement ratings to reasons for using PAEHR. To analyse variation in the reasons for using PAEHR, group comparisons were conducted based on gender (male/female), age group (65–74, 75–84 and 85+) and earlier encouragement to use PAEHR.

Results: Overall, the findings suggest that PAEHRs have multiple parallel affordance trajectories and affordance potencies that actualise differently depending on needs. The top reasons, pointing to both orientational and goal-oriented affordances for using PAEHR, were improving understanding of health issues, getting an overview of medical history/treatment and ensuring understanding of what the doctor said. Men reported more often sharing information with relatives or friends as a reason to access PAEHR. Women were more inclined, albeit similarly to men less frequently, to read their PAEHR for detecting errors. Age had little influence on reasons for using PAEHR.

Conclusions: The study applies and extends Affordance Theory in the context of older adults’ PAEHR use based on findings from the largest national investigation of reasons for older users to access PAEHR in Sweden demonstrating the applicability of the theory in improving the understanding of the diversity of individual perceptions on eHealth technologies. 

Background: Patients’ online record access (ORA) enables patients to read and use their health data through online digital solutions. One such solution, patient-accessible electronic health records (PAEHRs) have been implemented in Estonia, Finland, Norway, and Sweden. While accumulated research has pointed to many potential benefits of ORA, its application in mental healthcare (MHC) continues to be contested. The present study aimed to describe MHC users’ overall experiences with national PAEHR services. Methods: The study analysed the MHC-part of the NORDeHEALTH 2022 Patient Survey, a large-scale multi-country survey. The survey consisted of 45 questions, including demographic variables and questions related to users’ experiences with ORA. We focused on the questions concerning positive experiences (benefits), negative experiences (errors, omissions, offence), and breaches of security and privacy. Participants were included in this analysis if they reported receiving mental healthcare within the past two years. Descriptive statistics were used to summarise data, and percentages were calculated on available data. Results: 6,157 respondents were included. In line with previous research, almost half (45%) reported very positive experiences with ORA. A majority in each country also reported improved trust (at least 69%) and communication (at least 71%) with healthcare providers. One-third (29.5%) reported very negative experiences with ORA. In total, half of the respondents (47.9%) found errors and a third (35.5%) found omissions in their medical documentation. One-third (34.8%) of all respondents also reported being offended by the content. When errors or omissions were identified, about half (46.5%) reported that they took no action. There seems to be differences in how patients experience errors, omissions, and missing information between the countries. A small proportion reported instances where family or others demanded access to their records (3.1%), and about one in ten (10.7%) noted that unauthorised individuals had seen their health information. Conclusions: Overall, MHC patients reported more positive experiences than negative, but a large portion of respondents reported problems with the content of the PAEHR. Further research on best practice in implementation of ORA in MHC is therefore needed, to ensure that all patients may reap the benefits while limiting potential negative consequences. 

Patient-Accessible Electronic Health Records (PAEHR) is particularly controversial in mental healthcare. We aim to explore if there is any association between patients with mental health conditions and the experience of someone demanding access to their PAEHR. A chi-square test showed a significant association between group belonging and experiences of someone demanding access to the PAEHR.

Purpose: Ensuring security of online health records and patients' perceptions of security are concerns in adolescent healthcare. Little is known about adolescents' perceptions about healthcare's ability to protect online health records. This article explores adolescents' perspectives on security and privacy of their online health records, potential differences based on gender and health, attitudes to sharing information, and perceptions of what constitutes sensitive information. Methods: This study included a subset of items from a national online patient survey conducted in Sweden (January-February 2022), focusing on respondents aged 15–19 years. Gender and health status differences were calculated using the Kruskal-Wallis test. Results: Of 218 adolescent respondents (77.1% female), a minority had security and privacy concerns. A notable proportion (41.3%) wished to control who could see their records, and those who reported better perceived health were more likely to want to manage access to their electronic health record (H = 13.569, p = .009). Most had not experienced unauthorized access to their records (75.2%) and had never shared health information on other online applications (85.8%). More than half (56.0%) perceived some information as sensitive, where mental health was the most common (76.0%). Most felt that reading their notes improved their trust for their healthcare professional (65.6%) and supported better communication with healthcare professionals (66.5%). Discussion: In this national survey, adolescents generally reported few concerns about patient portals. Findings emphasize the need for security and privacy protection and to empower adolescents with greater control over access to their health information housed in electronic health record systems. 

Background: The NORDeHEALTH project studies patient-accessible electronic health records (PAEHRs) in Estonia, Finland, Norway, and Sweden. Such country comparisons require an analysis of the sociotechnical context of these services. Although sociotechnical analyses of PAEHR services have been carried out in the past, a framework specifically tailored to in-depth cross-country analysis has not been developed. Objective: This study aims to develop and evaluate a method for a sociotechnical analysis of PAEHRs that advances a framework for sociotechnical analysis of eHealth solutions first presented by Sittig and Singh. This first article in a series presents the development of the method and a cross-country comparison of the contextual factors that enable PAEHR access and use. Methods: The dimensions of the framework for sociotechnical analysis were thoroughly discussed and extended in a series of workshops with international stakeholders, all being eHealth researchers focusing on PAEHRs. All countries were represented in the working group to make sure that important national perspectives were covered. A spreadsheet with relevant questions related to the studied services and the various dimensions of the sociotechnical framework was constructed and distributed to the 4 participating countries, and the project participants researched various national sources to provide the relevant data for the comparisons in the 10 sociotechnical dimensions. Results: In total, 3 dimensions were added to the methodology of Sittig and Singh to separate clinical content from features and functions of PAEHRs and demonstrate basic characteristics of the different countries regarding national and regional steering of health care and information and communications technology developments. The final framework contained the following dimensions: metadata; hardware and software computing infrastructure; features and functions; clinical content shared with patients; human-computer interface; people; workflow and communication; the health care organization’s internal policies, procedures, and culture; national rules, regulations, and incentives; system measurement and monitoring; and health care system context. The dimensions added during the study mostly concerned background information needed for cross-country comparisons in particular. Several similarities were identified among the compared countries, especially regarding hardware and software computing infrastructure. All countries had, for example, one national access point, and patients are provided a PAEHR automatically. Most of the differences could be identified in the health care system context dimension. One important difference concerned the governing of information and communications technology development, where different levels (state, region, and municipality) were responsible in different countries. Conclusions: This is the first large-scale international sociotechnical analysis of services for patients to access their electronic health records; this study compared services in Estonia, Finland, Norway, and Sweden. A methodology for such an analysis was developed and is presented to enable comparison studies in other national contexts to enable future implementations and evaluations of PAEHRs.