This study is the first report of Saudi patients in the literature on electronic personal health records (ePHRs). It investigates patients’ attitudes and expectations regarding ePHRs in Saudi Arabia. It also gives insights about addressing the gap between the interest and the utilization of ePHRs by presenting information about patients’ preferences for ePHR features and activities. The findings show higher interest rates in ePHR use compared to other studies with similar sample frame in developed countries. They also indicate high levels of perceived usefulness of ePHRs on patients’ health and healthcare. More research is needed to explore the ePHR privacy concerns of patients and the key factors in improving the use of ePHRs among specific populations such as the elderly and those patients with chronic disease. / Thesis / Master of Science (MSc) / This study is the first report of Saudi patients in the literature on electronic personal health records (ePHRs). It investigates patients’ attitudes and expectations regarding ePHRs in Saudi Arabia. It also gives insights about addressing the gap between the interest and the utilization of ePHRs by presenting information about patients’ preferences for ePHR features and activities. More research is needed to explore the ePHR privacy concerns of patients and the key factors in improving the use of ePHRs among specific populations.

Electronic Health Records (EHR) data contain comprehensive longitudinal patient information, which is usually stored in databases in the form of either multi-relational structured tables or unstructured texts, e.g., clinical notes. EHR provides a useful resource to assist doctors' decision making, however, they also present many unique challenges that limit the efficient use of the valuable information, such as large data volume, heterogeneous and dynamic information, medical term abbreviations, and noisy nature caused by misspelled words. This dissertation focuses on the development and evaluation of advanced machine learning algorithms to solve the following research questions: (1) How to seek answers from EHR for clinical activity related questions posed in human language without the assistance of database and natural language processing (NLP) domain experts, (2) How to discover underlying relationships of different events and entities in structured tabular EHRs, and (3) How to predict when a medical event will occur and estimate its probability based on previous medical information of patients. First, to automatically retrieve answers for natural language questions from the structured tables in EHR, we study the question-to-SQL generation task by generating the corresponding SQL query of the input question. We propose a translation-edit model driven by a language generation module and an editing module for the SQL query generation task. This model helps automatically translate clinical activity related questions to SQL queries, so that the doctors only need to provide their questions in natural language to get the answers they need. We also create a large-scale dataset for question answering on tabular EHR to simulate a more realistic setting. Our performance evaluation shows that the proposed model is effective in handling the unique challenges about clinical terminologies, such as abbreviations and misspelled words. Second, to automatically identify answers for natural language questions from unstructured clinical notes in EHR, we propose to achieve this goal by querying a knowledge base constructed based on fine-grained document-level expert annotations of clinical records for various NLP tasks. We first create a dataset for clinical knowledge base question answering with two sets: clinical knowledge base and question-answer pairs. An attention-based aspect-level reasoning model is developed and evaluated on the new dataset. Our experimental analysis shows that it is effective in identifying answers and also allows us to analyze the impact of different answer aspects in predicting correct answers. Third, we focus on discovering underlying relationships of different entities (e.g., patient, disease, medication, and treatment) in tabular EHR, which can be formulated as a link prediction problem in graph domain. We develop a self-supervised learning framework for better representation learning of entities across a large corpus and also consider local contextual information for the down-stream link prediction task. We demonstrate the effectiveness, interpretability, and scalability of the proposed model on the healthcare network built from tabular EHR. It is also successfully applied to solve link prediction problems in a variety of domains, such as e-commerce, social networks, and academic networks. Finally, to dynamically predict the occurrence of multiple correlated medical events, we formulate the problem as a temporal (multiple time-points) and multi-task learning problem using tensor representation. We propose an algorithm to jointly and dynamically predict several survival problems at each time point and optimize it with the Alternating Direction Methods of Multipliers (ADMM) algorithm. The model allows us to consider both the dependencies between different tasks and the correlations of each task at different time points. We evaluate the proposed model on two real-world applications and demonstrate its effectiveness and interpretability. / Doctor of Philosophy / Healthcare is an important part of our lives. Due to the recent advances of data collection and storing techniques, a large amount of medical information is generated and stored in Electronic Health Records (EHR). By comprehensively documenting the longitudinal medical history information about a large patient cohort, this EHR data forms a fundamental resource in assisting doctors' decision making including optimization of treatments for patients and selection of patients for clinical trials. However, EHR data also presents a number of unique challenges, such as (i) large-scale and dynamic data, (ii) heterogeneity of medical information, and (iii) medical term abbreviation. It is difficult for doctors to effectively utilize such complex data collected in a typical clinical practice. Therefore, it is imperative to develop advanced methods that are helpful for efficient use of EHR and further benefit doctors in their clinical decision making. This dissertation focuses on automatically retrieving useful medical information, analyzing complex relationships of medical entities, and detecting future medical outcomes from EHR data. In order to retrieve information from EHR efficiently, we develop deep learning based algorithms that can automatically answer various clinical questions on structured and unstructured EHR data. These algorithms can help us understand more about the challenges in retrieving information from different data types in EHR. We also build a clinical knowledge graph based on EHR and link the distributed medical information and further perform the link prediction task, which allows us to analyze the complex underlying relationships of various medical entities. In addition, we propose a temporal multi-task survival analysis method to dynamically predict multiple medical events at the same time and identify the most important factors leading to the future medical events. By handling these unique challenges in EHR and developing suitable approaches, we hope to improve the efficiency of information retrieval and predictive modeling in healthcare.

Yes / We compare the performance of logistic regression with several alternative machine learning methods to estimate the risk of death for patients following an emergency admission to hospital based on the patients’ first blood test results and physiological measurements using an external validation approach. We trained and tested each model using data from one hospital (n=24696) and compared the performance of these models in data from another hospital (n=13477). We used two performance measures – the calibration slope and area under the curve (AUC). The logistic model performed reasonably well – calibration slope 0.90, AUC 0.847 compared to the other machine learning methods. Given the complexity of choosing tuning parameters of these methods, the performance of logistic regression with transformations for in-hospital mortality prediction was competitive with the best performing alternative machine learning methods with no evidence of overfitting. / Health Foundation; National Institute for Health Research (NIHR) Yorkshire and Humberside Patient Safety Translational Research Centre (NIHR YHPSTRC)

Information Systems (IS) innovations in healthcare sector are seen as panacea to control burgeoning demand on healthcare resources and lack of streamlining in care delivery. Two particular manifestations of such innovations are telehealth and electronic records in its two forms: the electronic medical records and the electronic health records. Deployment efforts concerning both of these IS-innovations have encountered a rough terrain and have been slow. Problems are also faced while evaluating the effectiveness of innovations on health and care delivery outcomes through strategies such as randomised controlled trials- particularly in case of telehealth. By taking these issues into account, this research investigates the issues that affect IS innovation deployment and its evaluation. The strategy adopted in this research was informed by recursive philosophy and theoretical perspectives within IS that strived to expound this recursive relationship. It involved conducting two longitudinal case studies that are qualitative in nature. The first study involved telehealth deployment and its evaluation in the UK, while the second case study involved the deployment of electronic medical/health records in the US. Data was collected through focus group discussions, interviews and online discussion threads; and was analysed thematically. The results of this research indicate that there are nine issues that arise and affect the deployment and evaluation of IS innovation in healthcare; and these are design, efficiency and effectiveness, optimality and equity, legitimacy, acceptance, demand and efficacy, expertise, new interaction patterns, and trust. These issues are attributes of relationships between the IS innovation, context of healthcare and the user. The significance of these attributes varies during the deployment and evaluation process, and due to iterative nature of IS innovation. This research further indicates that all the attributes have either direct or indirect impact on work practices of the user.

Introdução: Araraquara (SP) possui um programa de vacinação bem sucedido desde a década de 80, com o mais antigo Registro Informatizado de Imunização (RII) do país. Objetivos: Estimar a cobertura vacinal (CV) aos 12 e 24 meses de vida, em crianças nascidas em 2012, no município de Araraquara, investigar fatores associados à vacinação incompleta e analisar os eventos adversos pós-vacinação (EAPV). Métodos: Estudo observacional com componentes descritivo e analítico, abrangendo a coorte de crianças nascidas em 2012, residentes no município e registradas no Sistema de Informação de Nascidos Vivos (SINASC). Foram excluídas as crianças que faleceram no primeiro ano de vida e aquelas que se mudaram de Araraquara. As variáveis do estudo incluíram dados de vacinação e características maternas, de pré- natal/nascimento, do(s) serviço(s) de saúde e da área de residência. Estimou-se as CV e respectivos intervalos de confiança de 95 por cento (IC 95 por cento ) para cada vacina e esquema completo, conforme as normas vigentes no Estado de São Paulo em 2012/2013. A associação entre o esquema vacinal incompleto e as variáveis independentes foi investigada por meio da estimativa da odds ratio (OR) bruta e ajustada, por regressão logística múltipla não condicional hierarquizada, com os respectivos IC 95 por cento . Resultados: 2740 crianças estavam registradas no SINASC como residentes e 99,6 por cento dessas constavam no RII. Após excluir 30 óbitos (1,1 por cento ) e 98 crianças que se mudaram (3,6 por cento ), foram estudadas 2612 crianças. A CV para o esquema completo por doses recebidas aos 12 meses foi 67,9 por cento e aos 24 meses 79,7 por cento ; por doses oportunas foi 46,2 por cento e 32,8 por cento , respectivamente. A vacina sarampo, caxumba e rubéola apresentou a menor CV aos 12 meses por dose recebida (74,8 por cento ) e aos 24 meses por dose oportuna (53,5 por cento ). As vacinas com componente pertussis foram responsáveis por 58,8 por cento (10/17) dos casos de EAPV e febre foi a manifestação mais comum. A distribuição espacial da CV do esquema completo por área de residência não apresentou diferença estatística. No modelo final, mostraram-se independentemente associadas à vacinação incompleta: mães com idade entre 14 e 19 anos [aos 12 meses (OR:2,0); aos 24 meses (OR:2,5)]; com 12 anos ou mais de estudo [aos 12 meses (OR:1,9), aos 24 meses (OR:2,3)]; com três ou mais filhos [aos 12 meses (OR:3,2), aos 24 meses (OR:2,1)]; com menos de sete consultas de pré-natal [aos 12 meses (OR:1,7), aos 24 meses (OR:2,3)]; a criança ter frequentado unidade de saúde (US) pública e privada [aos 12 meses (OR:6,0), aos 24 meses (OR:8,0)], sem Estratégia Saúde da Família [aos 24 meses (OR:1,5)]; e ter vínculo fraco com a US [aos 24 meses (OR:1,4)]. Conclusão: Em Araraquara, a CV por vacina não é homogênea e há atraso vacinal. O uso do RII para o seu monitoramento pode constituir uma estratégia efetiva. A ausência de disparidades nas CV entre as distintas áreas de residência sugere a efetividade do programa de imunização na promoção da equidade em saúde. Recomenda-se priorizar ações de incentivo à vacinação de crianças filhas de mulheres com alta escolaridade e que apresentam vínculo mais frágil com os serviços públicos de saúde / Introduction: Araraquara (SP) has a successful vaccination program since the 80\'s, with the oldest Electronic Immunization Registry (EIR) in the country. Objectives: To estimate vaccination coverage (VC) at 12 and 24 months of life in children born in 2012 in the city of Araraquara, to investigate factors associated with incomplete vaccination and to analyze the adverse events following immunization (AEFI). Methods: An observational descriptive and analytical study comprising the cohort of children born in 2012, living in the city of Araraquara and recorded in the Live Births Information System (SINASC). Children who died in the first year of life or who moved from Araraquara were excluded. Study variables included vaccination data and characteristics of the mother, the antenatal/birth, the health unit (HU) and the area of residence. VC and the respective 95 per cent confidence intervals (95 per cent CI) were estimated for each vaccine and complete schedule, following the São Paulo\'s State recommendations in the years 2012/2013. The association between the incomplete vaccination schedule and the independent variables was investigated by estimating the crude and adjusted odds ratio (OR) by hierarchical non-conditional multiple logistic regression with the respective 95 per cent CI. Results: 2740 children were enrolled in the SINASC as residents and 99.6 per cent of them were in the EIR. After excluding 30 deaths (1.1 per cent ) and 98 children who moved (3.6 per cent ), 2612 children were studied. VC by received doses for the complete schedule at 12 months was 67.9 per cent and at 24 months was 79.7 per cent ; by timely doses was 46.2 per cent and 32.8 per cent , respectively. The measles, mumps and rubella vaccine had the lowest VC at 12 months per received dose (74.8 per cent ) and at 24 months per timely dose (53.5 per cent ). Vaccines with pertussis componente were responsible for 58.8 per cent (10/17) of AEFI cases and fever was the most common manifestation. The spatial distribution of VC of the complete schedule by area of residence did not present statistical difference. In the final model, incomplete vaccination was associated with mother between 14 and 19 years old [at 12 months (OR: 2.0); at 24 months (OR: 2.5)]; with 12 years or more of study [at 12 months (OR: 1.9), at 24 months (OR: 2.3) ]; with three or more children [at 12 months (OR: 3.2), at 24 months (OR: 2.1)]; with less than seven antenatal visits [at 12 months (OR: 1.7), at 24 months (OR: 2.3)]; the child has attended both public and private HU [at 12 months (OR: 6.0), at 24 months (OR: 8.0)], a HU without Family Health Strategy [at 24 months (OR: 1.5)]; and who had a weak link with the HU [at 24 months (OR: 1.4)]. Conclusion: VC per vaccine is not homogeneous in Araraquara and there is a vaccine delay. The use of RII for its monitoring can be an effective strategy. The lack of disparities in VC among the different areas of residence suggests the effectiveness of the immunization program in promoting health equity. It is recommended to prioritize actions to encourage children vaccination of mothers with high schooling and who have a more fragile link with public HU

Introdução: Araraquara (SP) possui um programa de vacinação bem sucedido desde a década de 80, com o mais antigo Registro Informatizado de Imunização (RII) do país. Objetivos: Estimar a cobertura vacinal (CV) aos 12 e 24 meses de vida, em crianças nascidas em 2012, no município de Araraquara, investigar fatores associados à vacinação incompleta e analisar os eventos adversos pós-vacinação (EAPV). Métodos: Estudo observacional com componentes descritivo e analítico, abrangendo a coorte de crianças nascidas em 2012, residentes no município e registradas no Sistema de Informação de Nascidos Vivos (SINASC). Foram excluídas as crianças que faleceram no primeiro ano de vida e aquelas que se mudaram de Araraquara. As variáveis do estudo incluíram dados de vacinação e características maternas, de pré- natal/nascimento, do(s) serviço(s) de saúde e da área de residência. Estimou-se as CV e respectivos intervalos de confiança de 95 por cento (IC 95 por cento ) para cada vacina e esquema completo, conforme as normas vigentes no Estado de São Paulo em 2012/2013. A associação entre o esquema vacinal incompleto e as variáveis independentes foi investigada por meio da estimativa da odds ratio (OR) bruta e ajustada, por regressão logística múltipla não condicional hierarquizada, com os respectivos IC 95 por cento . Resultados: 2740 crianças estavam registradas no SINASC como residentes e 99,6 por cento dessas constavam no RII. Após excluir 30 óbitos (1,1 por cento ) e 98 crianças que se mudaram (3,6 por cento ), foram estudadas 2612 crianças. A CV para o esquema completo por doses recebidas aos 12 meses foi 67,9 por cento e aos 24 meses 79,7 por cento ; por doses oportunas foi 46,2 por cento e 32,8 por cento , respectivamente. A vacina sarampo, caxumba e rubéola apresentou a menor CV aos 12 meses por dose recebida (74,8 por cento ) e aos 24 meses por dose oportuna (53,5 por cento ). As vacinas com componente pertussis foram responsáveis por 58,8 por cento (10/17) dos casos de EAPV e febre foi a manifestação mais comum. A distribuição espacial da CV do esquema completo por área de residência não apresentou diferença estatística. No modelo final, mostraram-se independentemente associadas à vacinação incompleta: mães com idade entre 14 e 19 anos [aos 12 meses (OR:2,0); aos 24 meses (OR:2,5)]; com 12 anos ou mais de estudo [aos 12 meses (OR:1,9), aos 24 meses (OR:2,3)]; com três ou mais filhos [aos 12 meses (OR:3,2), aos 24 meses (OR:2,1)]; com menos de sete consultas de pré-natal [aos 12 meses (OR:1,7), aos 24 meses (OR:2,3)]; a criança ter frequentado unidade de saúde (US) pública e privada [aos 12 meses (OR:6,0), aos 24 meses (OR:8,0)], sem Estratégia Saúde da Família [aos 24 meses (OR:1,5)]; e ter vínculo fraco com a US [aos 24 meses (OR:1,4)]. Conclusão: Em Araraquara, a CV por vacina não é homogênea e há atraso vacinal. O uso do RII para o seu monitoramento pode constituir uma estratégia efetiva. A ausência de disparidades nas CV entre as distintas áreas de residência sugere a efetividade do programa de imunização na promoção da equidade em saúde. Recomenda-se priorizar ações de incentivo à vacinação de crianças filhas de mulheres com alta escolaridade e que apresentam vínculo mais frágil com os serviços públicos de saúde / Introduction: Araraquara (SP) has a successful vaccination program since the 80\'s, with the oldest Electronic Immunization Registry (EIR) in the country. Objectives: To estimate vaccination coverage (VC) at 12 and 24 months of life in children born in 2012 in the city of Araraquara, to investigate factors associated with incomplete vaccination and to analyze the adverse events following immunization (AEFI). Methods: An observational descriptive and analytical study comprising the cohort of children born in 2012, living in the city of Araraquara and recorded in the Live Births Information System (SINASC). Children who died in the first year of life or who moved from Araraquara were excluded. Study variables included vaccination data and characteristics of the mother, the antenatal/birth, the health unit (HU) and the area of residence. VC and the respective 95 per cent confidence intervals (95 per cent CI) were estimated for each vaccine and complete schedule, following the São Paulo\'s State recommendations in the years 2012/2013. The association between the incomplete vaccination schedule and the independent variables was investigated by estimating the crude and adjusted odds ratio (OR) by hierarchical non-conditional multiple logistic regression with the respective 95 per cent CI. Results: 2740 children were enrolled in the SINASC as residents and 99.6 per cent of them were in the EIR. After excluding 30 deaths (1.1 per cent ) and 98 children who moved (3.6 per cent ), 2612 children were studied. VC by received doses for the complete schedule at 12 months was 67.9 per cent and at 24 months was 79.7 per cent ; by timely doses was 46.2 per cent and 32.8 per cent , respectively. The measles, mumps and rubella vaccine had the lowest VC at 12 months per received dose (74.8 per cent ) and at 24 months per timely dose (53.5 per cent ). Vaccines with pertussis componente were responsible for 58.8 per cent (10/17) of AEFI cases and fever was the most common manifestation. The spatial distribution of VC of the complete schedule by area of residence did not present statistical difference. In the final model, incomplete vaccination was associated with mother between 14 and 19 years old [at 12 months (OR: 2.0); at 24 months (OR: 2.5)]; with 12 years or more of study [at 12 months (OR: 1.9), at 24 months (OR: 2.3) ]; with three or more children [at 12 months (OR: 3.2), at 24 months (OR: 2.1)]; with less than seven antenatal visits [at 12 months (OR: 1.7), at 24 months (OR: 2.3)]; the child has attended both public and private HU [at 12 months (OR: 6.0), at 24 months (OR: 8.0)], a HU without Family Health Strategy [at 24 months (OR: 1.5)]; and who had a weak link with the HU [at 24 months (OR: 1.4)]. Conclusion: VC per vaccine is not homogeneous in Araraquara and there is a vaccine delay. The use of RII for its monitoring can be an effective strategy. The lack of disparities in VC among the different areas of residence suggests the effectiveness of the immunization program in promoting health equity. It is recommended to prioritize actions to encourage children vaccination of mothers with high schooling and who have a more fragile link with public HU

"Our modern society is increasingly relying on the collection, processing, and sharing of digital information. There are two fundamental trends: (1) Enabled by the rapid developments in sensor, wireless, and networking technologies, communication and networking are becoming more and more pervasive and ad hoc. (2) Driven by the explosive growth of hardware and software capabilities, computation power is becoming a public utility and information is often stored in centralized servers which facilitate ubiquitous access and sharing. Many emerging platforms and systems hinge on both dimensions, such as E-healthcare and Smart Grid. However, the majority information handled by these critical systems is usually sensitive and of high value, while various security breaches could compromise the social welfare of these systems. Thus there is an urgent need to develop security and privacy mechanisms to protect the authenticity, integrity and confidentiality of the collected data, and to control the disclosure of private information. In achieving that, two unique challenges arise: (1) There lacks centralized trusted parties in pervasive networking; (2) The remote data servers tend not to be trusted by system users in handling their data. They make existing security solutions developed for traditional networked information systems unsuitable. To this end, in this dissertation we propose a series of user-centric security and privacy mechanisms that resolve these challenging issues in untrusted network and computing environments, spanning wireless body area networks (WBAN), mobile social networks (MSN), and cloud computing. The main contributions of this dissertation are fourfold. First, we propose a secure ad hoc trust initialization protocol for WBAN, without relying on any pre-established security context among nodes, while defending against a powerful wireless attacker that may or may not compromise sensor nodes. The protocol is highly usable for a human user. Second, we present novel schemes for sharing sensitive information among distributed mobile hosts in MSN which preserves user privacy, where the users neither need to fully trust each other nor rely on any central trusted party. Third, to realize owner-controlled sharing of sensitive data stored on untrusted servers, we put forward a data access control framework using Multi-Authority Attribute-Based Encryption (ABE), that supports scalable fine-grained access and on-demand user revocation, and is free of key-escrow. Finally, we propose mechanisms for authorized keyword search over encrypted data on untrusted servers, with efficient multi-dimensional range, subset and equality query capabilities, and with enhanced search privacy. The common characteristic of our contributions is they minimize the extent of trust that users must place in the corresponding network or computing environments, in a way that is user-centric, i.e., favoring individual owners/users."

Semantic interoperability within the health care sector requires that patient data be fully available and shared without ambiguity across participating health facilities. The need for the current research was based on federal stipulations that required health facilities provide complete and optimal care to patients by allowing full access to their health records. The ongoing discussions to achieve interoperability within the health care industry continue to emphasize the need for healthcare facilities to successfully adopt and implement Electronic Health Record (EHR) systems. Reluctance by the healthcare industry to implement these EHRs for the purpose of achieving interoperability has led to the current research problem where it was determined that there is no existing single data standardization structure that can effectively share and interpret patient data within heterogeneous systems. The current research used the design science research methodology (DSRM) to design and develop a master data standardization and translation (MDST) model that allowed seamless exchange of healthcare data among multiple facilities. To achieve interoperability through a common data standardization structure, where multiple independent data models can coexist, the translation mechanism incorporated the use of the Resource Description Framework (RDF). Using RDF, a universal exchange language, allowed for multiple data models and vocabularies to be easily combined and interrelated within a single environment thereby reducing data definition ambiguity. Based on the results from the research, key functional capabilities to effectively map and translate health data were documented. The research solution addressed two primary issues that impact semantic interoperability – the need for a centralized standards repository and a framework that effectively maps and translates data between various EHRs and vocabularies. Thus, health professionals have a single interpretation of health data across multiple facilities which ensures the integrity and validity of patient care. The research contributed to the field of design science development through the advancements of the underlying theories, phases, and frameworks used in the design and development of data translation models. While the current research focused on the development of a single, common information model, further research opportunities and recommendations could include investigations into the implementation of these types of artifacts within a single environment at a multi-facility hospital entity.

Medication errors increased 64.4% from 2015 to 2018 in the United States due to the use of computerized physician order entry (CPOE) systems and the inability to exchange information among health care facilities. Healthcare information exchange (HIE) and subsequent discrepancies resulted in significant medical errors due to the lack of exchangeable health care information using technology software. The purpose of this qualitative multiple case study was to explore the strategies health care business managers used to manage computerized physician order entry systems within health care facilities to reduce medication errors and increase profitability. The population of the study was 8 clinical business managers in 2 successful small health care clinics located in the mid-Atlantic region of the United States. Data were collected from semistructured interviews with health care leaders and documents from the health care organization as a resource. Inductive analysis was guided by the Donabedian theory and sociotechnical system theory, and trustworthiness of interpretations was confirmed through member checking. Three themes emerged: standardizing data formats reduced medication errors and increased profits, adopting user-friendly HIE reduced medication errors and increase profits, and efficient communication reduced medication errors and increased profits. The findings of this study contribute to positive change through improved health care delivery to patients resulting in healthier communities.

Health care leaders lack the strategies to implement cloud security for electronic medical records to prevent a breach of patient data. The purpose of this qualitative case study was to explore strategies senior information technology leaders in the healthcare industry use to implement cloud security to minimize electronic health record cyberattacks. The theory supporting this study was routine activities theory. Routine activities theory is a theory of criminal events that can be applied to technology. The study's population consisted of senior information technology leaders from a medical facility in a large northeastern city. Data collection included semistructured interviews, phone interviews, and analysis of organizational documents. The use of member checking and methodological triangulation increased the validity of this study's findings among all participants. There were 5 major themes that emerged from the study (a) requirement of coordination with the electronic health record vendor and the private cloud vendor, (b) protection of the organization, (c) requirements based on government and organizational regulations, (d) access management, (e) a focus on continuous improvement. The results of this study may create awareness of the necessity to secure electronic health records in the cloud to minimize cyberattacks. Cloud security is essential because of its social impact on the ability to protect confidential data and information. The results of this study will further serve as a foundation for positive social change by increasing awareness in support of the implementation of electronic health record cloud security.