- : Ms Word Format
- : 67 Pages
- : ₦3000
- : 1-5 Chapters
- Click to DOWNLOAD Materials
INVESTIGATING THE EFFECTIVENESS OF DATA PROTECTION MEASURES IN SAFEGUARDING PERSONAL RECORDS IN NIGERIAN HEALTHCARE ORGANISATIONS
ABSTRACT
This research explores the effectiveness of data protection measures in safeguarding personal records within Nigerian healthcare organizations. With an increasing reliance on digital systems and the growing volume of sensitive health-related information, understanding the efficacy of data protection becomes paramount. The study investigates the current strategies in place, assesses their strengths and weaknesses, and proposes potential enhancements. The general research objective of this study was to examine the adherence to the data protection guidelines in health research using University of Uyo Teaching Hospital (UUTH) as a case study. Cross-sectional study design was used and it employed quantitative methods of data collection and analysis. The sample size for this study was 128 research participants however an extra 10% was added to cover for non-respondence. The study targeted UUTH scientists who have participated in any research project. Stratified sampling method and the “Probability Proportional to Size” (PPS) was used to get the desired sample for the research. The data analysis was done using SPSS Version 23. Descriptive statistics and chi-square test were done to determine significant association and results presented in tables, graphs and charts. A total of nine questions were asked to determine the adherence to the national guidelines. A respondent is considered to have adhered if he/she has agreed to all the 9 items. The neutral respondents were considered as non-adherence. The findings reveal that 18 (12.6%) of the respondents adhered to data protection guidelines in health research while the majority did not adhere 121 (87.4%). P-values <0.05 were considered significant. Results further showed that guidelines or policies on data protection within the institute are the organizational factor which highly influences adherence to data protection (p-value of 0.01). Restricting access to the authorized persons and use of codes to conceal participant’s identity (p-value of 0.04) are the best ways of protecting health research data. In conclusion, most health-care workers do not comply with all aspects of national guidelines on data protection which may lead to the exposure and leakage of participant’s data. In view of the findings, the researcher recommends the creation of awareness through workshops and trainings as well as the development of institutional guidelines as the best ways of adhering to data protection guidelines.
CHAPTER ONE –
INTRODUCTION
1.1. Background to the study
The Nigerian healthcare sector is undergoing a digital transformation, with patient records increasingly moving from paper-based systems to electronic health records (EHRs). While this shift offers numerous benefits, such as improved data accessibility and streamlined service delivery, it also raises critical concerns about the security and privacy of sensitive personal health information (PHI). Breaches of PHI can have significant consequences for individuals, including potential discrimination, financial loss, and even harm to physical and mental health. Therefore, protecting patient data in Nigerian healthcare organizations is paramount. Data protection, encompassing data security and privacy, is a complex issue with multiple stakeholders and legal frameworks. In Nigeria, the 2019 Nigeria Data Protection Regulation (NDPR) provides a comprehensive framework for data protection, aligning with international best practices. However, the effectiveness of this framework in safeguarding PHI within healthcare organizations remains an open question. Data can take various forms, such as numbers, texts, audio, video, electronic, or physical (Trewhella, 2014). In the field of health, research data can include laboratory specimens, samples, field notebooks, electronic or manual databases, clinical records, questionnaires, laboratory results, photographs, manuscripts, artifacts, and audio-visual materials, among others (Trewhella, 2014).
According to Article 10 of the Declaration of Helsinki, it is the responsibility of physicians conducting medical research to protect the life, health, privacy, and dignity of human subjects (WMA, 2006). Article 20 emphasizes the importance of respecting the privacy of the subjects and maintaining the confidentiality of their information (Sheikh, 2008). The Council for International Organizations of Medical Sciences (CIOMS) has published international guidelines for medical research involving human subjects, which state that patients have the right to expect their physicians and other healthcare professionals to keep their information confidential and disclose it only to those who need it or have a legal right to access it, such as attending physicians, nurses, or other healthcare workers involved in patient diagnosis and treatment (CIOMS, 2002). The Australian Code for the Responsible Conduct of Research also emphasizes the need for health-care workers to maintain confidentiality when accessing confidential information. In Ireland, the Data Protection Acts of 1988 and 2003 provide legislation to protect patient information collected for medical purposes through pseudonymization, anonymization, explicit consent protection, and the development of Electronic Health Records (EHRs), among other measures (Hawkes, 2007).
The European Union (EU) has developed and approved the General Data Protection Regulation (GDPR) on March 18, 2018, which provides guidelines for member states on safeguarding personal information, including health data (Kirwan et al., 2020). The Health Research Regulations (HRRs) in Ireland acknowledge that additional guidelines governing human health research will impact various aspects of research. One requirement outlined in the HRR is the need for explicit consent from participants before including any identifiable personal information (Kirwan et al., 2020). Key concepts of data management and best practices that should be considered in research include data ownership, gathering, storage, protection and retention, analysis, sharing, reporting, and data destruction (Hochstetler, 2009). A data breach occurs when private and confidential data, particularly information that can identify an individual, is accessed by unauthorized individuals (Filkins and Radcliff, 2008). Data protection programs and models aim to prevent unintentional data leaks.
In developing countries Nigeria inclusive, there is often limited guidance to inform regulatory and ethical decisions regarding privacy and data protection, especially with the implementation of eHealth. This concept presents ethical and regulatory challenges in the management of health research data (Leon et al., 2013). While the challenges to effective data protection in Nigerian healthcare are significant, several promising initiatives and technologies offer hope for improvement. Cloud-based data storage can provide several advantages for healthcare organizations. Secure cloud platforms offer robust infrastructure, regular backups, and automated updates, addressing issues with outdated hardware and software vulnerabilities common in many Nigerian facilities (Adewuyi & Odebode, 2023). Additionally, cloud providers invest heavily in cybersecurity expertise, offering advanced threat detection and incident response capabilities that many healthcare organizations might struggle to implement individually. However, it’s crucial to carefully select cloud providers with proven track records in data security and ensure compliance with regulations like the NDPR. Furthermore, proper data encryption in transit and at rest remains essential to protect patient data even within secure cloud environments.
Additionally, data encryption has become a fundamental tool for data protection in healthcare. By scrambling sensitive information using complex algorithms, encryption renders it unreadable to unauthorized individuals even if they gain access (Okafor & Onwuchekwa, 2022). This applies to data at rest (stored on devices or servers) and data in transit (transmitted over networks). Implementing encryption technologies like secure access platforms and encrypted email can significantly reduce the risk of data breaches and ensure patient privacy.
1.2 Statement of Research Problem
Despite the existence of the geria Data Protection Regulation (NDPR) and other guiding documents, concerns persist about the effectiveness of data protection measures implemented by Nigerian healthcare organizations. These concerns stem from a confluence of factors, including inadequate technical infrastructure, limited awareness and training among healthcare professionals, insufficient data governance, and the ever-evolving landscape of cyber threats.
Firstly, many healthcare organizations in Nigeria lack the robust cybersecurity infrastructure and expertise required to adequately protect EHRs. Outdated hardware, software vulnerabilities, and insufficient network security protocols can create critical entry points for cyberattacks, exposing sensitive patient data to unauthorized access (Adewuyi & Odebode, 2023). Furthermore, a lack of skilled IT personnel trained in data security best practices further exacerbates the vulnerability of EHR systems, leaving them susceptible to hacking, malware infections, and other malicious activities (Okafor & Onwuchekwa, 2022).
Secondly, limited awareness and training among healthcare professionals regarding data protection regulations and best practices contributes to the problem. Many healthcare workers may not fully understand their obligations to protect patient data or lack the practical knowledge to implement appropriate security measures in their daily workflows (Okoye & Uzoechi, 2021). This lack of understanding can lead to unintentional data breaches through insecure data sharing practices, weak password management, and failure to report suspicious activity promptly.
From inadequate technical infrastructure and human resource limitations to insufficient awareness and weak data governance, the vulnerabilities within the Nigerian healthcare sector are multifaceted and require comprehensive solutions. This research aims to delve deeper into these challenges and identify potential avenues for strengthening data protection practices in Nigerian healthcare organizations, ultimately ensuring the security and privacy of sensitive patient data.
1.3. Research Objectives and Questions
This research aims to investigate the effectiveness of data protection measures in safeguarding personal records in Nigerian healthcare organizations. The specific objectives are:
- To assess the current state of data protection practices in Nigerian healthcare organizations.
- To evaluate the adequacy of technical and administrative safeguards in place.
- To analyze the awareness and understanding of data protection regulations among healthcare professionals.
- To identify the challenges and gaps in data protection within the Nigerian healthcare sector.
- To develop recommendations for improving data protection practices and ensuring the security of PHI.
The research will address the following key questions:
- What are the current data protection practices employed by Nigerian healthcare organizations?
- How effective are these practices in preventing data breaches and safeguarding PHI?
- What are the major challenges faced by healthcare organizations in implementing effective data protection measures?
- To what extent does the NDPR influence data protection practices within the Nigerian healthcare sector?
- What are the potential avenues for improving data protection in Nigerian healthcare organizations?
1.5. Justification
This research is critical because it addresses a pressing need to understand and address the vulnerabilities in data protection within the Nigerian healthcare sector. The findings will contribute valuable insights to inform policy development, best practice guidelines, and training programs for healthcare professionals. Furthermore, the research will provide evidence-based recommendations to strengthen data protection in Nigerian healthcare organizations, ultimately contributing to improved patient data security and privacy.
