METHOD: We conducted a qualitative case study evaluation in a general hospital in Saudi Arabia using interviews, observation, and document analysis from the perspectives of major MDI-EMR stakeholders, including healthcare providers, IT professionals and cybersecurity specialists.
RESULTS: The results showed the interplay among physical, technical and administrative security controls that maintained a secure posture of MDI-EMR. The effectiveness of security controls is highly influenced by the staff's cybersecurity awareness and training. The perceived effectiveness of security controls varied among users, with some expressing satisfaction with the ease of use and reliability, while others highlighting challenges such as password complexity and access procedures. Understanding these diverse perspectives is crucial for tailoring security measures to meet the needs of different stakeholders effectively.
CONCLUSION: Collaboration among the key stakeholders is crucial for implementing security controls for MDI-EMR. Balancing security measures with usability concerns is essential, as highlighted by challenges in implementing technical controls. A comprehensive approach encompassing physical, technical and administrative controls, continuous education and awareness initiatives are significant to empower staff in recognising and mitigating cyber threats effectively to safeguard medical data and ensure the integrity of healthcare systems.
METHODS: An online survey was conducted among participants of the MD Training Program for Regulatory Authorities which provide International Medical Device Regulators Forum (IMDRF) adverse event terminology and codes, and six virtual MDAE cases.
RESULTS: All 29 of the 72 participants were regulators. In all cases, most participants selected the broad (level 1) codes rather than the detailed (level 2 or level 3) codes. While responders selected a variety of codes for all annexes in case 1, over 50% of responders selected the intended codes in case 6. The codes for cause investigation were chosen more frequently than other annexes for device problem, components, and health effect. No differences were observed in code selection amongst different stakeholders.
CONCLUSIONS: We identified the diversification in terminology and code selection for reporting MDAEs.