BUSINESS INFORM JOURNAL.

УКР

ENG

Search:

REGISTRATION CERTIFICATE

KV #19905-9705 PR dated 02.04.2013.

FOUNDERS

RESEARCH CENTER FOR INDUSTRIAL DEVELOPMENT PROBLEMS of NAS of Ukraine (KHARKIV, UKRAINE)

ROR

EDRPOU 05481984

According to the decision No. 802 of the National Council of Television and Radio Broadcasting of Ukraine dated 14.03.2024, is registered as a subject in the field of print media.
ID R30-03156

PUBLISHER

Liburkina L. M.

CATALOG

Internal Control of Electronic Medical Documentation in the Context of Healthcare Digitalization
Holovachko V. M., Herych M. S., Holovachko A. V.

Holovachko, Vasyl M., Herych, Myroslava S., and Holovachko, Anastasiia V. (2026) “Internal Control of Electronic Medical Documentation in the Context of Healthcare Digitalization.” Business Inform 9:260–275.
https://doi.org/10.32983/2222-4459-2026-9-260-275

Section: Economic and Mathematical Modeling

Article is written in Ukrainian
Downloads/views: 1

Download article (pdf) -

UDC 657.6:004.9:614.2

Abstract:
The research gap lies in the absence of an integrated methodology that simultaneously covers medical data quality, lawful processing, access management, authorship of electronic records, interoperability, recoverability, and the use of event logs as control evidence. The article aims to substantiate and develop a risk-based methodology for the internal control of electronic medical documentation. Methods include analysis of Ukrainian and EU acts, a structured review of peer-reviewed studies (2020–2026), mapping against ISO 27799:2025, ISO/IEC 27001:2022, and the Global Internal Audit Standards, process decomposition, risk-based modelling, scenario testing, and sensitivity analysis. The results identify nine control objectives: lawfulness and purpose limitation; correct patient identification; completeness; accuracy and plausibility; timeliness; confidentiality and minimum-necessary access; integrity and authorship; availability and recoverability; and traceability and interoperability. A matrix is developed for eight stages of the documentation life cycle, linking risks with preventive, detective, and corrective procedures and the evidence of their performance. The study proposes an allocation of responsibilities based on the Three Lines Model, ten quantitative indicators, a residual risk formula, and an integrated control maturity index with five levels. Scenario testing yielded a modelled aggregate-risk reduction from 135 to 47.84 points (64.56%); the scenario maturity index was 42.50%, versus a target of 80.00%. With nominal effectiveness fixed at 80%, lowering evidence reliability from 1.00 to 0.60 increases residual risk from 5.00 to 13.00. Scientific novelty lies in integrating regulatory, medical, information-security, and internal-audit requirements and using coefficient D to adjust control effectiveness and residual risk for evidence reliability. The practical value is that the matrix can serve as the basis for an internal control policy, an internal audit work programme, technical requirements for a medical information system, and a management dashboard. The scenario results demonstrate algorithmic consistency but do not constitute empirical evidence of effectiveness; the proposed parameters, weights, and thresholds require local calibration and validation on de-identified institutional data.

Keywords: internal control; electronic medical documentation; electronic health system; medical information system; data quality; audit log; personal data protection; risk-based approach.

Tabl.: 9. Formulae: 6. Bibl.: 19.

Holovachko Vasyl M. – Candidate of Sciences (Economics), Associate Professor, Associate Professor, Department of Accounting, Taxation, and Marketing, Mukachevo State Unіversity (26 Uzhhorodska Str., Mukachevo, 89600, Ukraine)
Email: [email protected]
Herych Myroslava S. – Candidate of Sciences (Physics and Mathematics), Associate Professor, Department of Probability Theory and Mathematical Analysis, Uzhhorod National University (3 Narodna Pl., Uzhhorod, Zakarpattia region, 88000, Ukraine)
Email: [email protected]
Holovachko Anastasiia V. – Masters Student, King Danylo Lviv National Medical University (69 Pekarska Str., Lviv, 79010, Ukraine)
Email: [email protected]

List of references in article

Biloshytska O. M., Bondarenko L. V. & Besarab O. M. (2026). Problemy ta perspektyvy standartyzatsii elektronnoi systemy okhorony zdorovia Ukrainy. Ch. 1. Mizhnarodni standarty z medychnoi informatyky [Problems and prospects of standardization of the electronic health system of Ukraine. Part 1. International standards in medical informatics]. Biomedychna inzheneriia i tekhnolohiia, 2 (22), 99–116. https://doi.org/10.20535/.2026.2(22).359709
Elektronna systema okhorony zdorovia. (2026, April 9). V ESOZ kilkist elektronnykh medychnykh zapysiv siahnula ponad 5 mlrd [In eHealth, the number of electronic medical records reached over 5 billion]. https://ehealth.gov.ua/2026/04/09/v-esoz-kilkist-elektronnyh-medychnyh-zapysiv-syagnula-ponad-5-mlrd/
European Parliament & Council of the European Union. (2025, March 5). Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2025/327/oj
Ghalavand H., Shirshahi S., Rahimi A., Zarrinabadi Z. & Amani F. (2024). Common data quality elements for health information systems: a systematic review. BMC Medical Informatics and Decision Making, 24(243). https://doi.org/10.1186/s12911-024-02644-7
Holovachko V., Korolovich O. & Havrylets O. (2024). Modern Transformations of Accounting, Management, and Marketing of an Enterprise in the Context of Digitalization. Ekonomika ta suspilstvo, 66. https://doi.org/10.32782/2524-0072/2024-66-4
Huilgol Y. S., Adler-Milstein J., Ivey S. L. & Hong J. C. (2022). Opportunities to use electronic health record audit logs to improve cancer care. Cancer Medicine, 11(17), 3296–3303. https://doi.org/10.1002/cam4.4690
The Institute of Internal Auditors. Global Internal Audit Standards. https://www.theiia.org/en/content/standards/complete-global-internal-audit-standards/
International Organization for Standardization. (2022). ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection – Information security management systems – Requirements. https://www.iso.org/standard/27001
International Organization for Standardization. (2025). ISO 27799:2025. Health informatics – Information security controls in health based on ISO/IEC 27002. https://www.iso.org/standard/84647.html
Lewis A. E., Weiskopf N. & Abrams Z. B. (2023). Electronic health record data quality assessment and tools: a systematic review. Journal of the American Medical Informatics Association, 30(10), 1730–1740. https://doi.org/10.1093/jamia/ocad120
Maksimova I. V. (2022). Regulation and organizational forms of internal audit of health care facilities. Ekonomika, upravlinnia ta administruvannia, 1 (99), 69–75. https://doi.org/10.26642/ema-2022-1(99)-69-75
Palojoki S., Lehtonen L. & Vuokko R. (2024). Semantic interoperability of electronic health records: systematic review of alternative approaches for enhancing patient information availability. JMIR Medical Informatics, 12(e53535). https://doi.org/10.2196/53535
Rule A., Chiang M. F. & Hribar M. R. (2020). Using electronic health record audit logs to study clinical activity: a systematic review of aims, measures, and methods. Journal of the American Medical Informatics Association, 27(3), 480–490. https://doi.org/10.1093/jamia/ocz196
Soroka I. M., Kizim A. V., Mochalov Yu. O., Bobelskyi V. V. & Komisar A. V. (2025). Analiz problem vzaiemodii operatoriv medychnykh informatsiinykh system iz samymy systemamy na zahalnosvitovomu rivni (ohliad literatury) [Analysis of the problems of interaction between operators of medical information systems and the systems themselves at the global level (literature review)]. Visnyk sotsialnoi hihiieny ta orhanizatsii okhorony zdorovia Ukrainy, 4, 128–138. https://doi.org/10.11603/1681-2786.2025.4.15909
zakon.rada.gov.ua. (1992, November 19). Zakon Ukrainy «Osnovy zakonodavstva Ukrainy pro okhoronu zdorovia» vid 19.11.1992 r. № 2801-XII [Law of Ukraine "Fundamentals of Health Legislation of Ukraine" dated November 19, 1992 No. 2801-XII]. https://zakon.rada.gov.ua/laws/show/2801-12#Text
zakon.rada.gov.ua. (2003, May 22). Zakon Ukrainy «Pro elektronni dokumenty ta elektronnyi dokumentoobih» vid 22.05.2003 r. № 851-IV [Law of Ukraine "On Electronic Documents and Electronic Document Circulation" dated May 22, 2003 No. 851-IV]. https://zakon.rada.gov.ua/laws/show/851-15#Text
zakon.rada.gov.ua. (2010, June 1). Zakon Ukrainy «Pro zakhyst personalnykh danykh» vid 01.06.2010 r. № 2297-VI [Law of Ukraine "On Personal Data Protection" dated June 1, 2010 No. 2297-VI]. https://zakon.rada.gov.ua/laws/show/2297-17#Text
zakon.rada.gov.ua. (2018, April 25). Postanova Kabinetu Ministriv Ukrainy «Deiaki pytannia elektronnoi systemy okhorony zdorovia» vid 25.04.2018 r. № 411 [Resolution of the Cabinet of Ministers of Ukraine "Some issues of the electronic health system" dated April 25, 2018 No. 411]. https://zakon.rada.gov.ua/laws/show/411-2018-p#Text
zakon.rada.gov.ua. (2020, February 28). Nakaz Ministerstva okhorony zdorovia Ukrainy «Deiaki pytannia vedennia Reiestru medychnykh zapysiv, zapysiv pro napravlennia ta retseptiv v elektronnii systemi okhorony zdorovia» vid 28.02.2020 r. № 587 [Order of the Ministry of Health of Ukraine "Some issues of keeping the Register of medical records, referral records and prescriptions in the electronic health system" dated February 28, 2020 No. 587]. https://zakon.rada.gov.ua/laws/show/z0236-20#Text