Implementing Electronic Medical Records (EMR) in Compliance with SNARS: A Technical and Compliance Guide

Hospitals and clinics in Indonesia currently face significant challenges in implementing Electronic Medical Records (EMR) that are not only operationally efficient but also meet the SNARS (Standar Nasional Akreditasi Rumah Sakit / National Hospital Accreditation Standards) accreditation standards. Compliance with SNARS, particularly in the Management of Information and Medical Records (MIRM) chapter, is crucial to maintaining service quality, avoiding regulatory sanctions, and ensuring the operational sustainability of healthcare facilities. Without an EMR that meets these standards, the risk of declining service quality, audit findings, and even regulatory fines can become a detrimental reality. Digital transformation in the healthcare sector, driven by the mandate of PMK No. 24 of 2022 on Medical Records, further emphasizes the urgency of implementing interoperable and secure EMR. This article will guide you in depth through the key technical and operational aspects of building or adapting your EMR system. We will discuss everything from the basic concepts of SNARS compliance, details of technical architecture, runnable code implementation examples, to best practices for ensuring your system is not only functional but also fully compliant with applicable regulations and standards.

Fundamentals of EMR Compliance with SNARS

Compliance of Electronic Medical Records (EMR) with the Standar Nasional Akreditasi Rumah Sakit (SNARS) is the primary foundation in ensuring the quality and safety of healthcare services. SNARS, especially through the Management of Information and Medical Records (MIRM) Chapter, establishes a series of standards that every healthcare facility must meet. These standards cover not only the completeness and accuracy of data but also crucial aspects such as confidentiality, security, and availability of patient medical information. For example, SNARS MIRM 1.1 requires that hospitals have a process to ensure accurate patient identification, while MIRM 13 emphasizes the importance of a comprehensive audit trail to track every access and modification of medical record data.

The legal foundation that further strengthens this urgency is the Minister of Health Regulation (PMK) No. 24 of 2022 on Medical Records. This PMK explicitly requires all healthcare facilities to implement EMR and integrate it with the SatuSehat platform. This integration is not merely regulatory compliance but a strategic step to realize national health data interoperability. Without proper integration, your EMR will not be able to function optimally within Indonesia's digital health ecosystem and may hinder the accreditation process.

Several key principles that must be the focus in ensuring your EMR complies with SNARS include:

• Data Security: Implementation of data encryption at rest and in transit, granular Role-Based Access Control (RBAC), and multifactor authentication (MFA) mechanisms.
• Data Integrity: Application of strict input validation, prevention of patient data duplication, and mechanisms to ensure data consistency across system modules.
• Interoperability: Adoption of the Fast Healthcare Interoperability Resources (FHIR) Release 4 standard as the backbone of data exchange, as well as readiness to integrate with the SatuSehat Platform.
• Completeness & Accuracy: Ensuring all clinical data, from anamnesis, diagnosis, procedures, to medication prescriptions, is recorded correctly, completely, and in accordance with applicable medical standards.
• Availability: The EMR system must be designed to have high availability with a minimum uptime target of 99.9%, equipped with robust backup and disaster recovery strategies.

As a concrete example, a hospital in Central Java once experienced difficulties in the accreditation process because the EMR they used did not have adequate audit trail features. Every time there was access or change to patient data, the system did not record who did it, when, and what changes occurred. This directly violated the MIRM 13 standard requiring tracking of medical record activities, resulting in delays and the need for significant system improvements. Therefore, understanding and implementing these principles from the outset is the key to success.

Technical Architecture and Compliance Implementation

Building an EMR that complies with SNARS and is ready for SatuSehat requires a solid technical architecture and the right technology choices. In the context of developing SIMRS or SIM Klinik, several popular and robust backend technology choices include Laravel 11.x (with PHP 8.2+), Node.js 20 LTS (using the Express.js framework), or Spring Boot 3.x (with Java 17+). Laravel, for example, offers a broad and fast ecosystem for API development, while Node.js excels in real-time applications and I/O scalability. Spring Boot is known for its performance and stability for enterprise-level applications. This choice will greatly depend on your IT team's capabilities and the specific needs of the healthcare facility.

For the database, PostgreSQL 16.x is a highly recommended choice. Besides being known for its reliability, PostgreSQL has excellent JSONB support, enabling efficient storage of semi-structured FHIR data. Another alternative is MySQL 8.x, which also offers solid performance and security features. The database security aspect is very important; ensure the implementation of data encryption at rest, strict firewall configuration, as well as database backup and replication strategies for high availability and disaster recovery. Master-slave or multi-master replication can ensure your EMR remains available even when the primary server fails.

Interoperability standards are the backbone of a modern EMR. Fast Healthcare Interoperability Resources (FHIR) Release 4 is a standard adopted nationally through the SatuSehat platform. For FHIR implementation, you can utilize libraries such as HAPI FHIR 6.8.x for the Java environment, or `fhir.js` for Node.js/JavaScript-based projects. This library simplifies the process of parsing, validating, and manipulating FHIR resources. In addition to FHIR, for integration with legacy systems that may still use HL7 v2.5.1, consider using a gateway or adapter that can translate HL7 v2 messages into FHIR format or vice versa. For more complex and asynchronous data exchange, messaging platforms such as Apache Kafka or RabbitMQ can be used to ensure reliable and scalable message delivery between modules or external systems.

The critical modules that must exist and meet SNARS standards include:

• Patient Identity Management: The system must be able to manage a Unique Patient Identifier (UPI) that is integrated with the Dukcapil Population Identification Number (NIK). This is crucial to prevent data duplication and ensure accurate patient identification in accordance with SNARS MIRM 1.1.
• Clinical Recording: This module must support various recording formats such as SOAP (Subjective, Objective, Assessment, Plan) or ADIME (Assessment, Diagnosis, Intervention, Monitoring, Evaluation) for dietitians. This includes order entry for lab/radiology examinations, result recording, and e-prescribing (electronic prescriptions).
• User & Access Management (RBAC): Implement highly granular role-based access control. Example roles: Doctor (full access to their patients' medical records), Nurse (limited access to nursing actions), Medical Records Officer (administrative access), and IT Admin (limited system access). Each role must have specific access permissions per module or even per data type.
• Audit Trail: Every activity in the EMR, from login, patient data access, data changes, to deletion, must be recorded in detail. Audit records must include user ID, activity type, timestamp, IP address, and details of data changes. This is an absolute requirement for SNARS MIRM 13.
• Clinical Decision Support System (CDSS): Integration with clinical guidelines, drug allergy warnings, drug interactions, or diagnostic recommendations can improve the safety and quality of service. CDSS helps doctors make more appropriate and evidence-based decisions.

As an example of a specific version, for integration with the SatuSehat platform, make sure you use an API endpoint that complies with the FHIR R4 standard, such as https://api-satusehat.kemkes.go.id/fhir-r4/v1. Using a consistent FHIR version and an up-to-date FHIR library will minimize compatibility issues and ensure your system is always ready for future regulatory updates.

Example Code Implementation for Audit Trail and FHIR

The SNARS compliance aspect, particularly MIRM 13 which requires activity tracking, can be implemented effectively through the audit trail feature. The following is a simple implementation example using the Laravel framework (PHP) to record important activities in your EMR system:

// app/Models/ActivityLog.php - Model for storing user activity logs
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class ActivityLog extends Model
{
    protected $fillable = ['user_id', 'activity_type', 'description', 'ip_address', 'user_agent', 'data_changes'];
    protected $casts = [
        'data_changes' => 'array', // Store data changes as JSON
    ];
    public static function log($userId, $activityType, $description, $dataChanges = [])
    {
        static::create([
            'user_id' => $userId,
            'activity_type' => $activityType,
            'description' => $description,
            'ip_address' => request()->ip(),
            'user_agent' => request()->userAgent(),
            'data_changes' => $dataChanges,
        ]);
    }
}

// Example usage in PatientController.php - Record patient data changes
use App\Models\ActivityLog;
use App\Models\Patient;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class PatientController extends Controller
{
    public function updatePatient(Request $request, Patient $patient)
    {
        // Save old data before update for comparison
        $oldData = $patient->getOriginal(); 
        $patient->update($request->all());
        $newData = $patient->fresh()->toArray(); // Retrieve the latest data

        // Record patient update activity
        ActivityLog::log(
            Auth::id(),
            'UPDATE_PATIENT',
            'Changed patient data with ID: ' . $patient->id,
            ['old' => $oldData, 'new' => $newData]
        );

        return response()->json($patient, 200);
    }

    public function viewPatient(Patient $patient)
    {
        // Record activity of viewing patient data
        ActivityLog::log(
            Auth::id(),
            'VIEW_PATIENT',
            'Viewed patient data with ID: ' . $patient->id
        );
        return response()->json($patient, 200);
    }
}

The code above shows a simple ActivityLog model in Laravel for recording every important user activity, such as viewing or changing patient data. The static log method allows recording activity details such as user ID, activity type, description, IP address, user agent, and data changes (if any). This is a vital component for meeting the SNARS MIRM 13 standard, which requires comprehensive tracking of access to and modification of medical record data. By storing old and new data changes, the system can provide a highly detailed audit trail, facilitating investigation in the event of a security incident or data error.

In addition to the audit trail, interoperability with the FHIR R4 standard is key to integration with SatuSehat. The following is an example of how you can create and send a FHIR Patient resource using Node.js and the axios library:

The following is an example of how you can create and send a FHIR Patient resource using Node.js and the axios library:

const axios = require('axios');

async function kirimPasienKeSatuSehat(pasien) {
  const fhirPatient = {
    resourceType: 'Patient',
    identifier: [
      { system: 'https://fhir.kemkes.go.id/id/nik', value: pasien.nik },
      { system: 'https://fhir.kemkes.go.id/id/ihs-number', value: pasien.ihsNumber }
    ],
    name: [{ use: 'official', text: pasien.namaLengkap }],
    gender: pasien.jenisKelamin === 'L' ? 'male' : 'female',
    birthDate: pasien.tanggalLahir,
    address: [{ text: pasien.alamat, city: pasien.kota, country: 'ID' }]
  };

  try {
    const response = await axios.post(
      'https://api-satusehat.kemkes.go.id/fhir-r4/v1/Patient',
      fhirPatient,
      {
        headers: {
          'Content-Type': 'application/fhir+json',
          Authorization: `Bearer ${process.env.SATUSEHAT_TOKEN}`
        }
      }
    );
    console.log('Patient terkirim:', response.data.id);
    return response.data;
  } catch (error) {
    console.error('Gagal mengirim Patient:', error.response?.data || error.message);
    throw error;
  }
}

Make sure every FHIR resource is validated against the applicable profiles (for example, Patient and Encounter from the Ministry of Health) before being sent. Store the ID returned from SatuSehat in the local database as a reference so that two-way synchronization can be carried out without data duplication.

Practical Tips for EMR Implementation in Accordance with SNARS

First, start with standards mapping. Create a matrix between the SNARS assessment elements (for example, MIRM 1–16) and the technical features to be built. Each element must have auditable implementation evidence, such as access logs, electronic signatures, or document versions. Involve the medical records team and quality committee from the start so that clinical requirements are not misinterpreted by the IT team.

Second, apply the principles of least privilege and encryption at both the database and application levels. Use strict role-based access control (RBAC), encrypt sensitive data (AES-256 for data at rest, TLS 1.3 for data in transit), and rotate keys regularly. Do not forget to create encrypted backups and test the restore process at least once every six months to meet data management standards.

Third, conduct gradual trials in one service unit before full go-live. Gather user feedback, measure system response times, and ensure that downtime does not disrupt services. Prepare manual fallback procedures if the system has problems, and document every configuration change in version notes. That way, the SNARS audit will be easier because every step is properly documented.

FAQ

Is an electronic signature mandatory for EMR?

Yes. SNARS requires authentication of medical record data entries. A certified electronic signature (such as e-Sign BSrE) meets the requirements for integrity and non-repudiation, so it can replace a wet signature on electronic medical record documents.

How can you ensure that the audit trail cannot be manipulated?

Store logs in append-only storage or use a hash chain (each entry stores the hash of the previous entry). Restrict write access to the application only, and send copies of logs to a separate server periodically to prevent deletion by system administrators.

Is SatuSehat integration optional?

For healthcare facilities that work with BPJS and the Ministry of Health, interoperability with SatuSehat is generally a regulatory obligation. In addition, this integration speeds up the exchange of referral data and improves patient safety, so it is highly recommended even if it is implemented gradually from a technical standpoint.

How long must medical record data be stored?

In accordance with the Minister of Health Regulation, inpatient medical records must be stored for at least 5 years from the date of the last visit, while discharge summaries must be stored for 25 years. For electronic data, ensure that retention and destruction are scheduled and recorded in official minutes so that compliance is maintained during audits.

Conclusion

EMR implementation in accordance with SNARS is not merely about buying software, but about building sustainable data governance, security, and interoperability. With a well-organized audit trail, strong encryption, and FHIR integration with SatuSehat, healthcare facilities can meet MIRM standards while improving service quality. Do not delay this step—start with needs mapping, limited trials, then scale gradually.

Need technical assistance? Our team is ready to help you design EMR architecture, prepare SNARS compliance documents, and integrate SatuSehat. Consult your healthcare facility's needs now and ensure that EMR implementation runs smoothly, securely, and audit-ready.

This article is part of the knowledge base of Nugroho Setiawan, an IT consultant in Jogja (Yogyakarta). Related solutions: SIMRS (Hospital Information System) Clinic Management System SatuSehat Integration. Need a free consultation?