Evaluation of Electronic Medical Records Risk Management in Kudus Hospitals: A Comparative Qualitative Study

The rapid expansion of digital health infrastructure has positioned electronic medical records (EMR) as a core element of service continuity, clinical decision-making, and data governance, yet the maturity of EMR risk management in many developing health systems remains uneven and weakly institutionalized. This study evaluates and compares EMR risk management practices in two Indonesian hospitals, mapping how organizational capability, system architecture, and regulatory context shape maturity progression and digital resilience. A comparative qualitative design was applied using semi-structured interviews, focus groups, non‑participant observation, and document review in a regional public hospital (DK) and a private hospital (AK). Data were thematically coded and triangulated, then interpreted through the HIMSS EMRAM maturity model, PDCA cycle, and SWOT analysis to assess governance readiness and risk‑mitigation capability. DK Hospital demonstrated more advanced EMR maturity (transitioning toward EMRAM Stage 5 with approximately 50% paperless workflows), structured PDCA-based monitoring, and a formalized risk taxonomy spanning technical, human, regulatory, and operational domains. AK Hospital adopted a modular EMR development strategy that increased flexibility but generated integration gaps, documentation weaknesses, and stronger dependency on key IT personnel. Both hospitals shared critical vulnerabilities related to human error, hybrid paper–electronic environments, fragmented incident documentation, and persistent uncertainty around electronic signature regulation. The findings show that EMR risk management maturity is determined less by technology acquisition than by multi-level governance, continuous monitoring loops, and the ability to manage uncertainty in complex socio‑technical systems. By integrating EMRAM, PDCA, and SWOT perspectives, this study proposes an evidence‑based roadmap for strengthening EMR risk governance in Indonesian hospitals and provides transferable insights for digital hospital resilience in other low‑ and middle‑income health systems.