Data privacy in EHR systems: A TCCM systematic literature review of practices in developing countries

Abstract

To examine how data privacy is addressed in electronic health record (EHR) systems across developing countries using the TCCM (Theory-Context-Characteristics-Methodology) framework. A systematic literature review was conducted following PRISMA 2020 guidelines. Searches were conducted across five databases (Scopus, PubMed, Web of Science, IEEE Xplore, and Google Scholar) for studies published between 2010 and 2025. Eligible studies were synthesised thematically using the TCCM framework A total of 19 studies met the inclusion criteria. Most studies addressed data privacy descriptively, with limited use of theoretical models. The primary barriers to privacy were found to be legal and infrastructural weaknesses, rather than technological gaps. Privacy-by-design was inconsistently applied, and methodological variation limited comparability across studies. Interpretation Strengthening EHR privacy in developing countries requires the development of integrated legal frameworks, enhanced infrastructure, embedded privacy design, and theory-informed research. The TCCM framework provides a structured lens for advancing policy and research agendas in this domain. • Data privacy in EHR systems is inconsistently addressed in developing countries. • Legal gaps and weak infrastructure often outweigh technical limitations. • Few studies use formal theoretical frameworks to study privacy. • Privacy-by-design is rare but emerging through tools like blockchain. • The TCCM framework provides a structured way to evaluate privacy practices.