Electronic Medical Records (EMR) serve as evidence of the implementation of information technology in healthcare services. To ensure the security of information in electronic medical records, Indonesian Ministry of Health Regulation No. 24 of 2022 on Medical Records, Article 29, outlines three key aspects: confidentiality, integrity, and availability. The objective of this study is to examine data security at Karangploso Community Health Center (Puskesmas Karangploso). This research employs a descriptive qualitative approach. The subjects of the study are users who have access to electronic medical records at Puskesmas Karangploso, while the object is the E-Puskesmas application. The instruments used in this study include interview guidelines and observation guidelines. Data collection was carried out through observation and interviews. The data processing techniques in this research involve data collection, data reduction, data presentation, and conclusion drawing. The analysis used is descriptive. The results of the study focus on the security of electronic medical record data in the E-Puskesmas application based on the aspects of confidentiality, integrity, and availability at Puskesmas Karangploso. In terms of confidentiality, data security is maintained as staff members are required to log in to the E-Puskesmas application using their respective usernames and passwords. Regarding integrity, data security is ensured because data can only be edited by users in their respective sections, and major data deletions or modifications can only be performed by authorized personnel. For availability, data security is also guaranteed, as necessary data can be accessed quickly, and electronic medical records are securely stored in the database without risk of loss for up to 25 years. The conclusion of this study highlights the importance of healthcare facilities in safeguarding patient data within the implementation of electronic medical records, as well as the potential consequences if patient medical record information is leaked and misused by unauthorized parties.