Abstract: Simple object access protocol or SOAP originally defined as protocol specification for exchanging structured information. SOAP relies on XML for its message format and other application protocols, particularly RPC and HTTP. XML considered as the universal language for data transmission on the Internet, however, end-to-end protection of messages must either be implemented within applications or it can be provided by middleware above the SOAP layer, therefore, SOAP-XML can not provide the level of confidentiality for transferring electronic medical databases. In this paper, we will investigate SOAP protocol structure over XML, the purpose of this paper is identify the possible way towards implementing secure protocol to transfer electronic medical records databases or creating electronic medical records backups over unsecure channels. As a conclusion, SOAP alone can not provide the level of security that medical records databases deserve.