Assessing and Comparing Information Security in Swiss Hospitals

Abstract

BackgroundAvailability of information in hospitals is an important prerequisite for good service. Significant resources have been invested to improve the availability of information, but it is also vital that the security of this information can be guaranteed.ObjectiveThe goal of this study was to assess information security in hospitals through a questionnaire based on the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standard ISO/IEC 27002, evaluating Information technology – Security techniques – Code of practice for information-security management, with a special focus on the effect of the hospitals’ size and type.MethodsThe survey, set up as a cross-sectional study, was conducted in January 2011. The chief information officers (CIOs) of 112 hospitals in German-speaking Switzerland were invited to participate. The online questionnaire was designed to be fast and easy to complete to maximize participation. To group the analyzed controls of the ISO/IEC standard 27002 in a meaningful way, a factor analysis was performed. A linear score from 0 (not implemented) to 3 (fully implemented) was introduced. The scores of the hospitals were then analyzed for significant differences in any of the factors with respect to size and type of hospital. The participating hospitals were offered a benchmark report about their status.ResultsThe 51 participating hospitals had an average score of 51.1% (range 30.6% - 81.9%) out of a possible 100% where all items in the questionnaire were fully implemented. Room for improvement could be identified, especially for the factors covering “process and quality management” (average score 1.3 ± 0.8 out of a maximum of 3) and “organization and risk management” (average score 1.3 ± 0.7 out of a maximum of 3). Private hospitals scored significantly higher than university hospitals in the implementation of “security zones” and “backup” (P = .008).ConclusionsHalf (50.00%, 8588/17,177) of all assessed hospital beds in German-speaking Switzerland are in hospitals that have a score of 49% or less of the maximum possible score in information security. Patient data need to be better protected because of the data protection laws and because sensitive, personal data should be guaranteed confidentiality, integrity, and availability.

Measuring Cyber Security Awareness within Groups of Medical Professionals in Poland

“…by verifying how hospitals comply with the ISO/IEC 27002 standard; however, the results also indicate that the audited hospitals have a low level of security. Another recently published work by Jalali and Kaiser [19], who studied cyber security in hospitals using a series of interviews, shows that one of the reasons is the end point complexity of the systems applied. This might be the case in Poland where numerous different applications are used, making it more difficult to create training programs for medical professionals that will cover all possible scenarios.…”

“…Their analysis shows that efforts to homogenise resource availability across hospitals reduce the probability of a cyberattack. In Europe, Landolt et al [19] evaluated the current status of information security in Swiss hospitals. The results showed very low scores, particularly for basic security issues.…”

Information security in healthcare supply chains: an analysis of critical information protection practices

“…However, that does not mean IS in HSCs also has to lag behind, because healthcare involves highly personal information. Depending on the seriousness of the breach, it could mean the end of a healthcare assistance organization (Hedström et al, 2011;Landolt et al, 2012;Huang et al, 2014).…”

“…IT has an increasingly important role in the field of healthcare assistance, due to the need to provide information in a timely manner for decision-making, as well as protect patient information. However, whatever of the cost of ensure information security, the cost of failing to protect patient information may be more expensive (Landolt et al, 2012;Samy et al, 2010). Healthcare professionals often require rapid access to patient information, and the delivery of that information may not always be in compliance with organizational and industry Information Security standards (Hedström et al, 2011;Huang et al, 2014).…”

Overview of Data Security Issues in Hospital Information Systems

“…Information and data in HIS has different values and may be subject to different regulations. In this context, knowing the value, sensitivity, and importance of hospital data allows for prioritizing the protection measures (Landolt et al, 2012). Further, there are an increasing number of internal and external systems exchange data with each other over the Internet, and the data are subject to data protection law and have to protect.…”