Standards and Guides for Implementing Security and Privacy for Health Information Technology

Abstract

In this chapter, the authors survey security standards and guides applicable to healthcare industry including control objective for information and related technologies (COBIT), ISO/IEC 27001:2005 (which has been revised by ISO/IEC 27001:2013), ISO/IEC 27002:2005 (which has been revised by ISO/IEC 27002:2013), ISO 27799:2008 (which has been revised by ISO 27799:2016), ISO 17090:2008 (which has been revised by ISO 17090:2015), ISO/TS 25237:2008, HITRUST common security framework (CSF), NIST Special Publication 800-53, NIST SP 1800, NIST SP 1800-8, and building code for medical device software security. This survey informs the audience of currently available standards that can guide the implementation of information security programs in healthcare organizations, and provides a starting point for IT management in healthcare organizations to select a standard suitable for their organizations.