A baseline security policy for distributed healthcare information systems

Computers & SecurityPublished 1 January 1997

Dimitris Gritzalis

DOI10.1016/s0167-4048(97)00009-6

Source URL

Citations36

SJR quartileQ1

SJR score1.45

SNIP2.27

TL;DR

The need for identifying and analyzing the generic security characteristics of a healthcare information system is demonstrated and the analysis of these characteristics is based upon a decision-support roadmap, leading to the development of a baseline security policy for healthcare institutions.

Abstract

In this paper, the need for identifying and analyzing the generic security characteristics of a healthcare information system is, first, demonstrated. The analysis of these characteristics is based upon a decision-support roadmap. The results from this profiling work are then analyzed in the light of the fact that more than 1000 accidental deaths happened due to computer system failures. As a result of this analysis, a set of recommendations is drawn up, leading to the development of a baseline security policy for healthcare institutions. Such a policy should be flexible enough to reflect the local needs, expectations and user requirements, as well as strict enough to comply with international recommendations. An example of such a baseline policy is then provided. The policy refers to a given security culture and has been based upon an abstract approach to the security needs of a healthcare institution.

Keywords

Health Professions

A Comparison of Commercial and Military Computer Security Policies

1,133 Citations1987David D. Clark, David R. Wilson

It is argued that a lattice model is not sufficient to characterize integrity policies, and that distinct mechanisms are needed to Control disclosure and to provide integrity.

Integrity-Oriented Control Objectives: Proposed Revisions to the Trusted Computer System Evaluation Criteria (TCSEC), DOD 5200.28-STD

374 Citations1991Terry Mayfield, John M. Boone +1 more

This document is intended to extend the scope of the TCSEC so that the control objectives, contained therein, will also address the protection of information and computing resource integrity.

Science and Public PolicyComputer-related accidental death: an empirical exploration

56 Citations1994Donald Mackenzie

Physical causes appear to be implicated in up to 4% of the deaths for which data were available, while 3% involved software error, and about 92% failures in human-computer interaction.

PubMedThe need for security--a clinical view.

31 Citations1994Francis H. Roger France, P. N. Gaunt

Although most health professionals would still believe that confidentiality is the main issue, it appears that data integrity and availability are as important in the context of the 'paperless' electronic record.

IFIP advances in information and communication technologyEthics of Computing

30 Citations1996Jacques Berleur, Klaus Brunnstein

Medical InformaticsData security in medical information systems: technical aspects of a proposed legislation

7 Citations1991Dimitris Gritzalis, Sokratis Katsikas +2 more

The results of a recent survey performed among medical establishment personnel in Greece are analyzed, information security legislation existing in other countries are evaluated and guidelines of international societies are incorporated to propose principles governing a future legal framework.

IFIP advances in information and communication technologyA classification of health information systems security flaws

7 Citations1995Dimitris Gritzalis, Ioanna Kantzavelou +2 more

View PDF

IFIP advances in information and communication technologyA human approach to security management in HealthCare

2 Citations1996Helen James, Katerina Andronis +1 more

An approach to computer security management which is people oriented, developed based upon the Soft Systems Methodology (SSM) is presented.

Computers & SecurityCybernetic analysis of national computer security

1 Citations1991Stewart Kowalski

A cybernetic analysis of security models used in four major Western countries using examples of computer security models developed in the U.S., England, Germany and France is given.