Analysis of Information Security Management Systems at 5 Domestic Hospitals with More than 500 Beds / 대한의료정보학회지

OBJECTIVES: The information security management systems (ISMS) of 5 hospitals with more than 500 beds were evaluated with regards to the level of information security, management, and physical and technical aspects so that we might make recommendations on information security and security countermeasures which meet both international standards and the needs of individual hospitals. METHODS: The ISMS check-list derived from international/domestic standards was distributed to each hospital to complete and the staff of each hospital was interviewed. Information Security Indicator and Information Security Values were used to estimate the present security levels and evaluate the application of each hospital's current system. RESULTS: With regard to the moderate clause of the ISMS, the hospitals were determined to be in compliance. The most vulnerable clause was asset management, in particular, information asset classification guidelines. The clauses of information security incident management and business continuity management were deemed necessary for the establishment of successful ISMS. CONCLUSIONS: The level of current ISMS in the hospitals evaluated was determined to be insufficient. Establishment of adequate ISMS is necessary to ensure patient privacy and the safe use of medical records for various purposes. Implementation of ISMS which meet international standards with a long-term and comprehensive perspective is of prime importance. To reflect the requirements of the varied interests of medical staff, consumers, and institutions, the establishment of political support is essential to create suitable hospital ISMS.

An Awareness Survey on the Protection and Use of Personal Health Information Focused on Applicants for Copies of the Medical Record / 대한의료정보학회지

OBJECTIVE: To supplement a previous study on the management of medical records with a view to preparing a system capable of ensuring basic patient rights regarding the protection of confidential medical information. The study objectives are to provide detailed guidelines to regulate the access and protection of medical information by analyzing patients' understanding and views regarding the dissemination of medical records. METHODS: A self-administered questionnaire was administered to 781 patients who visited five University hospitals located in Seoul, Busan, Gyeonggi, Chungnam and Jeonnam from July to September, 2008 and asked for copies of medical records to be issued. Data were analyzed by using the statistical program SPSS 13.0. RESULTS: More than 70% of respondents wanted to access their medical records after confirming the required documents. The highest distribution in the range of persons able to receive copies of medical records without the individual patient's consent or required documents was 'only personally' in each variable. Copies of medical records were issued mostly within 1 hour, while the appropriate time of issuing the copies was within one day. Half of respondents approved of a subscription system that did not require a doctor consultation. The results regarding changes in the ways to request/issue copies of medical records to improve the convenience for applicants differed significantly according to age. CONCLUSION: Considering the sensitivity of personal health information, medical records should only be issued with the patient's consent and by confirming the identity of the designated person with required documents. Furthermore, people should be aware of the importance of protecting personal health information, and medical institutes should inform the requirements for bringing the relevant documents. Medical institutes play an important role in protecting personal records, which necessitates generalized guidelines.