Information security risk management for computerized health information systems in hospitals: a case study of Iran

Abstract

BackgroundIn recent years, hospitals in Iran – similar to those in other countries – have experienced growing use of computerized health information systems (CHISs), which play a significant role in the operations of hospitals. But, the major challenge of CHIS use is information security. This study attempts to evaluate CHIS information security risk management at hospitals of Iran.Materials and methodsThis applied study is a descriptive and cross-sectional research that has been conducted in 2015. The data were collected from 551 hospitals of Iran. Based on literature review, experts’ opinion, and observations at five hospitals, our intensive questionnaire was designed to assess security risk management for CHISs at the concerned hospitals, which was then sent to all hospitals in Iran by the Ministry of Health.ResultsSixty-nine percent of the studied hospitals pursue information security policies and procedures in conformity with Iran Hospitals Accreditation Standards. At some hospitals, risk identification, risk evaluation, and risk estimation, as well as risk treatment, are unstructured without any specified approach or methodology. There is no significant structured approach to risk management at the studied hospitals.ConclusionInformation security risk management is not followed by Iran’s hospitals and their information security policies. This problem can cause a large number of challenges for their CHIS security in future. Therefore, Iran’s Ministry of Health should develop practical policies to improve information security risk management in the hospitals of Iran.

Cybersecurity in Hospitals: A Systematic, Organizational Perspective (Preprint)

“…Similar vulnerabilities in hospitals are also observed in other countries [13][14][15][16]. Specifically, pressure from the board of directors appears to be essential in creating substantive cyber-resiliency, as research shows that hospital management support is essential for user compliance with information security policies, which in turn are written by healthcare IT security professionals [17,18].…”

Cybersecurity in Hospitals: A Systematic, Organizational Perspective

“…Furthermore, significant variability in cybersecurity as a priority has been observed throughout the hospital industry-in the United States, 70% of hospital boards include cybersecurity in their risk management oversight, and only 37% of hospitals perform annual incident response exercises [12]. Similar vulnerabilities in hospitals are also observed in other countries [13][14][15][16]. Specifically, pressure from the board of directors appears to be essential in creating substantive cyber resiliency, as research shows that hospital management support is essential for user compliance with information security policies, which in turn are written by health care IT security professionals [17,18].…”

Information Security Risk Management for BIDUK System

“…Several studies has been performed to explore IS risk management in organization. Study [15] explores IS risk management for some hospitals in Iran. They found that only eight hospitals have framework for IS risk management, but lacks in systematic approach.…”