Medical Organization Information Security Management Based on ISO27001 Information Security Standard

摘要

Most of the information security events inmedical organizations are due to improper management.This is a clear indication that the security of information isan issue related to information and communicationtechnology and a management issue as well. In a review ofliterature, most research on information security hasfocused on information and communication technologyissues, such as network security and access control; rarelyaddressing issues at the management-level. The mainpurpose of this study is to construct a mechanism for themanagement of information with regard to security as itapplies to medical organizations. This mechanism is basedon the eleven control items and one hundred thirty-threecontrol objectives of the ISO27001 information securitymanagement standard. This study analyzes and identifiesthe most common events related to information security inmedical organizations and categorizes these events as highrisk,transferable-risk, and controlled-risk to facilitate themanagement of such risk.