The Importance of ISO/IEC27001 Standard and Hospital Information Security Management System

Abstract

            At present, the information system has been used in various business operations to increase work efficiency, speed of service including the accuracy of the information. However, the use of information technology often encounters problems in many areas, such as security systems, data security, or stability of the infrastructure of information systems. Therefore, the security policy of information technology is very important in controlling the risk, such as information technology systems for hospital management. It is the most important system in providing services to patients at Siriraj Hospital. The organization should make the hospital system and infrastructure always highly available, such as the main power supply or backup power supply to the data center made with the standard. To establishing the Disaster Recovery Site (DR Site) to support emergency situations which allow the system to recover quickly. Risk management is an important strategic tool for good business governance principles. This has implemented risk management systems for information in both public and private business units, and the ISO standard has been defined and controlled by international organizations to be an international standard system. The ISO/IEC27001 standard is a guideline for information risk for policy-making and work processes including the appropriate controls for risk management.

            In the hospital business, information systems were developed to be used to collect and store information from various sources. Hospitals applied electronic medical records (Medical Informatics) to increase capacity by linking various databases together such as patient medical records, treatment history, or medication, etc.So, hospital information systems are extremely important. Establishing guidelines for managing information security controls are necessary for the hospital in order to provide the system to be more stable and secure in terms of information security and system reliability. Therefore, we have implemented an information security management system (ISO/IEC27001), which includes information security and related information. This will lead to an effective security management system for the hospital.