A Study of the Integrated Architecture of Hospital Information and Communication Security based on the BS7799 Standard_full

隨著社會環境的變遷、全民健保的實施以及醫療院所間彼此的激烈競爭，醫療院所的經營面對前所未有的衝擊及挑戰。醫療院所為因應上述的挑戰，也紛紛導入資訊科技以期有效提升經營績效，並增加組織的競爭優勢。然而，由於大部份醫療相關的系統在開發時都缺乏良好的規劃設計，同時未能考量未來整合性、擴充性、管理性及整體安全性上的需求，因此，常常造成後續系統維護人員系統維護及管理上的困擾。此外，雖然病歷資料的數位化可有效的提升對於病患健康照護的品質，但另一方面也衍生出安全管理以及病患隱私權保護的問題。縱觀目前國內關於醫院資訊安全方面的相關研究還是相當的不足，且缺乏一個整體的安全架構設計，導致醫院組織對於各種威脅的承受度及應變能力非常的薄弱。因此，本研究的主要目的，是以英國國家標準協會(British Standard Institute, BSI)所制定之BS7799資訊安全規範標準規範作為本研究的基礎，同時考量現有有限資源、技術條件以及醫療產業特殊性的要求，主要針對醫療院所防毒、防駭（包含部份隱私權保護之議題）之需求，探討BS7799實際應用於國內醫療院所資訊安全評估作業的適用性，並依據現行學者專家所提出之安全管理機制與技術建置出一個適用於醫療機構整合性資訊安全的架構。冀望本研究之研究成果能提供實務界與學術界，醫療機構資訊安全議題上研究之參考。
Due to the rapid change in the health care industry and social environment, those health care enterprises are enforced to deal with all challenges and problems occurred in this specific industry. To quickly response those challenges mentioned above, those enterprises aggressively adopt information technologies to improve their management performance and competitive advantages. However, because the systems involved in the efficient improvement of hospital enterprise are not designed properly, it causes a lot of problems coming from the poorly design of the integration, extensibility,
management and security issues. Besides, the privacy protection of the computerized medical records is another issue we have to pay our attention. Although it is extremely important to protect the hospital information security from being illegally modified or accessed, the development of hospital security is still in its infancy stage and lacks of an integrated security architecture. In this research, we hope to utilize the recommendations proposed by the BS7799 as the basis of this research to improve the security of the integrated hospital security. The purposes of this proposal focus on two major topics: first of all, according to the guidelines of BS7799, we develop some hospital security recommendations which are suitable for the improvement of hospital security especially for the threat of virus and hackers (including partial privacy issues). Secondly, we implement a security framework by using current security mechanisms and technologies to improve the global hospital security. This study cannot only provide a good reference for hospitals in developing security hospital framework but also provides valuable empirical data for further research.