Zarei Javad, Sadoughi Farahnaz
Health Information Management, Health Management and Economics Research Center, School of Health Management and Information Science, Iran University of Medical Sciences, Tehran, Islamic Republic of Iran.
Health Information Management Department, School of Health Management and Information Science, Iran University of Medical Sciences, Tehran, Islamic Republic of Iran.
Risk Manag Healthc Policy. 2016 May 27;9:75-85. doi: 10.2147/RMHP.S99908. eCollection 2016.
In recent years, hospitals in Iran - similar to those in other countries - have experienced growing use of computerized health information systems (CHISs), which play a significant role in the operations of hospitals. But, the major challenge of CHIS use is information security. This study attempts to evaluate CHIS information security risk management at hospitals of Iran.
This applied study is a descriptive and cross-sectional research that has been conducted in 2015. The data were collected from 551 hospitals of Iran. Based on literature review, experts' opinion, and observations at five hospitals, our intensive questionnaire was designed to assess security risk management for CHISs at the concerned hospitals, which was then sent to all hospitals in Iran by the Ministry of Health.
Sixty-nine percent of the studied hospitals pursue information security policies and procedures in conformity with Iran Hospitals Accreditation Standards. At some hospitals, risk identification, risk evaluation, and risk estimation, as well as risk treatment, are unstructured without any specified approach or methodology. There is no significant structured approach to risk management at the studied hospitals.
Information security risk management is not followed by Iran's hospitals and their information security policies. This problem can cause a large number of challenges for their CHIS security in future. Therefore, Iran's Ministry of Health should develop practical policies to improve information security risk management in the hospitals of Iran.
近年来，伊朗的医院——与其他国家的医院类似——经历了计算机化健康信息系统（CHISs）使用的不断增加，这些系统在医院运营中发挥着重要作用。但是，CHIS使用的主要挑战是信息安全。本研究试图评估伊朗医院的CHIS信息安全风险管理。
这项应用研究是一项描述性横断面研究，于2015年进行。数据收集自伊朗的551家医院。基于文献综述、专家意见以及对五家医院的观察，我们设计了详细问卷，以评估相关医院CHISs的安全风险管理，然后由卫生部将问卷发送给伊朗的所有医院。
69%的被研究医院遵循符合伊朗医院认证标准的信息安全政策和程序。在一些医院，风险识别、风险评估、风险估计以及风险处理是无组织的，没有任何特定的方法或方法论。在被研究医院中没有显著的结构化风险管理方法。
伊朗的医院及其信息安全政策没有遵循信息安全风险管理。这个问题可能在未来给它们的CHIS安全带来大量挑战。因此，伊朗卫生部应制定切实可行的政策，以改善伊朗医院的信息安全风险管理。
