Yeng Prosper Kandabongee, Fauzi Muhammad Ali, Sun Luyi, Yang Bian
Department of Information Security and Communication Technology, Norwegian University of Science and Technology, Gjovik, Norway.
JMIR Hum Factors. 2022 May 25;9(2):e30050. doi: 10.2196/30050.
BACKGROUND: The loss of human lives from cyberattacks in health care is no longer a probabilistic quantification but a reality that has begun. In addition, the threat scope is also expanding to involve a threat of national security, among others, resulting in surging data breaches within the health care sector. For that matter, there have been provisions of various legislation, regulations, and information security governance tools such as policies, standards, and directives toward enhancing health care information security-conscious care behavior among users. Meanwhile, in a research scenario, there are no comprehensive required security practices to serve as a yardstick in assessing security practices in health care. Moreover, an analysis of the holistic view of the requirements that need more concentration of management, end users, or both has not been comprehensively developed. Thus, there is a possibility that security practice research will leave out vital requirements. OBJECTIVE: The objective of this study was to systematically identify, assess, and analyze the state-of-the-art information security requirements in health care. These requirements can be used to develop a framework to serve as a yardstick for measuring the future real security practices of health care staff. METHODS: A scoping review was, as a result, adopted to identify, assess, and analyze the information security requirement sources within health care in Norway, Indonesia, and Ghana. RESULTS: Of 188 security and privacy requirement sources that were initially identified, 130 (69.1%) were fully read by the authors. Subsequently, of these 188 requirement documents, 82 (43.6%) fully met the inclusion criteria and were accessed and analyzed. In total, 253 security and privacy requirements were identified in this work. The findings were then used to develop a framework to serve as a benchmark for modeling and analyzing health care security practices. CONCLUSIONS: On the basis of these findings, a framework for modeling, analyzing, and developing effective security countermeasures, including incentivization measures, was developed. Following this framework, research results of health care security practices would be more reliable and effective than relying on incomprehensive security requirements.
背景：医疗保健领域因网络攻击造成的人员伤亡已不再是概率性的量化问题，而是已然开始成为现实。此外，威胁范围也在不断扩大，涉及国家安全威胁等，导致医疗保健行业的数据泄露事件激增。为此，已经出台了各种法律法规以及信息安全治理工具，如政策、标准和指令，以增强用户对医疗保健信息安全的重视。与此同时，在研究场景中，尚无全面的必要安全实践可作为评估医疗保健领域安全实践的标准。此外，对于需要管理层、终端用户或双方更多关注的需求的整体视图分析尚未全面展开。因此，安全实践研究有可能遗漏重要需求。 目的：本研究的目的是系统地识别、评估和分析医疗保健领域的最新信息安全需求。这些需求可用于制定一个框架，作为衡量医疗保健人员未来实际安全实践的标准。 方法：因此，采用了范围综述来识别、评估和分析挪威、印度尼西亚和加纳医疗保健领域的信息安全需求来源。 结果：在最初识别的188个安全和隐私需求来源中，作者完整阅读了130个（69.1%）。随后，在这188份需求文件中，有82份（43.6%）完全符合纳入标准，并被获取和分析。本研究共识别出253项安全和隐私需求。这些结果随后被用于开发一个框架，作为建模和分析医疗保健安全实践的基准。 结论：基于这些发现，开发了一个用于建模、分析和制定有效安全对策（包括激励措施）的框架。遵循这个框架，医疗保健安全实践的研究结果将比依赖不全面的安全需求更加可靠和有效。
Campbell Syst Rev. 2021-5-24
Cochrane Database Syst Rev. 2022-2-1
Int J Qual Health Care. 2021-2-20
Am Soc Clin Oncol Educ Book. 2020-3
Acta Inform Med. 2019-12
Stud Health Technol Inform. 2019
J Biomed Inform. 2019-4-19
Int J Environ Res Public Health. 2019-3-25
BMC Med Inform Decis Mak. 2018-10-16
Stud Health Technol Inform. 2018
Stud Health Technol Inform. 2018
Zotero 插件
