Investigating the Security of Health-care Information in Iranian Hospitals in Confronting with Threatening Risks

Abstract

BACKGROUND: Like other organizations, hospitals are at risk of information security threats. The implementation and use of various kinds of electronic health records and information systems challenge the privacy and security management of personal care as well as health-care organizations. OBJECTIVE: This survey aims to evaluate information security by focusing on the differences among hospitals based on their size and type. MATERIALS AND METHODS: We conducted a survey, as a cross-sectional study, in 2023. The chief information officers of 165 hospitals in Iran were invited to participate. Furthermore, we designed an online questionnaire based on the ISO/IEC 27002. The scores of the hospitals were analyzed for significant differences in terms of seven factors of this questionnaire with respect to the size and type of hospitals. RESULTS: The 165 participating hospitals had a score of <55% of the maximum possible score (100%). The hospitals with more than 200 beds had the highest level of information security, and the lowest level of information security was far hospitals with 150–200 beds. In all studied hospitals, the highest score was related to the component “Backup and security zones,” and the lowest score was related to the component “Encryption and staging.” Even the analysis based on the number of beds did not change this result. Furthermore, the private and university hospitals were weaker than other hospitals in terms of “organization and risk management” and “protection against attacks.” CONCLUSION: All participating hospitals in this study in Iran had an average score. Therefore, due to the importance of confidentiality of information in the health-care system, it is essential to provide a secure platform for information retention in hospitals. The causes of these threats should also be identified and controlled before experiencing harmful effects. We thus suggest that managers of health-care information and information technology departments in hospitals take appropriate corrective measures in policy development, user training, access control, risk management, as well as physical standards and protection against attacks.