Abstract:Background: The Internet provides many advantages when used for interaction and data sharing among health care providers, patients, and researchers. However, the advantages provided by the Internet come with a significantly greater element of risk to the confidentiality, integrity, and availability of information. It is therefore essential that Health Care Establishments processing and exchanging medical data use an appropriate security policy. Objective: To develop a High Level Security Policy for the processing of medical data and their transmission through the Internet, which is a set of high-level statements intended to guide Health Care Establishment personnel who process and manage sensitive health care information. Methods: We developed the policy based on a detailed study of the existing framework in the EU countries, USA, and Canada, and on consultations with users in the context of the Intranet Health Clinic project. More specifically, this paper has taken into account the major directives, technical reports, law, and recommendations that are related to the protection of individuals with regard to the processing of personal data, and the protection of privacy and medical data on the Internet. Results: We present a High Level Security Policy for Health Care Establishments, which includes a set of 7 principles and 45 guidelines detailed in this paper. The proposed principles and guidelines have been made as generic and open to specific implementations as possible, to provide for maximum flexibility and adaptability to local environments. The High Level Security Policy establishes the basic security requirements that must be addressed to use the Internet to safely transmit patient and other sensitive health care information. Conclusions: The High Level Security Policy is primarily intended for large Health Care Establishments in Europe, USA, and Canada. It is clear however that the general framework presented here can only serve as reference material for developing an appropriate High Level Security Policy in a specific implementation environment. When implemented in specific environments, these principles and guidelines must also be complemented by measures, which are more specific. Even when a High Level Security Policy already exists in an institution, it is advisable that the management of the Health Care Establishment periodically revisits it to see whether it should be modified or augmented.

[A guide to good practice for information security in the handling of personal health data by health personnel in ambulatory care facilities]

Technical guidelines for enhancing privacy and data protection in modern electronic medical environments

Toward the European Health Data Space: The IMPaCT-Data secure infrastructure for EHR-based precision medicine research

Healthcare Security Breaches in the United States: Insights and their Socio-Technical Implications

General Data Protection Regulation in Health Clinics

A Survey of Privacy Awareness of the Health Physical Examination Person and Strategy for the Privacy Protection in Special Health Services

Develop Security Architecture for Both In-House Healthcare Information Systems and Electronic Patient Record

IT Risk Assessment for Group6 Healthcare Clinic Report

A framework for an institutional high level security policy for the processing of medical data and their transmission through the Internet

Legal protection of personal data in the field of health care in Ukraine

Data protection and information security in biomedical research: A sequential explanatory mixed study

Privacy and Security Issues in Mobile Medical Information Systems MMIS

The Health Insurance Portability & Accountability Act and the practice of dentistry in the United States: system security

Security Recommendations for mHealth Apps: Elaboration of a Developer's Guide

Clinical Simulation Program for the Training of Health Profession Residents in Confidentiality and the Use of Social Networks

Evaluating people's concern about their health information privacy based on power-responsibility equilibrium model: A case of Taiwan

BYOD security behaviour and preferences among hospital clinicians - A qualitative study

Privacy Preservation of Electronic Health Records in the Modern Era: A Systematic Survey

Enhancing patient privacy protection under Hong Kong’s Electronic Health Record Sharing System

[Patient's Personal Data Protection Awareness: A Survey of Clinical Nurses]

Draft secure medical database standard