Implementation of information security and confidentiality policies, procedures, and standards

The article describes one approach to developing and implementing a security program in response to the birth and growth of a computer-based patient record in a large teaching hospital. The discussion emphasizes the importance of the collaborative effort between the hospital and school of medicine in establishing one policy and set of standards because information is shared and electronically transferred between both institutions. The hospital's approach is summarized in five major steps: survey and literature search, development of key components or recommendations, institutional approval of the recommendations, feasibility analysis and projected time frame for implementation, and implementation of the recommendations with resolution of impediments to implementation.