Assessing and comparing information security in swiss hospitals

Area of Science:

• Health Informatics
• Information Security Management
• Hospital Administration

Background:

• Effective hospital service delivery relies on robust information availability.
• Ensuring the security of sensitive hospital information is a critical challenge.
• Significant investments are made in information availability, but security often lags.

Purpose of the Study:

• To assess hospital information security practices in German-speaking Switzerland.
• To evaluate compliance with the ISO/IEC 27002 standard for information security management.
• To analyze the impact of hospital size and type on information security implementation.

Main Methods:

• A cross-sectional study utilizing an online questionnaire distributed to Chief Information Officers (CIOs).
• The questionnaire was based on the ISO/IEC 27002 standard, assessing information security controls.
• Factor analysis was used to group controls, and scores were analyzed for differences based on hospital size and type.

Main Results:

• Participating hospitals achieved an average information security score of 51.1%, indicating substantial room for improvement.
• Key areas needing enhancement include "process and quality management" and "organization and risk management."
• Private hospitals demonstrated higher scores in "security zones" and "backup" compared to university hospitals.

Conclusions:

• Approximately 50% of hospital beds in German-speaking Switzerland are in facilities with suboptimal information security scores (≤49%).
• Enhanced patient data protection is essential due to data protection laws and the need for confidentiality, integrity, and availability of sensitive information.
• There is a clear need to strengthen information security measures across Swiss hospitals to safeguard patient data.