Information security in healthcare must account for consequences for care and operations. For one care process, you assess information risks and decide which safeguards are needed, who is responsible and when to review them. Your plan supports discussion between senior leadership, clinical leads and information security.
For one care process, examine the information, systems and providers it needs. Assign safeguards and decisions to clinical, technical and management roles, and record fallback procedures and handovers.
In the course case, a diagnostic-results platform may be compromised while reliable results are needed for urgent care. Compare isolation, restricted operation and a paper procedure, including their prerequisites. Choose a provisional option and set a review point and assign clinical and technical responsibilities for it. The course covers the German and European context; applicable legal requirements, including data protection, require separate assessment.
What you will work on
Map information dependencies and care consequences for one process
Prioritise controls according to information risk and consequences for care
Assess the impact of isolation and fallback procedures on access to results
Who it is for
Leaders of healthcare organisations
Information security officers in healthcare
Leads for clinical processes and IT governance
Topics
Care processes and information needs
Availability, integrity and confidentiality
Clinical, technical and external dependencies
Protective measures and conflicts with care
Management decisions, evidence and review
Your result
Your procedure for the care process records information needs, safeguards, responsibilities and fallback arrangements. You can develop it further with clinical, technical and management leads.
Prerequisites
Basic knowledge of information security or healthcare management and authorised access to process information. Personal health data are not required; a course case may be used.
Format and approach
Planned as eight to ten hours of self-paced study with a written process analysis and self-checks with explanations.
Identify risks in your area and prepare management decisions on whether to treat or accept them. Your risk register sets out causes and consequences; your treatment plan records responsibilities, resources and decisions still needed.
After a cyberattack, several business processes need to resume. Develop a recovery plan with a sequence, release conditions and fallback routes. In the case, revise the sequence when data has been manipulated.
Plan the annual information security programme for your area: which objectives and risks come first, and what actions and resources are needed? A management review template helps you present the decisions and supporting evidence to leadership.