Pitfalls and Security Measures for the Mobile EMR System in Medical Facilities
2
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
Objectives: The goal of this paper is to examine the security measures that should be reviewed by medical facilities that are trying to implement mobile Electronic Medical Record (EMR) systems designed for hospitals. Methods: The study of the security requirements for a mobile EMR system is divided into legal considerations and sectional security investigations. Legal considerations were examined with regard to remote medical services, patients’ personal information and EMR, medical devices, the establishment of mobile systems, and mobile applications. For the 4 sectional security investigations, the mobile security level SL-3 from the Smartphone Security Standards of the National Intelligence Service (NIS) was used. Results: From a compliance perspective, legal considerations for various laws and guidelines of mobile EMR were executed according to the model of the legal considerations. To correspond to the SL-3, separation of DMZ and wireless network is needed. Mobile access servers must be located in only the smartphone DMZ. Furthermore, security measures like 24-hour security control, WIPS, VPN, MDM, and ISMS for each section are needed to establish a secure mobile EMR system. Conclusions: This paper suggested a direction for applying regulatory measures to strengthen the security of a mobile EMR system in accordance with the standard security requirements presented by the Smartphone Security Guideline of the NIS. A future study on the materialization of these suggestions after their application at actual medical facilities can be used as an illustrative case to determine the degree to which theory and reality correspond with one another.
Abstract
Objectives: The goal of this paper is to examine the security measures that should be reviewed by medical facilities that are trying to implement mobile Electronic Medical Record (EMR) systems designed for hospitals. Methods: The study of the security requirements for a mobile EMR system is divided into legal considerations and sectional security investigations. Legal considerations were examined with regard to remote medical services, patients’ personal information and EMR, medical devices, the establishment of mobile systems, and mobile applications. For the 4 sectional security investigations, the mobile security level SL-3 from the Smartphone Security Standards of the National Intelligence Service (NIS) was used. Results: From a compliance perspective, legal considerations for various laws and guidelines of mobile EMR were executed according to the model of the legal considerations. To correspond to the SL-3, separation of DMZ and wireless network is needed. Mobile access servers must be located in only the smartphone DMZ. Furthermore, security measures like 24-hour security control, WIPS, VPN, MDM, and ISMS for each section are needed to establish a secure mobile EMR system. Conclusions: This paper suggested a direction for applying regulatory measures to strengthen the security of a mobile EMR system in accordance with the standard security requirements presented by the Smartphone Security Guideline of the NIS. A future study on the materialization of these suggestions after their application at actual medical facilities can be used as an illustrative case to determine the degree to which theory and reality correspond with one another.
참고문헌 (25)
- Korea Communications Commission, "National information security white paper" (2011), Korea Communications Commission
- "App store metrics" (2012)[URL]
- Ministry of Public Administration and Security, "2011 National informatization white paper", pp.323~326 (2011), Ministry of Public Administration and Security
- Min JH., "The study of security measures of threat on mobile internet environment", 석사, pp.2010
- Jang SJ., "IT planning series : the trend of mobile computing security technology", pp.12~20 (2011), National IT Industry Promotion Agency
- Ho AJ., "Security of smartphone pouring", Inf Secur 21C, 114, pp.54~ (2010)
- Park HW., "Start to prepare the security., safe receipt of mobile office", Inf Secur 21C, 124, pp.75~ (2010)
- National Intelligence Service, "Security standards for smartphones for business use by national and public institutions", National Intelligence Service, ~ (2010)
- Poon EG., "Effect of bar-code technology on the safety of medication administration", N Engl J Med, 362, pp.1698~1707 (2010)
- Paoletti RD., "Using bar-code technology and medication observation methodology for safer medication administration", Am J Health Syst Pharm, 64, pp.536~543 (2007)
- Ministry of Health and Welfare., "Medical facility personal information protection guideline", Ministry of Health and Welfare, ~ (2010)
- Ministry of Public Administration and Security., "Notification of privacy impact assessment(2011-39)", Ministry of Public Administration and Security, ~ (2011)
- Korea Food and Drug Administration., "Mobile PACS licensing examination guideline", Korea Food and Drug Administration, ~ (2011)
- Security measures for safe use of wireless-LAN, "Choi MG.", National Cyber Security Center, ~, pp.Report No.: NCSC-TR050021 (2005)
- Hacking Response Team., "Wireless LAN security guide", Korea Internet and Security Agency, ~ (2010)
- Smartphone security guide in the banking sector, "Center for Cyber Response.", Financial Security Agency, ~, pp.Report No.: FSA 2010-2008 (2010)
- Information system SW development security guide, "Ministry of Public Administration and Security.", Ministry of Public Administration and Security, ~, pp.Reg. No.: 11-1311000-000330-0310 (2011)
- Ministry of Public Administration and Security., "Information system establishment and operation guideline (2012-12)", Ministry of Public Administration and Security, ~ (2012)
- Public SW Security Team., "Mobile application security certification guide v1. 0", Korea Internet and Security Agency, ~ (2011)
- Ministry of Public Administration and Security., "Standards for measures to warrant security of personal information(2011-43)", Ministry of Public Administration and Security, ~ (2011)
- Korea Communications Commission, "Guide to using smartphone vaccine", Korea Communications Commission, ~ (2011)
- Park JH., "The latest IT trend : the core of multiplatform mobile strategy, MDM solution" (2012), National IT Industry Promotion Agency
- Security threat of mobile office and MDM solution, "Min SS.", Financial Security Agency, ~, pp.Report No.: TM-01 (2011)
- Issue report: information security and Introduction of personal information management framework, "Kim YT.", Financial Security Agency, ~, pp.Report No.: vol. 2011-017 (2011)
- Ministry of Public Administration and Security., "The e-government ISMS certification guideline (2010-178)", Ministry of Public Administration and Security, ~ (2010)