医院信息系统安全政策的制定方法  

How to Establish the Hospital Information System Security Policies

作　　者：龚庆悦[1] 施诚[1] 

机构地区：[1]南京中医药大学信息技术学院,江苏南京210046

出　　处：《中国医疗器械杂志》2008年第2期124-125,130,共3页Chinese Journal of Medical Instrumentation

摘　　要：信息安全政策在保护医院信息方面有着重要的作用。制定信息安全政策应综合考虑用户、IT支撑人员和医院管理方的可接受程度,须有一个规范的政策制定程序。每个信息安全政策都应包含制定的理由和适用的对象,须明确用户应遵守的职责以及违反后的惩处规定。对医院起关键作用的信息安全政策有计算机资源使用政策、远程访问政策、信息保护政策、边界安全政策、主机和设备的基本安全政策。安全管理程序是强制执行安全政策的保障,安全事故处理程序是最重要的一个安全管理程序。It is important to establish the hospital information system security policies. While these security policies are being established, a comprehensive consideration should be given to the acceptable levels of users, IT supporters and hospital managers. We should have a formal policy designing process that is consistently followed by all security policies. Reasons for establishing the security policies and their coverage and applicable objects should be stated clearly. Besides, each policy should define user＇s responsibilities and penalties of violation. Every organization will need some key policies, such as of information sources usage, remote access, information protection, perimeter security, and baseline host/device security. Security managing procedures are the mechanisms to enforce the policies. An incident-handling procedure is the most important security managing procedure for all organizations.

关 键 词：信息安全政策 服务器安全政策 安全管理程序 安全事故处理程序 

分 类 号：TN918[电子电信—通信与信息系统]