基于等级保护要求的三级医院信息安全平台设计  

Design of the platform of information safety of tertiary hospital on the basis of the requirement of grade protection

作　　者：王能才 王玉珍 冯宝义 韦哲 李洪威[1] WANG Neng-cai;WANG Yu-zhen;FENG Bao-yi(Department of Information,The 940th Hospital of PLA Joint Service Support Force,Lanzhou 730050,China)

机构地区：[1]联勤保障部队第九四〇医院信息科,甘肃兰州730050 [2]兰州理工大学电气工程与信息工程学院,甘肃兰州730050

出　　处：《中国医学装备》2020年第10期4-7,共4页China Medical Equipment

基　　金：甘肃省民生课题(1303FCMA018)“远程会诊医疗信息服务平台建设与示范应用”。

摘　　要：目的:设计基于等级保护要求的三级医院信息安全平台,确保医院信息系统(HIS)安全防护,做好医院医疗数据安全存储和容灾备份。方法:通过部署态势感知系统、数据库审计、边界防火墙、安全沙箱等软件和硬件设备,对医院全网进行分区分域安全设计,结合物理区域监控、防盗报警系统,阻止非法用户的各种临近攻击。结果:医院信息安全平台能够检测、监控来自内部操作性攻击、外部黑客的恶意攻击和系统漏洞侦查,保障HIS免受各种威胁。结论:三级医院信息安全平台的建立,能够有效防控患者医疗信息泄露,并在威胁造成损害后,安全平台能够迅速使医院业务系统恢复正常运行。Objective:To design a platform of information safety of the tertiary hospital based on the requirement of grade protection so as to ensure the safety protection of hospital information system,and realize well secure storage and disaster recovery backup for medical data of hospital.Methods:The safety of the whole network of hospital was designed as separate district and separate domain through deploying a series of software and hardware equipment such as situation awareness system,database audit,boundary firewall,security sandbox and others.And these could combine with physical region monitoring and guard against theft and alarm system to hold back various close-in attacks of illegal users.Results:The platform of information safety of hospital could test and monitor the operational attack from interior,the hostile attack of external hackers and system vulnerability investigation so as to guarantee HIS to avoid various threats.Conclusion:The establishment of information safety platform of the tertiary hospital can effectively prevent and control the leakage of medical information of patients,and can quickly restore the normal operation of the business system of hospital after the threat causes the damage.

关 键 词：三级医院 三级等级保护 信息安全平台 安全策略 

分 类 号：R-058[医药卫生]