ISO 27799-2008 健康信息学.使用ISO/IEC 27002的健康信息安全管理

标准号：ISO 27799-2008
中文标准名称：健康信息学.使用ISO/IEC 27002的健康信息安全管理
英文标准名称：Health informatics - Information security management in health using ISO/IEC 27002
标准类型：C07
发布日期：1999/12/31 12:00:00
实施日期：1999/12/31 12:00:00
中国标准分类号：C07
国际标准分类号：35.240.80
引用标准：ISO/IEC 27002-2005
适用范围：1.1 GeneralThis International Standard defines guidelines to support the interpretation and implementation in healthinformatics of ISO/IEC 27002 and is a companion to that standard2).This International Standard specifies a set of detailed controls for managing health information security andprovides health information security best practice guidelines. By implementing this International Standard.healthcare organizations and other custodians of health information will be able to ensure a minimum requisitelevel of security that is appropriate to their organization's circumstances and that will maintain theconfidentiality, integrity and availability of personal health information.This International Standard applies to health information in all its aspects, whatever form the information takes(words and numbers, sound recordings, drawings, video and medical images), whatever means are used tostore it (printing or writing on paper or electronic storage) and whatever means are used to transmit it (by hand,via fax, over computer networks or by post), as the information must always be appropriately protected.This International Standard and ISO/IEC 27002 taken together define what is required in terms of informationsecurity in healthcare; they do not define how these requirements are to be met. That is to say, to the fullestextent possible, this International Standard is technology-neutral. Neutrality with respect to implementingtechnologies is an important feature. Security technology is still undergoing rapid development and the paceof that change is now measured in months rather than years. By contrast, while subject to periodic review,standards are expected on the whole to remain valid for years. Just as importantly, technological neutralityleaves vendors and service providers free to suggest new or developing technologies that meet the necessaryrequirements that this International Standard describes.As noted in the introduction, familiarity with ISO/IEC 27002 is indispensable for an understanding of thisInternational Standard.1.2 Scope exclusionsThe following areas of information security are outside the scope of this International Standard:a) methodologies and statistical tests for effective anonymization of personal health information;b) methodologies for pseudonymization of personal health information (see bibliographic Reference [10] for an example of an IS~ Technical Specification that deals specifically with this subject);c) network quality of service and methods for measuring availability of networks used for health informatics;d) data quality (as distinct from data integrity).2) This guideline is consistent with the revised version of ISO/IEC 27002:2005.