Case study of information security in the field health - University Medical Center Ljubljana

Varstvo informacijske zasebnosti je v medicini izredno pomembno, saj zdravstveno osebje ob vsakem prihodu posameznika v zdravstveno ustanovo vstopa na njegovo najbolj intimno področje. Zaradi narave dela izve bolnikove najbolj osebne podatke, ki jih mora za časa njegovega življenja varovati kot poklicno skrivnost. Z raziskavo smo dokazali, da informacijska varnost v Univerzitetnem kliničnem centru Ljubljana ni na prvem mestu, kar velja tudi za številne druge zdravstvene organizacije po Sloveniji. Koncepti, kot je Safe Mode, imajo sposobnost dviga ravni ozaveščenosti uporabnikovznajo jim predstaviti potencialne grožnje in njihove posledice na razumljiv način, predvsem pa uporabnike lahko naučijo preventivnega vedenja, ki jih lahko zavaruje pred izgubo podatkov in nastankom katastrofalnih posledic. Z magistrsko nalogo smo želeli prikazati realno stanje v slovenskem prostoru na primeru Univerzitetnega kliničnega centra Ljubljana (v nadaljevanju UKC). Rezultati raziskave so pokazali, da je manevrskega prostora za izboljšanje ozaveščenosti veliko, prav tako tehnik, s katerimi bi to lahko dosegli. Preizkusili smo koncept Safe Mode in ga uporabili kot delavnico opismenjevanja za prostovoljne udeležence, zaposlene v UKC-ju. Večina sicer bežno pozna politike, ki urejajo varovanje informacij, vendar pa menijo, da jih protokoli, implementirani za vdrževanje informacijske varnosti, omejujejo, prav tako tudi njihovo delo.Protection information privacy in medicine is extremely important because the medical staff enters into the most intimate area of an individual at each arrival in a medical institution. Thus, medical personnel, due to the nature of its work, learns the most personal information about the patient, which must be protected as a professional secret during his lifetime. The research demonstrated that the information security is not the first concern in this organization, as in many others across Slovenia. Concept as Safe Mode and many others have the ability to raise the level of awareness of users, they can present them with threats and their consequences in a meaningful way, more importantly the fact that users can learn preventative behaviors that can protect against data loss and the occurrence of catastrophic consequences. With this master\u27s thesis we wanted to show the real situation in the slovenian field, using the example of the University Medical Centre Ljubljana. The results showed that there is a lot of room for improvement of awareness, as well as techniques for achieving this. We tested the concept of Safe Mode and used it as a workshop for voluntary participants who are employed at that organization. Most of them were vaguely aware of the policies governing the protection of information, but at the same time believe that the protocols implemented for maintaining information security are restricting them and their work