title: Business Model for the Security of a Large-Scale PACS, Compliance with ISO/27002:2013 Standard.
abstract: Data security is a critical issue in an organization; a proper information security management (ISM) is an ongoing process that seeks to build and maintain programs, policies, and controls for protecting information. A hospital is one of the most complex organizations, where patient information has not only legal and economic implications but, more importantly, an impact on the patient's health. Imaging studies include medical images, patient identification data, and proprietary information of the study; these data are contained in the storage device of a PACS. This system must preserve the confidentiality, integrity, and availability of patient information. There are techniques such as firewalls, encryption, and data encapsulation that contribute to the protection of information. In addition, the Digital Imaging and Communications in Medicine (DICOM) standard and the requirements of the Health Insurance Portability and Accountability Act (HIPAA) regulations are also used to protect the patient clinical data. However, these techniques are not systematically applied to the picture and archiving and communication system (PACS) in most cases and are not sufficient to ensure the integrity of the images and associated data during transmission. The ISO/IEC 27001:2013 standard has been developed to improve the ISM. Currently, health institutions lack effective ISM processes that enable reliable interorganizational activities. In this paper, we present a business model that accomplishes the controls of ISO/IEC 27002:2013 standard and criteria of security and privacy from DICOM and HIPAA to improve the ISM of a large-scale PACS. The methodology associated with the model can monitor the flow of data in a PACS, facilitating the detection of unauthorized access to images and other abnormal activities.
authors: Subdirección de Investigación Tecnológica, Instituto Nacional de Rehabilitación, Av. México Xochimilco 289, Col. Arenal de Guadalupe Tlalpan, 14389, México, D. F., Mexico, gtzmtzjos@gmail.com.
authors: Josefina
authors: J
authors: Gutiérrez-Martínez
authors: Marco Antonio
authors: MA
authors: Núñez-Gaona
authors: Heriberto
authors: H
authors: Aguirre-Meneses
mesh_terms: D003132:Commerce; D016494:Computer Security / Q000331:legislation & jurisprudence* / Q000592:standards*; D003219:Confidentiality / Q000331:legislation & jurisprudence* / Q000592:standards*; D006801:Humans; D011873:Radiology Information Systems / Q000331:legislation & jurisprudence* / Q000592:standards*; D014481:United States
references: J Med Syst. 2013 Feb;37(1):9897
references: 23321959
references: J Med Syst. 2013 Feb;37(1):9924
references: 23321964
references: J Digit Imaging. 2013 Dec;26(6):1040-4
references: 23852637
references: J Digit Imaging. 2014 Feb;27(1):19-25
references: 23917863
references: Comput Med Imaging Graph. 2003;27(2-3):185-96
references: 12620309
references: Comput Med Imaging Graph. 2005 Mar-Apr;29(2-3):235-41
references: 15755540
references: Int J Med Inform. 2009 Dec;78(12):815-26
references: 19783203
references: J Digit Imaging. 2012 Aug;25(4):471-9
references: 22692771