Planning and Formulation of Security Policy for Royal Melbourne Hospital

PLANNING AND FORMULATION OF SECURITY POLICY 1
PLANNING AND FORMULATION OF SECURITY POLICY FOR ROYAL
MELBOURNE HOSPITAL
Student Name
Tutor
Institutional Affiliations
State
Date

PLANNING AND FORMULATION OF SECURITY POLICY 2
Executive summary
Information system is obligatory for organizations in the current era. We have
experienced drastic change in the way data is generated and managed. This has also changed the
way people interact not only at personal level but also at organizational level. We have amassed
significant benefits from the new era but it is associated with its challenges in terms of privacy
and information security. This is also reflected by the ever growing legislations on information
security around the world.
As a national healthcare organization that is committed high quality healthcare services,
Royal Melbourne Hospital has a legal, ethical as well as professional duty to ensure that sensitive
data it holds for its clients conforms to integrity, confidentiality and availability principles. The
organization is obliged to ensure that the information it holds is secured from any form of
security breach. Following this rationale, the purpose of this document is to research, formulate,
develop and document basic security policies for the organization. The policies will be the
cornerstone of Royal Melbourne healthcare to enhance and manage its information security
procedures.
Table of Contents

PLANNING AND FORMULATION OF SECURITY POLICY 3
Executive summary........................................................................................................ 2
Table of Contents........................................................................................................... 3
PLANNING AND FORMULATION OF SECURITY POLICY FOR ROYAL MELBOURNE
HOSPITAL................................................................................................................... 4
Introduction.................................................................................................................. 4
Security incidents in information system............................................................................. 4
Security policies............................................................................................................. 5
The system access security policy plan................................................................................6
Security policies for information system access.....................................................................6
Doctors......................................................................................................................... 7
Purpose.................................................................................................................. 7
Policy..................................................................................................................... 7
Nurses.......................................................................................................................... 7
Purpose.................................................................................................................. 8
Policy..................................................................................................................... 8
System administrators..................................................................................................... 8
Purpose.................................................................................................................. 8
Policy..................................................................................................................... 8
Managing information system security policy......................................................................8
POTENTIAL THREATS AND VULNERABILITY OF INFORMATION SYSTEM...................9
How the threats can be mitigated..................................................................................... 10
Conclusion.................................................................................................................. 10
References.................................................................................................................. 11

PLANNING AND FORMULATION OF SECURITY POLICY 4
PLANNING AND FORMULATION OF SECURITY POLICY FOR ROYAL
MELBOURNE HOSPITAL
Introduction
Information system of any healthcare organization requires full protection to ensure that
no unauthorized personnel are capable of accessing anything about it. It therefore needs many
procedures and policies to help in accessing and managing information. There are important
details of patients that should not easily be accessed by hackers or stakeholders of any other
organization. Health records should be stored in a safeguarded database since they carry delicate
information. The information security of Royal Melbourne hospital was realized to be low and
can therefore easily experience threats (Puthal, Nepal, Ranjan and Chen, 2016, pp.64-71). They
were making use of windows XP software which was not regularly updated and therefore was
encrypted by unknown personnel.
It is true that every organization has got important information that should be protected
from cybercriminals. This vital information is always protected by strategies and controls. The
process of implementing the laid down policies requires attention of employees such as
clinicians, nurses and professional experts in administration. The management process involves
monitoring the manners of the personnel within the organization.
Security incidents in information system
The hospital experiences a number of incidences of threats in the information system. In
the first case, there exists violence in the department of emergency as reported by nursing staff,
which has increased to the level that calls for total attention (Ferns, 2012, pp12.). This has raised
the incidences of injury presentations. The main causes of violence is said to be influence of
drugs and alcohol. Appropriate policies are therefore required to deal with the risk.
The second incidence is ransomware which is a universal threat hindering business
steadiness as well as reliability of identifiable evidences that are much sensitive at individual
level. More than 1500 files of patients could not be accessed after experiencing an attack which
interfered with the data. Even after payment to the attackers, some files could still not be
accessed containing sensitive medical reports that were to be used in identifying theft. The