Implementación de un sistema de seguridad de la información en empresa del sector salud

Caso de estudio

Abstract

This research project was based on the design of a set of processes to efficiently manage the confidentiality, integrity, and availability of the information assets of the health service provider, seeking to protect and control the information and ensure through the minimization of the risks that the entity may face. To achieve the design, we worked under the ISO/IEC 27001 standard, which specifies the necessary requirements to establish, implement, maintain, and improve an Information Security Management System (ISMS) according to the well-known "Deming Cycle": PDCA – acronym for Plan, Do, Check, Act (Plan, Do, Verify, Act), this being an approach to continuous improvement. According to Decree 1008 of 2018, official entities in Colombia must establish the general guidelines of the digital government policy and within these guidelines, there is the use of the Information Security and Privacy Model -MSPI; which is based on a risk analysis and the definition of the Risk Treatment Plan that seeks to mitigate the identified risks, avoiding those situations that prevent the achievement of the objectives of the health service provider and the Ministry of Information and Communications Technologies (MINTIC). Through the creation and application of this system, it was possible to protect and safeguard the entity's information, safeguarding the attributes of availability, integrity and availability in compliance with the law and the users' personal data.