An organizational view on formulating information security policies in hospitals - Hernan Contreras Pinochet, Luis (O Mundo da Saúde, 2011)
This research aimed at understanding the participation of the managers in the process of devising strategies of a policy on information security, identifying the guiding elements to make an analysis structure about hospitals. The object of this research was composed by five hospitals, chosen according to the following criteria: type, duration and position in the market, and easy access to data. This research used a multi-case and cross-section study design of a contextual and process and exploratory and descriptive nature to create a categorical classification to develop a theory based on data. This research conducted the development of an analysis structure that was named as “Continuous Follow-up Cycle for the Development of a Policy on Information Security about Hospitals”. With this structure, it was possible to identify the duties about the information security in the different organizational levels, defining responsibilities as to the compliance, evaluation and audit verification and implementation and establishing guidelines needed for all the protection measures that will be implemented. As a result, it was observed that the studied hospitals in their different natures showed clear deficiencies to formulate a policy on information security due to the need for clear definitions in the roles of the several organizational groups and for guiding elements for the perception in the decision-making of the managers.