Hospital Information Security Association Releases Guidelines on Managing Insider Threats in Medical Institutions
IT DAILY ·
✦ AI Summary
The Korea Hospital Information Security Association (K-HISA) announced on the 13th that it had published the "Guidelines and Casebook for Managing Insider Threats in Medical Institutions." This guideline is intended to support medical institutions in responding to insider threats and proposes supplemental measures centered on privilege verification. The five core controls are access control based on the treatment relationship, emergency exception access (Break Glass), abnormal behavior detection and access log review, dynamic screen watermarking, and real-time alerts for high-risk access.
The Korea Hospital Information Security Association (K-HISA) announced on the 13th that it had published the "Guidelines and Casebook for Managing Insider Threats in Medical Institutions." The purpose of the publication is to support medical institutions in responding to insider threats.
Recently, incidents have continued in which employees with legitimate access rights at medical institutions viewed or leaked patient information for unauthorized purposes. Because of the nature of insider access records, such acts remain logged by the system as normal activity, making it difficult to detect insider viewing using access control and DLP systems alone.
The association said that a response focused only on hacking and external leaks has limitations. Accordingly, it proposed guidelines centered on privilege verification, saying that additional measures are needed to address insider threats.
The guidelines present five core controls: access control based on the treatment relationship, emergency exception access (Break Glass), abnormal behavior detection and access log review, dynamic screen watermarking, and real-time alerts for high-risk access.
The guidelines divide the five core controls into required and recommended measures, making phased application possible depending on hospital size and conditions. They also reflect the fact that broad viewing privileges are unavoidable in fast-paced care settings such as emergency rooms.
For those settings, the guidelines make post hoc verification based on reason logging and post-audit review the principle, rather than imposing advance restrictions. In responding to leaks caused by smartphone photography, they did not adopt a blanket ban on personal devices, and they proposed displaying a watermark with the viewer's information on the screen and detecting repeated access as recommended deterrents.
The association included an appendix to support practical application of the guidelines. The appendix contains 21 self-check items, 15 anomaly-detection rules, and four domestic and overseas cases. The names of the institutions in the cases were anonymized to protect member hospitals, and the cases were organized into the structure of method, reason for undetected activity, and implications so that each hospital can use them for self-inspection.
The association plans to distribute printed copies of the guidelines. Distribution will take place at the site of the "2026 Hospital Information Security Association Fall Seminar," to be held at Yonsei Medical Center from the 15th to the 16th. This year's fall seminar theme is "Information Protection in the Age of AI Digital Healthcare - Cyber Resilience and Data Protection Strategies for Patient Safety."
Kim Jin-eung, president of the Hospital Information Security Association, said insider threats are a common challenge in the field of medical information protection. He added that, as AI and digital transformation accelerate, the importance of managing personnel with access to data will increase, and said he hopes the guidelines will be used as a practical inspection tool for member hospitals.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242171
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.