基于风险评估模型的区域卫生信息化环境下医疗信息隐私保护体系研究

Regional health informatization plays an important role in supporting and guaranteeing the new medical health system reform, it is an essential mean to realize medical services accessibility and equalization. In recent years, some provinces and cities, like Beijing, Shanghai, Guangzhou, Zhejiang,et al., have been striving to carry out regional health information construction, and have made breakthrough progress in health facilities interconnection and medical information exchange and sharing. However, with the development of regional health information system, the problem of medical information security and privacy is increasingly prominent, which has been concerned generally by more and more people. If this problem can't be solved, it will cause great economic loss and social influence. This project aims to establish an information privacy protection system that based on laws, management and technology, which meets the development requirements of regional health informatization. Employing risk assessment model, and multi-disciplinary theories and methods, such as management, medicine, law, operational research, information technology and security,et al., are using comprehensively to define the conception, protection scope and specific contexts of medical privacy, build risk assessment index system to know the potential hazards and its degree of medical privacy through the whole process of information collection, storage, transmission, exchange and utilization, determine the critical processes and ways of medical privacy disclosure, and specifically establish targeted protection measures and management decisions, promoting the sustainable and healthy development of regional health informatization.

区域卫生信息化是我国新一轮医改的重要支撑和保障，是实现医疗服务可及化、均等化建设目标的重要手段。近年来，北京、上海、广州、浙江等地努力开展区域卫生信息化建设工作，在区域内医疗机构的互联互通和医疗信息的交换共享方面取得了突破性进展。然而，随着区域卫生信息化的建设与发展，医疗信息隐私保护问题变得日益突出，越来受到人们的普遍关注，如果不加以解决，将会造成巨大的影响和损失。本项目旨在建立一套基于法律、管理和技术的符合区域卫生信息化发展要求的医疗信息隐私保护体系。借鉴风险评估模型，综合运用管理学、医学、法学、信息技术与安全等学科理论和方法，界定医疗信息隐私的概念内涵、保护范围和具体情境，构建医疗信息隐私安全风险评估指标体系，对医疗信息隐私安全潜在的威胁与风险程度进行评估，确定容易发生隐私泄露或遭受破坏的关键环节与途径，有针对性地制定隐私安全保护措施和管理决策，以期推动区域卫生信息化持续健康发展。

随着区域卫生信息化的建设与发展，医疗信息隐私保护问题变得日益突出。本项目旨在建立一套基于法律、管理和技术的符合区域卫生信息化发展要求的医疗信息隐私保护体系。课题通过界定医疗隐私信息，借鉴风险评估模型构建了医疗信息隐私安全风险评估指标，对医疗信息在采集、存储、传输、处理等过程中潜在的隐私泄露风险进行分析，发现容易造成信息泄露或遭受破坏的关键环节，评估其可能带来的威胁与风险程度，制定医疗信息隐私保护措施和管理决策，为解决医疗卫生信息隐私保护问题提供方案，保证医疗信息安全、保护患者隐私权利，在区域卫生信息化建设与发展过程中，对于建立安全可信的医疗信息发展环境，促进区域卫生信息化发展，提高医疗服务整体质量，减少医疗纠纷，深化我国医药卫生体制改革，具有重要的理论和实践意义。