Section 3 Information Security Requirements for Medical Laboratories

I. Environmental Conditions

  1. Procedure documents shall be established to maintain the information systems used for collecting, processing, recording, reporting, storing, or retrieving examination data and information, so as to ensure their normal operation and provide the necessary environmental and operating conditions. The integrity of data and information shall be maintained and recorded; computer facilities and equipment shall be kept clean, and their placement locations and environments shall comply with relevant provisions (such as ventilation, static electricity, temperature, and humidity).

  2. The placement of computers shall comply with fire safety requirements.

  3. Protective measures shall be provided for electrical wires and computer cables located in traffic areas.

  4. Uninterruptible power supplies (UPS) shall be provided for LIS servers and computers involved in data processing, so as to prevent damage to or loss of data in the LIS caused by sudden power outages.

  5. Provisions and measures shall be established to prevent unauthorized persons from accessing information facilities.

II. Procedure Manuals

  1. Computer operating system procedure manuals and work instructions shall be established; they may be in electronic form for convenient use by all authorized computer users, and shall be available at the location where activities are performed.

  2. The purpose of computer programs, their mode of operation, and their interaction with other computer programs shall be clearly described. The level of detail shall be sufficient to support computer information system administrators in performing related troubleshooting and in making system changes or, when necessary, authorized program modifications.

  3. Computer system procedure manuals and work instructions shall be periodically reviewed and approved by the laboratory director or authorized personnel; the computer system procedure manuals and work instructions in use shall be current and effective.

  4. Procedures shall be established so that, in the event of fire or software or hardware damage, measures are in place to protect data, information, and computer equipment.

III. System Security

  1. Users of the LIS shall be authorized. Authorization for the LIS shall be detailed, and authorization shall be granted to personnel who access patient data, enter patient results, alter results, alter bills, or change computer programs.

  2. All persons authorized to enter the laboratory LIS shall safeguard the confidentiality of patient information in all computers and information systems. The laboratory and the network management center shall ensure that: (1) procedures are established and implemented to protect the integrity of data in all computers and information systems at all times; (2) computer programs and other methods are sufficient to protect the collection, processing, recording, reporting, storage, or retrieval of examination data and information, preventing accidental or unauthorized access, modification, or destruction.

  3. Illegal installation of software on laboratory computers is prohibited, and the use of USB flash drives and other data transcription devices is prohibited.

  4. If information from other computer systems (such as pharmacy or medical record systems) can be accessed through the laboratory's computer system, appropriate computer security measures shall be in place to prevent unauthorized access to such information.

  5. Appropriate computer security measures shall be in place to prevent unauthorized access to, and unauthorized alteration of, any patient laboratory information through other computer systems (such as pharmacy or medical record systems).

  6. Data transmitted over networks, both within and outside the institution, shall be protected against illegal interception or reception.

IV. Data Entry and Reporting

  1. The consistency between the final examination report results in the LIS and the original input data shall be checked periodically, and procedure documents and records for preventing data transmission errors shall be maintained. Data shall be checked periodically for errors arising during processing and storage. For example: (1) the consistency between the data in examination result query systems such as doctors' and nurses' workstations and the original data shall be checked periodically. (2) When a new instrument is connected to the LIS, a certain number of comparisons between instrument data and LIS data shall be performed.

  2. Multiple copies of tables maintained in different systems (for example, the biological reference interval tables in the laboratory information system and the hospital information system) shall be checked periodically to ensure the consistency of all copies during use. Appropriate replication or comparison procedures shall be available, and periodic checks shall be performed.

  3. The laboratory shall periodically audit and record the process and results of computer processing of patient data. Note: the process and results of processing patient data refer to any modification made to patient records on the basis of entered data, including numerical calculations, logical functions, automatic verification of results, and the addition of remarks.

  4. When data are entered into a computer or other information system by manual or automated methods, the correctness of the entered data shall be checked and verified before final computer review and reporting. Where possible, result entry shall be checked against the numerical range predefined for the particular examination, so as to detect unreasonable or impossible results before final review and reporting.

  5. The laboratory director shall review and approve the content and format of laboratory reports in the LIS, and shall solicit the opinions of clinical personnel.

  6. The LIS shall have a report review procedure in normal operation. Laboratory management or designated personnel shall be responsible for accurately and efficiently transmitting examination results to authorized recipients and shall approve modifications in any information system that may affect patient medical care.

  7. The LIS should have a procedure capable of detecting unreasonable or impossible results before the computer issues a report; after patient data are modified, the original data shall remain displayable. The LIS shall be capable of displaying patients' historical data, so that examination personnel can compare test data during report review.

  8. The report format in the LIS shall provide the function of adding remarks such as sample quality and result interpretation.

  9. The LIS shall be able to identify and record information on personnel who have accessed or modified patient data, control documents, or computer programs.

  10. The LIS shall have a procedure capable of detecting critical value results and issuing an early warning before the computer issues a report, and shall notify the clinical side in a timely manner through relevant procedures (for example, screen flashing at doctors' and nurses' workstations) and keep records (including the date and time the clinical side received the critical value result, the critical value result, the recipient of the critical value result, the notifier, and the date and time of notification).

  11. The LIS shall have functions for internal quality control method selection, data analysis, chart drawing, warning initiation, and out-of-control state alarming, as well as functions for the retention of data after release from control and original data and for retrospective analysis and statistics.

  12. The LIS shall have functions that reflect time records, operating status, emergencies, and other content from specimen collection, transport, and delivery to the laboratory through to examination and report issuance.

  13. The LIS shall have functions that reflect the warehousing, issue, use, and inventory of laboratory consumables, and shall provide early-warning prompts when consumables are running short.

V. Data Retrieval and Storage

  1. Patient result data and archival information stored in information systems shall be readily retrievable for queries. The laboratory shall determine the retention period for patient result data and archival information in its information systems. The retention period shall comply with the national time-limit requirements for electronic medical records. The method of retrieval and query shall be subject to consultation with clinical personnel.

  2. The LIS shall be able to reproduce completely archived examination results and other necessary additional information, including measurement uncertainty, biological reference intervals, and warnings, footnotes, or explanatory remarks attached to examination results.

  3. If no other means are available, patient and laboratory data shall be retrievable "online" within a specified time limit.

  4. Procedure documents shall be established to correctly label and properly preserve data storage media and to prevent their use by unauthorized persons.

  5. The LIS shall back up patient result data.

VI. Hardware and Software

  1. A procedure shall be established to carry out preventive maintenance of all computer hardware and keep records, available for reference at any time.

  2. After each backup or restoration of data files, the system shall be checked for unintended changes and the check shall be recorded.

  3. Changes made to system hardware and software shall be accurately identified and recorded. Changes made to system hardware and software shall be verified to ensure that they are acceptable.

  4. All changes in the LIS that may affect patient medical care, such as report re-review, shall undergo review and approval, with records kept.

  5. When a program is first installed, or after it is changed or modified, its normal operation shall be checked and recorded.

  6. Procedure documents shall be established to enable authorized personnel at all levels to carry out troubleshooting, system modification, or programming.

  7. Computer users shall be trained so that they master how to use new systems and modified existing systems.

  8. A dedicated person shall be designated to report promptly to higher levels and keep records when a computer develops an obvious fault.

VII. System Maintenance

  1. The laboratory shall establish a procedure to test periodically all computer hardware. A schedule for periodic maintenance shall be available.

  2. The laboratory shall establish effective backup measures to prevent loss of patient data caused by hardware or software failures. The effectiveness of backups shall be checked periodically.

  3. The laboratory shall specify the backup cycle and retention period.

  4. Errors detected during system backup and the corrective measures adopted shall be recorded and reported to the person responsible for the laboratory.

  5. The computer alarm system (usually the main computer console, which monitors hardware and software performance) shall be monitored and tested periodically to ensure normal operation.

  6. Procedure documents shall be established specifying the requirements for shutting down and restarting all or part of the system, so as to ensure data integrity, minimize the impact on services provided by the laboratory, and ensure normal system operation after restart.

  7. Records of periodic maintenance, servicing, and repair shall be maintained so that operators can trace the work that has been done on any computer.

  8. Documentation shall be established for taking corrective measures against computer faults and their causes, and records shall be kept.

  9. A written response plan shall be developed for computer system emergencies.

VIII. Validation of Information Systems

  1. When computers are used to collect, process, record, report, store, or retrieve examination data, the laboratory shall ensure that computer software, including general-purpose software used in building instruments or systems (such as word processing or spreadsheet applications), is validated.

  2. Upon first installation, and after planned changes or modifications, programs shall be validated before they can be put into normal operation.

  3. Any change to system hardware or software shall be validated for suitability so as to confirm that all changes are feasible, and records shall be kept. Information on all personnel who add or modify software shall be recorded.

IX. Data Recovery

  1. Procedures shall be established to deal with downtime of other systems (such as the hospital information system) so as to ensure the integrity of patient data. Procedures shall be established for verifying the recovery of other systems and the replacement or updating of data files.

  2. All unplanned shutdowns, periods of system degradation (such as slowed response times), and other computer problems, including the causes of the faults and the corrective measures taken, shall be recorded. The laboratory shall promptly report all serious computer faults to designated personnel.

  3. A written emergency plan shall be developed to respond to certain events and to ensure that patient result reports can be issued quickly and effectively in the event of a failure of computers or other information systems.

X. Classified Protection of Information System Security

1. Background to Development

With the continuous development of hospital informatization, the conduct of every kind of hospital work has adopted network information systems to varying degrees, and the role of information systems in hospitals has become increasingly important. The development and construction of modern hospitals have become integrated with informatization; when hospital information system security is attacked or damaged, causing the hospital to be unable to carry out its various medical activities normally, it is very easy to trigger social mass incidents, such as the leakage of patients' personal private information (serious diseases), or patients becoming discontented and causing disturbances in the hospital because the registration system is interrupted. Therefore, how to safeguard hospital information system security has also become an issue requiring attention in hospital informatization.

To further improve the protection of hospital information security, the Ministry of Health, in response to the current state of the various medical industries at the present stage in China, issued the "Guiding Opinions on the Work of Classified Protection of Information Security in the Health Industry" (No. 85 [2011]), which clarified the connection between classified protection of information security and information security protection in the medical industry. In accordance with the guiding spirit of this document, the core business systems of Grade A tertiary hospitals shall be constructed and protected according to Level 3 of the classified protection of information security.

2. Construction Process

The construction of hospital information security classified protection work is mainly divided into the following processes:

2.1 Classification Review of Hospital Information Systems

According to the relevant provisions on classified protection of information security, when an information system is attacked or damaged, the resulting consequences shall be graded according to the degree of harm caused to national security, social order and public interests, and the lawful interests of citizens and individuals.

2.2 Filing of Hospital Information Systems

After the classification review of a hospital information system, the hospital shall submit the "Information System Security Classified Protection Filing Form," the "Information System Security Classified Protection Classification Report," and related documents to the local competent health department. The health department shall report to the public security organ at or above the municipal level for filing and registration, and the classification of the information system is completed once the filing receipt is obtained.

2.3 Testing and Evaluation of Hospital Information System Classified Protection

After completing the classification and filing of the information system, a professional testing and evaluation institution authorized by the local public security department and qualified for information security classified protection testing and evaluation shall be selected to carry out an overall evaluation of the hospital information system. The purpose of the evaluation is to make an objective assessment of the security protection capability of the hospital information system. Through security inspections of physical security, network security, application security, data security, host security, and security management, and taking the basic requirements of national classified protection of information security as the security baseline, an objective conformity determination is made to further gauge the current security protection capability of the system and the threats and risks faced by the system, providing a strong basis for security rectification and future security construction.

2.3.1 Evaluation Indicators and Methods

The hospital's core business systems are Level 3 classified protection systems, and the security evaluation indicators shall include the Level 3 general indicator class (G3), the Level 3 business information security indicator class (S3), and the Level 3 business service assurance class (A3) in Section 7.1 "Technical Requirements" of the "Basic Requirements for Information System Security Classified Protection."

Three types of methods, namely interviews, inspections, and testing, will be used in the on-site evaluation work. An interview is a method by which evaluation personnel obtain evidence through activities such as exchanging views and holding discussions with personnel related to the information system. An inspection is a method by which evaluation personnel obtain evidence through activities such as observing, examining, and analyzing the evaluation objects. Testing refers to activities in which evaluation personnel cause the evaluation objects to produce specific responses according to predetermined methods/tools, and then obtain evidence by examining and analyzing the response outputs.

The main tool used for interviews is the interview list. Evaluation personnel address the questions on the interview list one by one through exchanging views and holding discussions with personnel related to the information system, and learn about and confirm the security protection situation of the information system according to the interviewees' answers. The main tool used for inspections is the verification list. Evaluation personnel address the questions on the verification list one by one through activities such as observation, examination, and analysis. According to the different inspection objects, inspections can be further divided into document review, on-site observation, and configuration verification. According to the different tools and implementation processes, testing can be further subdivided into information acquisition, vulnerability scanning, penetration testing, and cryptographic analysis. Information acquisition refers to obtaining information such as the names of surviving hosts/devices, IP addresses, operating systems, open service ports, and specific data packets; vulnerability scanning refers to using vulnerability scanning equipment to automatically probe target devices and discover misconfigurations and known security vulnerabilities on each open network port of these hosts/devices; penetration testing simulates attack techniques that hackers may use, attempting to intrude into the information system or obtain more resources on it, so as to directly evaluate the security status of the information system. Conducting vulnerability scanning and penetration testing on the information system from different access points can reflect the security status of the information system from different angles and perspectives.

2.3.2 Unit Evaluation

Combining the evaluation indicators and evaluation methods with the specific evaluation objects of the information system constitutes work units that can be specifically evaluated. The evaluation institution will conduct unit evaluations separately of physical security, network security, host system security, application security, data security and backup/recovery, security management organization, security management systems, personnel security management, system construction management, and system operation and maintenance management.

2.3.3 Overall Evaluation

After the security controls of an information system are integrated into the information system, interrelated relationships such as connection, interaction, dependence, and coordination arise within layers, between layers, and between regions, so that the overall security function of the information system is closely related to its structure and presents an integrated characteristic as a whole. These integrated characteristics are not fully reflected in the work units of security controls. Therefore, on the basis of the security control evaluation, it is necessary to conduct an overall evaluation of the integrated system and its operating environment. Security evaluation between security controls mainly considers the correlative effects, such as functional enhancement, supplementation, or weakening, that exist between different security controls on the same layer. For example, identity authentication and access control at the host layer are closely related, and attention should be paid to their correlative and complementary effects. Security evaluation between layers mainly considers the correlative effects, such as functional enhancement, supplementation, and weakening, that exist between different layers within the same region. For example, the network layer, the host system layer, and the system operation and maintenance management aspect of security management are closely related, and attention should be paid to their correlative and complementary effects. Security evaluation between regions mainly considers the correlative effects, such as enhancement, supplementation, and weakening of security functions, that exist between different regions that are interconnected and interoperable (including physical and logical interconnection), particularly two different regions between which data are exchanged. The system structure security evaluation mainly considers the security of the overall structure of the information system and the rationality of the overall security precautions. The security evaluation of the overall structure shall start from the physical layout, network topology, business logic (business data flow), system implementation, and integration approach of the information system, and, taking account of the threats that may be faced at different positions and the vulnerabilities that may be exposed, comprehensively determine whether the overall layout of the information system is reasonable and whether it is secure and effective as a whole. After examining the specific implementation methods and deployment of the information system's security protection measures, and analyzing, in combination with its business data flow, the relationship between different regions and different boundaries and the security protection measures, and the relationship between important business and key information and the security protection measures, reference shall be made to the requirements of defense in depth to identify whether the information system's security precautions highlight key points and deepen layer by layer, so as to comprehensively determine whether the overall security precautions of the information system are appropriate and reasonable.

2.4 Reporting of Test Results and Rectification

After completing the evaluation of the hospital information system, the evaluation institution will issue an "Information System Classified Evaluation Report." The hospital shall submit the evaluation report to the local public security organ for filing. In accordance with the evaluation results in the evaluation report, against standards such as the "Basic Requirements for Information System Security Classified Protection," and in light of the actual work of the hospital, the hospital shall organize and carry out security construction and rectification work for classified protection, assign the rectification work to specific individuals, and complete the rectification within the expected time.

2.5 Formulating the Hospital Information Classified Protection Management System

The hospital will, by reference to the management requirements for classified protection of information security and in light of its own actual situation, construct its information security classified protection management system from the aspects of information security management organization, information security management systems, information personnel security, system construction management, and system operation and maintenance management.

In general, the information security classified protection construction system must proceed from actual needs and periodically test the compliance and rationality of the construction. Compliance means constructing the hospital's complete information security system under the guidance of policy requirements: implementing the national classified protection standards; responding to the guiding spirit of the Ministry of Health in advancing classified protection construction; passing national classified protection evaluation; and serving as a pilot and demonstration for the construction of the information security system and classified protection construction in the medical industry. Actual needs means carrying out systematic construction in light of the hospital's own business development requirements and genuinely improving its own information security protection level: achieving active defense against external intrusion threats and preventing the harmful effects brought about by irregular internal operations; reducing the difficulty of day-to-day information management work and improving the operation and management efficiency for complex, heterogeneous information systems, so as to achieve "laws to abide by and techniques available"; and rationally planning and standardizing the construction of information systems already built, newly built, and planned for construction.