Strategies for Information Security in Medical Appointment Management Systems

Lazo Amado M.; Andrade-Arenas L. · International Journal of Safety and Security Engineering (2026) · DOI: 10.18280/ijsse.160316

Resumen

Medical appointment management systems are essential tools for improving efficiency, coordination, and service quality in healthcare organizations. These platforms handle highly sensitive information, including personal and clinical data, making them vulnerable to internal misuse, human error, and external cyber threats. Inadequate security controls may compromise the confidentiality, integrity, and availability of information, potentially disrupting operations and undermining patient trust. This study aims to design and implement structured information security strategies for such systems based on the ISO/IEC 27001 standard. It adopts the Information Security Management System (ISMS) framework, focusing on systematic risk identification, qualitative and quantitative risk assessment, and risk treatment through Annex A controls. Additionally, it incorporates contingency planning, business continuity, secure backup policies, encryption, access control, and continuous improvement supported by the Plan-Do-Check-Act (PDCA) cycle. The results show a substantial reduction in identified risks, with most reaching acceptable levels, while some residual risks require continuous monitoring. A quantitative evaluation revealed improvements between 15% and 40%, with an average increase of 22.7%. Key indicators include 98% backup success, 100% encryption coverage, full access compliance, and 99.95% system availability, demonstrating enhanced security and operational resilience.

Instituciones: Universidad de Ciencias y Humanidades