The information held by Landspítali must be protected from all threats, internal and external, whether intentional, negligent or accidental. The implementation and execution of the policy is the basis for professional working practices and is important to assure Landspítali employees and users of the hospital's services of integrity and correct working practices.
1. Scope
The information security policy applies to all data/information, in whatever form it exists and wherever it is stored. Special emphasis is placed on:
a. Health data; health information and biosamples.
b. Personal information related to Landspítali employees.
The information security policy also applies to the premises, equipment, and systems that house or transmit data/information, including server rooms, servers, information systems, databases, cables, network equipment, and telecommunication cabinets. The information security policy also extends to Landspítali employees and contractual partners who have access to the aforementioned data/information, such as contractors or service providers.
2. Objectives
The objectives of the information security policy are to ensure that:
a. Information is accurate and accessible to those with authorized access.
b. Confidentiality and privacy of information are maintained, where applicable.
c. Information transmitted over Landspítali's network reaches the correct recipient undamaged.
d. Risk related to information processing and retention is within defined risk limits, in accordance with risk assessment.
3. Means to Objectives
The means to achieve the above objectives are:
a. To always comply with the laws, rules, and regulations governing Landspítali's operations concerning the retention, handling, protection, and registration of health information.
b. To develop, maintain, and test business continuity plans to ensure secure operation and system recovery.
c. To investigate and follow up on deviations from the information security policy.
d. To maintain certification of Health and Information Technology operations in accordance with ISO 27001.
e. To regularly and formally conduct risk assessments of critical assets (e.g., Information assets) and the vulnerabilities that may jeopardize them.
f. To maintain a register of information assets and classify them by confidentiality, integrity, and availability.
g. To create backups of all Landspítali data and software systems.
h. To comply with and fulfill all agreements Landspítali is a party to that concern information security.
i. To always comply with the laws and rules of the Landspítali Ethics Committee, the Data Protection Authority (Persónuvernd), and the National Bioethics Committee, regarding the handling of applications for access to health information from Landspítali systems, for example, for scientific research.
j. To ensure that access to health information and biosample information is in accordance with laws, regulations, and recommendations issued by the Director of Health and Landspítali.
k. To comply with laws, rules, and regulations concerning healthcare institutions as well as Landspítali's own rules.
l. To maintain quality manuals with procedures and workflows for information handling and ensure that employees and partners follow them.
m. To provide training and education to employees on information security.
n. To ensure workflows that promote improvements in the field of information security.
4. Responsibilities
Responsibility for the implementation and maintenance of the information security policy is divided as follows:
a. The Chief Medical Officer of Landspítali is responsible for the security of medical records at Landspítali.
b. The Landspítali Executive Board is responsible for the information security policy and for its regular review and revision.
c. The Development Division is responsible for the implementation of the information security policy concerning all electronic data.
d. Landspítali managers are responsible for ensuring that their employees comply with the rules and recommendations governing information security, the handling of health information, and the handling of biosample information. Landspítali managers are also responsible for maintaining security awareness among employees.
e. All employees are obligated to work in accordance with the information security policy. They must report security deviations and vulnerabilities related to information security to their respective Quality and/or Security Manager, if applicable, or to the units responsible for Landspítali's Health and Information Technology matters within the Development Division. Landspítali employees must, to the best of their ability, ensure that only those with authorization can access health information or biosample information.
5. Penalties
Those who deliberately compromise Landspítali's information security face prosecution or other appropriate legal action. Furthermore, according to the Act on the Rights and Duties of State Employees, they risk a warning or, in case of repeated or serious violations, dismissal from employment.
Approved by the CEO of Landspítali on January 23, 2025 Landspítali Information Security Policy (.pdf)
