Application security mechanisms and protection analysis in organizational context

Network System Analysis

Natividad Medical Center was established in 1844 (NMC Profile). It is a licensed hospital for 172 beds and employs approximately 800 employees. Natividad Medical Center serves more than 135,000 patients with a wide range of inpatient and outpatient services, including Doctor Clinics, surgery, lab, as well as emergency services, and handles more than 42,000 emergency visits annually. The hospital industry is governed by laws and regulations that require a high amount of security by the facility, employees, and the information system, such as Health Insurance and Accountability Act (HIPAA) (Dennis, 2005). HIPAA requires individual user authentication, access controls, audit trails, physical security and disaster recovery, protection of remote access points, such as individual computers in the hospital, secure external electronic communications, software discipline, and system assessments. The medical record storage and input interfaces are required to maintain high levels of security.

The Hospital Information System supports clinical and medical patient care activities (Hospital Information System). The clinical interfaces are pages designed to train staff on computer input. The medical patient care activities include pages for patient billing information, nurse notes on hospital stays, dietary, medication logs, Doctor's notes, labs and other testing with results, scheduling of different tests, surgery, etc., as well as, discharge information. The medical records storage is part of this system. Information from the other pages interact and store information in the medical records storage system that includes all the information on a particular patient, including test results, attending physicians, billing, and payment information.

The Administration application includes interfaces for financial, personnel, statistics, and performance. The financial interfaces are for business transactions, such as accounts receivable, accounts payable, payroll, budgeting, and financial performance, etc. Personnel interfaces includes information for human resources that have employee hiring and disciplinary information as well as employee health information for test and vaccine information on each employee, infection control measures, information for medication adverse reactions, and disease control. This application also includes an interface for material management, such as hospital supplies and equipment purchases, etc. There is a Doctor ID system that identifies which doctors have been granted permission to practice in the hospital and a doctor referral system to transfer patients when the hospital is not equipped to care for them. Statistical interfaces are also implemented for evaluation on performance of patient satisfaction, bed census, costs, and projections for long-term forecast.

The system is an application to application interface that enables event driven communication with abstract and actual string messages. The definitions include data exchange, timing of exchanges, and reporting of application-specific errors between applications. The errors are set up as control measures to control inaccuracies of information and access to certain information. The access controls are mandated by the individual position of each employee based on the required job duties with high level password protection.