Evaluating the ISO/IEC 27001 with experts' knowledge for Taiwanese medical center

Information security is a management problem, not a technology one. Experience indicates that technology cannot provide all the answers to the problems posed by people in the context of information security management (ISM). Since the improvements of information security managements are crucial for all healthcare organizations. The information they possess is very personal, while the trust between the patient and the hospital is one basic factor for quality care. Therefore hospital information security and privacy are major issues that cannot be ignored. For the information security management, ISO/IEC 27001 is the most important standards and it plays an important role while the organizations are considering strengthening their security management. This research uses case study methods to observe and understand the information security management system of our research subject. We used the nominal group technique (NGT) that was developed on the basis of "ISO/IEC 27001"to develop models that could verify their information security management systems. The primary data was collected in the NGT and uses a structured group process to elicit and prioritize answers to a carefully articulated question. The chosen expert panel consists of the following interest groups. Based on the result of this study, we found that NGT represents a workable research tool in hospital information security management to capture multifaceted and enriched view about risk factors selecting. Finally, it not only can realize the more accurate potential risk incident by utilize the ISO/IEC 27001, but also achieved the objective for self-assessed management of hospital information security.