The Aleris Sjukvård AB failed to implement the necessary organizational and technical measures to ensure proper information security. The Swedish DPA found that the company carried out no risk analyses regarding access to patient data. The hospital information system TakeCare had not assigned the authorization for users according to the principle of minimum access. All the users had full access to all patient data, irrespective of work purposes or not.
the aleris sjukvård ab failed to implement the necessary organizational and technical measures to ensure proper information security the swedish dpa found that the company carried out no risk analyses regarding access to patient data the hospital information system takecare had not assigned the authorization for users according to the principle of minimum access all the users had full access to all patient data irrespective of work purposes or not
 aleris sjukvård ab fail  implement  necessary organizational  technical measure  ensure proper information security  swedish dpa find   company carry   risk analyse regard access  patient data  hospital information system takecare   assign  authorization  users accord   principle  minimum access   users  full access   patient data irrespective  work purpose  