The hospital failed to implement the necessary organizational and technical measures to ensure proper information security. The Swedish DPA found that the hospital carried out no risk analyses regarding access to patient data. The hospital information systems Melior and Nationell patienttoversikt had not assigned the authorization for users according to the principle of minimum access. All the users had full access to all patient data, irrespective of work purposes or not. Moreover, the Melior information system did not keep any records of when or for what purpose the patient data was accessed.
the hospital failed to implement the necessary organizational and technical measures to ensure proper information security the swedish dpa found that the hospital carried out no risk analyses regarding access to patient data the hospital information systems melior and nationell patienttoversikt had not assigned the authorization for users according to the principle of minimum access all the users had full access to all patient data irrespective of work purposes or not moreover the melior information system did not keep any records of when or for what purpose the patient data was accessed
 hospital fail  implement  necessary organizational  technical measure  ensure proper information security  swedish dpa find   hospital carry   risk analyse regard access  patient data  hospital information systems melior  nationell patienttoversikt   assign  authorization  users accord   principle  minimum access   users  full access   patient data irrespective  work purpose   moreover  melior information system   keep  record      purpose  patient data  access