Basic principles

The Tokushukai General Incorporated Association Information System Department supports the implementation, operation and maintenance of EMRs and other medical information systems, develops hospital management software, and creates websites. To remain a sustainable organisation trusted by healthcare providers, other customers and society, all officers, employees and other personnel comply with this policy. We work to prevent the loss, theft, misuse, external attack or leakage of medical and other personal information and information assets entrusted to us, and to maintain their confidentiality, integrity and availability.

Basic policies

1. We establish organisational information security policies, including this policy, to protect information assets. We conduct our work in accordance with them and comply with applicable laws, regulations, standards and customer contracts.
2. We establish a systematic approach to risk assessment and conduct assessments regularly to prevent loss, theft, misuse or leakage of information assets. If a risk materialises, we respond appropriately, minimise its impact and work to prevent recurrence.
3. We establish an information security structure led by the person responsible for information security, clearly defining roles, authority and responsibilities.
4. We appropriately store, transfer and handle information, whether on paper, in electronic form or on external storage media. We also appropriately manage the facilities, hardware and software used to process it.
5. We enter into appropriate agreements with customers and business partners and provide a contact point for enquiries and consultations.
6. We conduct internal checks and audits and regular information security audits by independent third parties. Any deficiencies identified are addressed appropriately and promptly.
7. We establish and maintain an information security management system to fulfil these principles and policies and continually review and improve it.