The Three Pillars of Information Security: Confidentiality, Integrity, and Availability in Hospitals

Tiga Pilar Keamanan Informasi: Kerahasiaan, Keutuhan, dan Ketersediaan Data Rumah Sakit

Kalau ngomongin keamanan informasi di rumah sakit, sebenernya ada tiga hal dasar yang jadi pondasinya. Kerahasiaan, keutuhan, dan ketersediaan. Tiga ini yang sering disebut sebagai pilar utama.

Kedengerannya kayak teori di buku pelajaran ya. Tapi coba deh dipikir lagi, tiga hal ini sebenernya muncul tiap hari di pekerjaan kita. Cuma mungkin kita gak sadar aja kalau itu bagian dari pilar yang sama.

Gw sendiri baru nyadar betapa pentingnya tiga pilar ini setelah beberapa kali kejadian kecil di lapangan. Ada yang bikin kesel, ada yang bikin mikir, ada juga yang bikin gw cuma bisa bilang "yaampun".

Pilar Pertama: Kerahasiaan

Kerahasiaan itu simpel sih sebenernya. Informasi hanya boleh diakses oleh pihak yang berwenang. Titik.

Contoh paling gampang ya data pasien. Identitas pasien, diagnosis, hasil pemeriksaan, riwayat pengobatan. Semua itu cuma boleh diakses oleh orang-orang yang memang punya keperluan untuk mengaksesnya.

Kedengerannya gampang ya. Tapi di lapangan?

Pernah gw denger cerita, ada yang ngobrolin hasil lab seorang pasien di ruang tunggu, sambil nunggu lift. Bukan sengaja sih. Mungkin cuma ngobrol biasa. Tapi di sebelahnya bisa jadi ada keluarga pasien lain yang... ya dengerin.

Atau yang lebih sering: ada yang buka rekam medis di komputer, terus tinggal pergi sebentar—ke pantry, ke toilet, siapa tau ada urusan mendesak. Komputernya masih kebuka. Layarnya masih nampilin data pasien.

Apakah itu sengaja? Belum tentu. Tapi kerahasiaan itu bukan soal niat. Kerahasiaan itu soal hasil. Kalau ada yang bisa lihat yang seharusnya gak boleh lihat, ya itu udah pelanggaran.

Yang juga sering kejadian: kirim data pasien lewat chat pribadi. Gampang sih, tinggal foto, kirim. Praktis. Tapi datanya ke mana? Tersimpan di mana? Siapa yang punya akses ke chat itu? Ini yang kadang kita lupa mikirin.

Kerahasiaan bukan berarti pelit informasi. Kerahasiaan itu soal menjaga hak pasien. Pasien percaya sama kita. Dan kepercayaan itu harus dibayar dengan cara menjaga informasi mereka tetap aman.

Pilar Kedua: Keutuhan

Kalau kerahasiaan soal siapa yang boleh akses, keutuhan itu soal isinya.

Keutuhan berarti data tetap akurat, lengkap, dan tidak berubah tanpa otorisasi. Jadi informasi yang tercatat ya harus sesuai dengan kejadian sebenarnya. Gak boleh ada yang dirubah sembarangan.

Tapi tunggu. Di dunia nyata kan ada yang namanya koreksi. Salah ketik itu manusiawi. Hasil lab bisa salah input, nama pasien bisa ketuker, dosis obat bisa kelewat satu angka. Nah kalau salah, ya harus dibenerin dong?

Betul. Dan di sinilah keutuhan bekerja dengan cara yang lebih cerdas.

Koreksi itu boleh. Bahkan harus. Tapi koreksi yang baik itu meninggalkan jejak. Namanya audit trail. Atau jejak audit.

Jadi kalau ada data yang diubah, sistem harus bisa nunjukin siapa yang ngubah, kapan diubah, dan apa yang diubah. Nilai sebelumnya tetap tercatat. Nilai barunya tercatat. Waktunya juga tercatat.

Kenapa ini penting?

Karena di rumah sakit, data itu bukan cuma angka di layar. Data bisa jadi dasar pengambilan keputusan klinis. Kalau hasil lab pasien tiba-tiba berubah tanpa jejak, gimana kita bisa tau yang bener yang mana?

Kalau hasil pemeriksaan diubah tanpa otorisasi, atau tanpa dokumentasi perubahan, itu masalah besar. Bukan cuma soal administrasi. Bisa menyangkut keselamatan pasien.

Jejak audit itu semacam pertanggungjawaban. Bukan buat nyari siapa yang salah. Tapi supaya setiap perubahan bisa ditelusuri, diverifikasi, dan dipertanggungjawabkan.

Kedengerannya ribet ya. Tapi bayangin kalau gak ada. Semua orang bisa ubah apa aja, kapan aja, tanpa ketahuan. Itu jauh lebih serem.

Pilar Ketiga: Ketersediaan

Nah ini yang paling sering dilupain orang.

Ketersediaan itu soal data dan sistem harus bisa diakses ketika diperlukan. Kapan pun. Terutama untuk pelayanan pasien.

Bunyi teorinya gampang. Praktiknya?

Coba bayangin jam 2 pagi, ada pasien masuk IGD dengan kondisi kritis. Dokter butuh riwayat alergi pasien, hasil lab terakhir, atau riwayat pengobatan sebelumnya. Kalau sistemnya lagi down, dan datanya gak bisa diakses... terus gimana?

Di sini ketersediaan bukan cuma soal "sistemnya jangan sering error". Ketersediaan juga soal kesiapan menghadapi situasi ketika sistem memang gak bisa dipakai.

Makanya ada yang namanya prosedur downtime.

Prosedur downtime itu rencana yang disiapkan supaya pelayanan tetap jalan ketika sistem informasi gak bisa digunakan. Entah karena gangguan listrik, jaringan bermasalah, server error, atau apapun itu.

Prosedurnya bisa macem-macem. Misalnya formulir kertas yang disiapkan di setiap unit, cara pencatatan manual sementara, cara input ulang data setelah sistem kembali normal, sampai siapa yang harus dihubungi kalau ada gangguan.

Pertanyaannya, apakah semua unit punya prosedur ini? Apakah semua pegawai tau apa yang harus dilakukan? Apakah formulir cadangannya masih ada, atau udah lama hilang entah ke mana?

Gw pernah denger ada unit yang waktu sistemnya down, bingung mau ngapain. Formulir cadangan udah gak tau di mana. Nomor kontak IT juga udah ganti. Akhirnya ya... improvisasi. Yang penting pelayanan jalan. Tapi catatannya berantakan.

Padahal kalau prosedur downtime-nya beneran siap, semua bisa lebih terkendali. Data tetap tercatat, meskipun manual. Setelah sistem normal, tinggal diinput ulang atau dimigrasi.

Ketersediaan bukan cuma soal teknologi canggih. Kadang justru soal kesiapan hal-hal sederhana yang sering kita anggap remeh.

Kenapa Tiga Pilar Ini Gak Bisa Dipisah?

Ketiganya saling terkait.

Kalau kerahasiaan jebol tapi keutuhan dan ketersediaan bagus, data bisa bocor ke pihak yang salah. Kalau keutuhan rusak tapi dua lainnya bagus, data bisa salah tapi tetap diakses banyak orang dengan lancar. Kalau ketersediaan bermasalah, dua pilar lainnya jadi gak ada artinya karena datanya gak bisa diakses sama sekali.

Makanya disebut pilar. Bukan tiga hal terpisah. Tapi satu fondasi yang tiga kakinya harus sama-sama kuat.

Tiga pilar ini juga bukan cuma tanggung jawab tim IT atau SIRS. Kerahasiaan jadi tanggung jawab semua yang pegang informasi. Keutuhan jadi tanggung jawab semua yang mencatat dan mengoreksi data. Ketersediaan jadi tanggung jawab semua yang punya peran dalam menjaga layanan tetap jalan.

Dari yang input data di front office, yang ngisi formulir di poli, yang nginput hasil lab, sampai yang pegang kebijakan di manajemen. Semua ada perannya.

Entahlah. Mungkin tiga pilar ini kelihatan kayak konsep yang jauh dari pekerjaan sehari-hari. Tapi coba perhatiin lagi. Sebenernya kita ketemu mereka tiap hari.

Cuma mungkin kita belum nyebut namanya aja.

Menurut lo gimana?

Pertanyaan yang Sering Muncul

Apa bedanya kerahasiaan, keutuhan, dan ketersediaan?

Kerahasiaan soal siapa yang boleh akses informasi. Keutuhan soal isi informasi tetap akurat dan gak berubah tanpa otorisasi. Ketersediaan soal informasi dan sistem bisa diakses saat dibutuhkan.

Apa contoh pelanggaran kerahasiaan di rumah sakit?

Misalnya membiarkan komputer dengan rekam medis terbuka saat meninggalkan meja, mengirim data pasien lewat chat pribadi, atau membahas diagnosis pasien di tempat umum yang bisa didengar orang lain.

Kenapa koreksi data harus punya jejak audit?

Supaya setiap perubahan bisa ditelusuri: siapa yang mengubah, kapan, dan apa yang diubah. Ini penting supaya data tetap bisa dipertanggungjawabkan dan tidak disalahgunakan.

Apa itu prosedur downtime di rumah sakit?

Prosedur downtime adalah rencana yang disiapkan supaya pelayanan tetap berjalan ketika sistem informasi tidak bisa digunakan. Biasanya mencakup pencatatan manual, formulir cadangan, dan alur komunikasi dengan tim terkait.

Apakah tiga pilar ini hanya tanggung jawab IT?

Tidak. Kerahasiaan, keutuhan, dan ketersediaan adalah tanggung jawab semua pihak yang terlibat dalam pengelolaan dan penggunaan informasi di rumah sakit.

The Three Pillars of Information Security: Confidentiality, Integrity, and Availability in Hospitals

When we talk about information security in hospitals, there are three basic things that serve as the foundation. Confidentiality, integrity, and availability. These three are often called the main pillars.

Sounds like textbook theory, right? But think about it again. These three things actually show up in our daily work. We just might not realize they're part of the same pillar.

I only really understood how important these three pillars were after a few small incidents in the field. Some were frustrating, some made me think, and some just made me go "oh come on."

Pillar One: Confidentiality

Confidentiality is actually pretty simple. Information should only be accessed by authorized parties. Period.

The easiest example is patient data. Patient identity, diagnosis, test results, treatment history. All of that should only be accessed by people who genuinely need to access it.

Sounds easy, right? But in practice?

I once heard a story about someone discussing a patient's lab results in the waiting area, while waiting for the elevator. Not on purpose. Probably just chatting. But the person next to them could have been another patient's family member... listening.

Or the more common one: someone opens a medical record on the computer, then steps away for a moment—to the pantry, to the restroom, whenever something urgent comes up. The computer is still open. The screen is still showing patient data.

Was it intentional? Not necessarily. But confidentiality isn't about intention. Confidentiality is about outcome. If someone can see what they shouldn't be able to see, that's already a breach.

Another thing that happens a lot: sending patient data through personal chat. It's easy—snap a photo, send it. Practical. But where does the data go? Where is it stored? Who has access to that chat? This is what we sometimes forget to think about.

Confidentiality doesn't mean being stingy with information. Confidentiality is about protecting the patient's rights. Patients trust us. And that trust has to be repaid by keeping their information safe.

Pillar Two: Integrity

If confidentiality is about who can access, integrity is about the content itself.

Integrity means data stays accurate, complete, and unchanged without authorization. So what's recorded should match what actually happened. Nothing should be changed carelessly.

But wait. In the real world, there's such a thing as correction. Typos are human. Lab results can be entered wrong, patient names can get swapped, drug doses can miss a digit. If something's wrong, it has to be fixed, right?

Exactly. And this is where integrity works in a smarter way.

Corrections are allowed. They're even necessary. But a good correction leaves a trace. It's called an audit trail.

So if data is changed, the system should be able to show who changed it, when it was changed, and what was changed. The previous value is still recorded. The new value is recorded. The time is recorded too.

Why does this matter?

Because in a hospital, data isn't just numbers on a screen. Data can be the basis for clinical decisions. If a patient's lab result suddenly changes without a trace, how do we know which one is correct?

If test results are altered without authorization, or without documentation of the change, that's a serious problem. It's not just administrative. It can affect patient safety.

An audit trail is a form of accountability. Not to find who's at fault. But so that every change can be traced, verified, and accounted for.

Sounds complicated, right? But imagine if there were none. Anyone could change anything, anytime, without being noticed. That would be far scarier.

Pillar Three: Availability

This is the one people forget most often.

Availability means data and systems must be accessible when needed. At any time. Especially for patient care.

The theory sounds easy. In practice?

Imagine it's 2 AM, a patient arrives at the ER in critical condition. The doctor needs the patient's allergy history, last lab results, or previous treatment records. If the system is down, and the data can't be accessed... then what?

This is where availability isn't just about "the system shouldn't crash often." Availability is also about being ready for situations when the system genuinely can't be used.

That's why there's something called a downtime procedure.

A downtime procedure is a plan prepared so that services keep running when the information system can't be used. Whether due to power outages, network issues, server errors, or anything else.

The procedure can take many forms. Paper forms prepared in each unit, temporary manual recording methods, how to re-enter data once the system is back to normal, and who to contact when there's a disruption.

The question is, does every unit have this procedure? Do all employees know what to do? Are the backup forms still there, or have they long since disappeared?

I once heard about a unit that, when the system went down, had no idea what to do. The backup forms were gone. The IT contact number had changed. So they improvised. The important thing was that service kept running. But the records were a mess.

Yet if the downtime procedure had really been ready, everything could have been more controlled. Data would still be recorded, even manually. Once the system was back, it could be re-entered or migrated.

Availability isn't just about advanced technology. Sometimes it's about being ready with simple things we often take for granted.

Why These Three Pillars Can't Be Separated

All three are interconnected.

If confidentiality is breached but integrity and availability are fine, data can leak to the wrong parties. If integrity is broken but the other two are fine, data can be wrong but still accessed smoothly by many. If availability is compromised, the other two pillars mean nothing because the data can't be accessed at all.

That's why they're called pillars. Not three separate things. But one foundation whose three legs must all be strong.

These three pillars aren't just the responsibility of the IT or SIRS team. Confidentiality is the responsibility of everyone who handles information. Integrity is the responsibility of everyone who records and corrects data. Availability is the responsibility of everyone who plays a role in keeping services running.

From those entering data at the front office, filling out forms at the clinic, inputting lab results, to those shaping policy in management. Everyone has a role.

I don't know. Maybe these three pillars seem like concepts far removed from daily work. But look again. We actually meet them every day.

Maybe we just haven't been calling them by name.

What do you think?

Frequently Asked Questions

What's the difference between confidentiality, integrity, and availability?

Confidentiality is about who can access information. Integrity is about the content staying accurate and unchanged without authorization. Availability is about information and systems being accessible when needed.

What are examples of confidentiality breaches in hospitals?

For example, leaving a computer with medical records open when stepping away, sending patient data through personal chat, or discussing a patient's diagnosis in public where others can hear.

Why must data corrections have an audit trail?

So that every change can be traced: who changed it, when, and what was changed. This is important so that data remains accountable and isn't misused.

What is a downtime procedure in a hospital?

A downtime procedure is a plan prepared so that services keep running when the information system can't be used. It usually covers manual recording, backup forms, and communication flow with related teams.

Are these three pillars only the responsibility of IT?

No. Confidentiality, integrity, and availability are the responsibility of everyone involved in managing and using information in the hospital.

Terima kasih sudah mampir! Jika kamu menikmati konten ini dan ingin menunjukkan dukunganmu, bagaimana kalau mentraktirku secangkir kopi? 😊 Ini adalah gestur kecil yang sangat membantu untuk menjaga semangatku agar terus membuat konten-konten keren. Tidak ada paksaan, tapi secangkir kopi darimu pasti akan membuat hariku jadi sedikit lebih cerah. ☕️

☕ Buy Me Coffee