Gestão da segurança da informação em ambientes hospitalares, desafios da lei geral da proteção de dados e estratégias de uma mitigação de riscos cibernéticos: uma revisão integrativa

Abstract

The increasing digitalization of healthcare services has expanded the use of information systems in hospital environments, making the protection of sensitive data a strategic challenge for healthcare institutions. In this context, the General Data Protection Law establishes guidelines for the processing of personal data and directly impacts hospital management. This study aimed to analyze the challenges of information security management in hospitals, considering legal requirements and cyber risk mitigation strategies described in the scientific literature. This is an integrative literature review conducted using studies published in the PubMed, Scopus, Web of Science, SciELO, and LILACS databases, selected according to previously defined criteria, resulting in a final sample of ten studies. The results showed that hospitals are among the sectors most vulnerable to cyberattacks, especially ransomware, and present weaknesses related to human factors, legacy systems, and the incorporation of connected medical devices. It was also observed that compliance with legal requirements occurs unevenly, particularly in public institutions, due to structural, financial, and governance limitations. It is concluded that the effectiveness of hospital information security depends on the integration of legal compliance, information governance, technology, professional training, and strategic management, with data protection being essential for the continuity of healthcare services and patient safety