Programa de privacidade e proteção de dados baseado em business process management para hospital pediátrico

Abstract

In pediatric hospitals, compliance with the General Data Protection Law (LGPD) changed working methods, creating in certain cases difficulties in their implementation, because frameworks, commonly used for this purpose, such as COBIT and ISO 27701, do not have the means to deal with the processing of sensitive data of children and adolescents. One way to implement privacy and data protection is through a program that is developed to consider the characteristics of the processes and data present in a pediatric hospital, considering mapping processes and data with the BPM methodology. Process mapping is an essential practice for fulfilling the duties imposed in a regulatory environment and is important because it can provide visibility to existing processes and allow for subsequent procedural improvement. The objective of this work was to develop and implement a privacy and data protection program based on Business Process Management for a pediatric hospital, to support compliance with the General Data Protection Law. The development of the program was structured into four distinct phases: Bibliographic Research; Development of the Privacy and Data Protection Program; Implementation of the Privacy and Data Protection Program and Compliance with the General Data Protection Law, implemented in a private pediatric hospital with 180 beds, located in a large Brazilian urban center. After implementation, it was possible to improve the hospital's data protection environment and, consequently, improve processes with operational and patient safety gains, which affected the development of policies, documents and processes. There was also an improvement in information security management, with the sponsorship of changes to rules and customs, based on the training carried out. The hospital now has policies and processes aimed at data protection and the correct management of data subjects, ensuring compliance with the LGPD.