PDF下载

[1]鞠鑫李曼赵亚.医疗卫生机构信息系统应用程序接口安全管理规范地方标准探索与实践[J].中国卫生质量管理,2026,33(5):17-22.[doi:10.13912/j.cnki.chqm.2026.33.5.04]
　JU Xin,LI Man,ZHAO Ya.Exploration and Practice of Local Standards for API Security Management in Medical and Health Institution Information Systems[J].Chinese Health Quality Management,2026,33(5):17-22.[doi:10.13912/j.cnki.chqm.2026.33.5.04]

点击复制

医疗卫生机构信息系统应用程序接口安全管理规范地方标准探索与实践

《中国卫生质量管理》[ISSN:1006-7515/CN:CN 61-1283/R] 卷: 33 期数: 2026年5期页码: 17-22 栏目: 特别关注出版日期: 2026-05-15

Title:: Exploration and Practice of Local Standards for API Security Management in Medical and Health Institution Information Systems

作者:: 鞠鑫李曼赵亚; 苏州市卫生健康信息中心

Author(s):: JU Xin; LI Man; ZHAO Ya; Suzhou Health Information Center

关键词:: 医疗信息系统; API安全; 标准构建; 全生命周期管理

Keywords:: Medical Information System; API Security; Standard Construction; Full Lifecycle Management

分类号:: R197.3

DOI:: 10.13912/j.cnki.chqm.2026.33.5.04

文献标志码:: B

摘要:: 应用程序接口（API）已成为医疗卫生机构跨系统数据交互的核心载体，但其安全管理缺乏统一标准，导致API资产不明、权限失控、数据泄露等问题频发，严重威胁患者隐私与医疗业务连续性。本研究以相关法律法规为依据，结合苏州市多所医疗卫生机构实地调研结果，构建了医疗卫生机构信息系统API安全管理标准，从建设、运营与考评3个维度形成闭环管理体系，为解决API管理乱象，降低数据安全风险，提升区域医疗信息互操作性提供实践范式。

Abstract:: Application programming interface (API) has become the core vehicle for cross-system data interaction in medical and health institutions. However, the lack of unified standards for its security management has led to frequent issues such as unclear API assets, uncontrolled permissions, and data breaches, seriously threatening patient privacy and the continuity of medical services. Based on relevant laws and regulations and combined with the results of field research conducted at multiple medical and health institutions in Suzhou, this study has established an API security management standard for medical and health institution information systems. It forms a closed-loop management system from three dimensions: construction, operation, and evaluation, providing a practical paradigm for addressing API management chaos, reducing data security risks, and enhancing regional medical information interoperability.

参考文献/References:

［1］鞠鑫,徐爱彬,王华铎，等.联网医疗设备网络安全管理规范地方标准构建与实践路径［J］.中国卫生质量管理, 2024, 31(8):63-68.［2］汤其宇,陈昌杰,王士勇.医院网络环境中API接口的安全性问题与对策探讨［J］.中国数字医学, 2024, 19(6):115-120.［3］吴翔.浅谈企业的API安全防护［J］.网络安全和信息化, 2023(11):135-137.［4］SHOJAEI P, GJORGIEVSKA VE, CHOW WY. Security and privacy of technologies in health information systems: a systematic literature review ［J］. Computers, 2024, 13(2): 41.［5］BATHULA A,GUPTA KS,MERUGU S,et al.Blockchain, artificial intelligence, and healthcare: the tripod of future—a narrative review［J］.Artif Intell Rev,2024,57(9):238.［6］GUPTA K, JUNAID V, QURESHI MA, et al. Health data sciences and cardiovascular diseases in South Asia: innovations and challenges in digital health ［J］.Curr Atheroscler Rep,2024,26(11):639-648.［7］韦峻峰,李耀文. API接口安全运营研究［J］.邮电设计技术,2023(8):33-37.［8］SONUNE S, KALBANDE D, YEOLE A, et al. Issues in IoT healthcare platforms: a critical study and review［M］.Piscataway:IEEE,2017:1-5.［9］NAN J, XU LQ. Designing interoperable health care services based on fast healthcare interoperability resources: literature review［J］. JMIR Medical Informatics, 2023, 11(1): e44842.［10］曹晓均,翟志斌,张文峰.医院科研数据平台安全体系的构建与应用［J］.中国卫生质量管理, 2024, 31(9):82-86.［11］冯景瑜,潘濛,王佳林，等.基于深度语义解析的API越权漏洞攻击主动防御方法［J］.信息网络安全, 2025,25 (6):933-942.［12］谷波.电子病历档案API接口的安全性问题与对策探讨［J］.网络安全和信息化,2025(4):98-100.［13］陶元,常培.加强数据安全保护,提升企业API开放安全水平［J］.信息通信技术,2025,19(1):43-47.［14］李冬阳,韦雨君.高校应用API接口安全监测研究与实践［J］.电脑知识与技术,2024,20(31):74-76.［15］Open Web Application Security Project (OWASP). OWASP API Security Top 10 (2023)［EB/OL］.［2025-01-13］. https://owasp.org/API-Security/editions/2023/en/0x11-t10/.［16］刘天珞,张慧翔,廖凯华,等.API安全威胁与防范技术研究［J］.保密科学技术, 2022(4):8-14.［17］赵子轩,常杰,史丽鹏，等.基于拟态防御技术的API网关安全防护方法［J］.网络安全和信息化,2025(7):137-139.

更新日期/Last Update: 2026-05-15