• State institutions
• Health facilities
• Health insurance companies world wide

Purpose and definitions

The purpose of security information management is to provide and protect information and property from all types of threats, internal or external, accidental or deliberate, by establishing, implementing, executing, monitoring, reviewing, maintaining and improving information security management system - ISMS (Information Security Management System). The implementation of these policies and rules is important for maintaining the integrity of information systems for ensuring provision of services to insured persons, employees of the National Health Insurance Fund (NHIF) and other stakeholders.

The Policy ensures and guarantees that:

• information is protected from unauthorized access
• confidentiality of information shall be kept
• information shall not be disclosed to unauthorized persons any accidental or deliberate actions
• integrity of information shall be maintained by ensuring protecting against unauthorized changes
• access to authorized persons shall be enabled when needed for modifying the information
• compliance is ensured with all regulatory and legal requirements
• policy is supported through continuous business plan which will be defined, maintained and tested in continuous practical work
• training is delivered in all NHIF organizational units
• any violation of safe handling of information shall be reviewed and investigated
• all security violations will be documented and investigated

Scope of application

All employees are responsible for implementing security policies and information security and must provide support to the management bodies that have prescribed the policies and rules.

Objectives

• Protection of NHIF information
• Protection of information assets
• Providing reliable information
• Ensuring the availability of information to authorized persons
• Confidentiality in all cases of access to existing information.

Purpose

Privacy Information Security Management should identify risks to property, property value and identify possible vulnerabilities and potential causes of unwanted incidents, which may result in damage to the system or NHIF.

Managing risks to an acceptable level through design, implementation and maintenance of the ISMS.

The policy is in compliance with other standards and NHIF documents including:

• Standard ISO 9001:2001
• Documents on establishment, operation and organization
• Compliance with NHIF contractual obligations
• Compliance with NHIF instructions
• Ensuring operation in accordance with ISO 27001:2005
• Ensuring the accomplishment of objectives under ISO 27001:2005 and maintaining the certified status.

Policy Specifics – Operations

Specific rules are set up to support these documents, including:

1. Physical security;
2. System Access Control and Data;
3. Education regarding safety and specific training in relation thereto;
4. Internet and e-mail communication;
5. Data Protection through copies;
6. Use of mobile devices;
7. Storage and Availability of Confidential Information;
8. Prevention and detection of activity of software viruses or other malicious codes.

Responsibility

The Director General creates and reviews the rules. The ISMS manager implements the rules through appropriate standards and procedures.

All employees are required to abide by the procedures and maintain safety rules.
All employees are required to report on observed weaknesses and report incidents.
This policy is regularly consulted for the purpose of exercising the right of compulsory health insurance of all NHIF insured persons and business opportunities in terms of services and business support to NHIF staff, insured persons and other stakeholders.

Privacy Information Security Management is regularly and consistently reviewed to ensure its effectiveness and relevance.

The MISSION of the National Health Insurance Fund of the Republic of Serbia is rational allocation of funds collected from health insurance contributions, full exercise of health insurance rights and a positive impact on improving the healthcare system of the Republic of Serbia.

The VISION of the National Health Insurance Fund is to ensure the provision of quality services to insured persons in an easy, accessible and transparent way and pursuing modern trends in the area of health insurance.

The National Health Insurance Fund accomplishes its vision by the implementation and continuous improvement of the quality management system harmonized with the requirements of ISO 9001:2008 standard and by the Information Security Management System harmonized with the requirements of ISO 27001:2005 standard, as well as applying the following principles:

• focusing on insured persons and healthcare providers as users of the Fund's services, in order to continuously increase their satisfaction,
• a leadership role of the management in the accomplishment of the vision,
• full involvement of employees so as to increase efficiency of their work and their creative skills,
• planning, consistent implementation and verification of quality management and information security management system,
• system approach in the management for effective and efficient accomplishment of the vision of the National Health Insurance Fund,
• continuous improvement of service quality, quality management systems and information security management system,
• decision-making based on data analysis and information,
• development of mutually beneficial relationships with partners in order to create additional value for both parties.

The National Health Insurance Fund’s management and all employees are willing to fulfill their obligations and are committed to the Fund’s vision.