상급종합병원의 정보보호 및 개인정보보호 관리체계 (ISMS-P) 전환 장애요인이 전환 의도에 미치는 영향

As societal demands for privacy protection intensify, tertiary hospitals managing large volumes of sensitive data face growing pressure to transition from ISMS to ISMS-P certification. However, this transition has been delayed due to complex data flows and the availability-oriented nature of hospital information systems. Guided by Socio-Technical Systems (STS) theory, this study empirically examines barriers influencing transition intention in tertiary hospitals. Using valid survey responses from information security and privacy practitioners in 46 Korean tertiary hospitals, multiple regression analysis was conducted. The results show that three organizational and operational factors-lack of personnel, insufficient top management support, and increased workload-significantly hinder transition intention. In contrast, technical limitations, process complexity, budget constraints, organizational resistance, perceived regulatory pressure, and the direct and moderating effects of perceived necessity were not statistically significant. These findings suggest that transition intention depends less on external regulatory awareness or technical challenges than on internal execution capacity, including personnel, governance, and operational systems. This study provides empirical evidence on ISMS-P transition barriers and offers implications for healthcare information security certification policy and practice.