Theory: Integrity Standards & Thai Law
Good practice becomes enforceable in two ways: standards turn it into requirements an auditor can check, and laws attach legal consequences. This lesson covers the ISO/IEC 27001 controls for integrity and three Thai laws: the Electronic Transactions Act, the Computer Crime Act and the PDPA.
ISO/IEC 27001:2022, Annex A Controls for Integrity
| Control | Requirement | Links to (see 8.4) |
|---|
| 5.3 Segregation of duties | Conflicting duties are separated. | Maker-checker |
| 8.13 Information backup | Backups are kept and tested. | 3-2-1, restore testing |
| 8.15 Logging | Activities are logged and logs are protected. | Audit trail |
| 8.32 Change management | Changes follow a controlled process. | RFC → Assess → CAB → Test → Deploy → Review |
Standards turn good practice into requirements that an auditor can check. In an exam, when you recommend a control, name the matching Annex A number: maker-checker → 5.3, backup → 8.13, audit trail → 8.15, change process → 8.32.
Electronic Transactions Act B.E. 2544 (2001)
| Section | Topic | Rule |
|---|
| Section 10 | Original form | An electronic record can replace an original document only if a reliable method keeps its integrity. The test: the data stayed complete and unchanged. |
| Section 11 | Evidence | A court gives electronic evidence weight based on how reliably it was created, stored, and sent. |
Manager takeaway: if you cannot show that a record was not changed, it may not count as evidence. Audit trails and integrity controls are also legal protection.
Computer Crime Act, Section 9
Section 9: changing or deleting another person’s computer data without permission is a crime. Penalty: up to 5 years imprisonment, or up to 100,000 baht, or both.
- Related section: Section 7 covers unauthorized access to data; Section 9 covers changing or deleting it.
- Hospital example: an employee changes a colleague’s records to hide a mistake → Section 9 (and Section 7 for the access, if the data was protected and not meant for that employee).
Common mistake: citing the Computer Crime Act for an honest error. The offence requires acting without permission/right, i.e. intent. An accidental wrong entry is an integrity failure for the hospital to fix, not a computer crime.
PDPA: Accuracy and the Right to Correction
| Section | Who | Rule |
|---|
| §35 | Controller’s duty | Keep personal data accurate, up to date, complete, and not misleading. |
| §36 | Data subject’s right | The patient may ask the hospital to correct wrong data. |
If the hospital refuses: the controller may refuse a request that is not appropriate, but must record the request and the reason.
Integrity and privacy work together here: the history is kept, not erased.
Integrity Is Also Legal
| Law | Why it depends on integrity |
|---|
| Electronic Transactions Act | Records count as originals/evidence only if their integrity can be shown. |
| Computer Crime Act | Unauthorized change or deletion of data is a crime. |
| PDPA | Personal data must be accurate, and corrections must be handled and recorded. |
Worked Examples
Exercise 1
A patient asks the hospital to remove a diagnosis from her record. She says it is wrong. Her doctor disagrees. What should the hospital do?
A. Change it: it is the patient’s right.
B. Refuse: the doctor knows best; do nothing.
C. Keep and record: keep the original, record the request, the decision, and the reason.
Show solution ↓Hide solution ↑
Solution
- PDPA §36 gives the patient the right to request correction, but not an automatic right to have clinical data deleted. If the doctor’s diagnosis is medically justified, deleting it would make the record inaccurate and incomplete, breaking §35 and patient safety. So A is wrong.
- The hospital may refuse an inappropriate request, but it must record the request and the reason. Doing nothing breaks that duty. So B is wrong.
- The correct path: review the request, keep the original diagnosis, and record the request, the decision and the reason (the patient’s disagreement stays visible in the history). If the review finds the diagnosis really is wrong, correct it with a trail (keep the original, add the correction, log who, when and why).
Answer: C, keep and record.
Exercise 2
An employee secretly changes a colleague’s records in the EHR to hide his own mistake. Which Thai law applies, which section, and what is the maximum penalty? Which related section may also apply?
Show solution ↓Hide solution ↑
Solution
- He changed another person’s computer data without permission, on purpose.
- That is the Computer Crime Act, Section 9: up to 5 years imprisonment, or up to 100,000 baht, or both.
- If he opened data that was protected and not meant for him in order to do it, Section 7 (unauthorized access to data) may also apply.
Answer: Computer Crime Act Section 9 (up to 5 years or up to 100,000 baht or both); Section 7 for the unauthorized access.
Exercise 3
MediCare Plus scans its paper consent forms and destroys the originals. In a court case, the hospital wants to use the scanned records. Under the Electronic Transactions Act, what must the hospital be able to show?
Show solution ↓Hide solution ↑
Solution
- Section 10 (original form): an electronic record can replace the original only if a reliable method keeps its integrity: the hospital must show the data stayed complete and unchanged since it was scanned.
- Section 11 (evidence): the court weighs the evidence by how reliably it was created, stored, and sent: the scanning process, storage (e.g. protected, write-once), and access controls.
- Useful proof: hashes or digital signatures taken at scan time, protected audit logs showing no edits, documented scanning and storage procedures.
Answer: the hospital must show a reliable method kept the records complete and unchanged (s.10) and that they were reliably created, stored and transmitted (s.11); integrity controls are the proof.
Exercise 4
An auditor asks MediCare Plus to show evidence for ISO/IEC 27001:2022 Annex A. For each hospital practice, name the Annex A control:
- Every EHR update goes through an RFC and CAB approval.
- A finance manager approves all supplier payments entered by clerks.
- Backups are restored to a test server every month.
- Every change to a medication order is logged, and admins cannot delete the logs.
Show solution ↓Hide solution ↑
Solution
Match each practice to the requirement it satisfies:
- Controlled change process → 8.32 Change management.
- Maker and checker are different people → 5.3 Segregation of duties.
- Backups kept and tested → 8.13 Information backup.
- Activities logged, logs protected → 8.15 Logging.
Answer: 1 = 8.32, 2 = 5.3, 3 = 8.13, 4 = 8.15.