Breach Risk Magnitude: A Quantitative Measure of Database Security.

Area of Science:

• Health Informatics
• Information Security
• Database Management

Background:

• Health record systems store sensitive patient data, making them targets for breaches.
• Assessing the security of these systems requires objective, quantitative methods.
• Current methods may not fully capture the complexities of data access and authentication.

Purpose of the Study:

• To introduce a quantitative methodology for evaluating health record system breach potential.
• To establish a metric, breach risk magnitude (BRM), for objective security assessment.
• To compare the security implications of different data architectures using BRM.

Main Methods:

• Developed a quantitative methodology based on the number of accessible records and authentication steps.
• Defined breach risk magnitude (BRM) as the log of accessible records divided by authentication steps.
• Calculated BRM for a traditional relational database and a secure, encrypted architecture.

Main Results:

• A one million-record relational database showed BRM values from 5.52 to 6.
• An alternative architecture with separate, encrypted records had significantly lower BRM, ranging from 1.3 to 2.6.
• The methodology provides objective data for comparing security levels.

Conclusions:

• The breach risk magnitude (BRM) offers a valuable quantitative assessment of health record system security.
• Alternative data architectures can substantially reduce breach risk.
• BRM can guide decisions on database organization to enhance patient data protection.