Information Security Risk Assessment in Hospitals.

Area of Science:

• Healthcare Informatics
• Information Security Management
• Risk Assessment

Background:

• Information security threats in healthcare are a growing concern.
• Hospitals face numerous unknown risks to health information security.
• Effective classification of threats is essential for risk mitigation.

Purpose of the Study:

• To assess information security risks in hospitals in northwest Iran.
• To identify high-priority threats to health information.
• To evaluate the current use of security safeguards in healthcare settings.

Main Methods:

• A questionnaire-based study was conducted with 27 hospital IT managers in 2014.
• Content validity and test-retest reliability (r=0.78) were established for the research instrument.
• Both open and closed questions were used to gather comprehensive data.

Main Results:

• Fire was identified as a high probability/high impact risk factor.
• Human and physical/environmental threats were classified as low probability risks.
• Technical safeguards (91.7%) were most frequently used, followed by administrative (87.5%) and physical (66.7%).

Conclusions:

• High-impact risks necessitate immediate corrective actions and root cause analysis.
• Addressing underlying causes of threats is vital to prevent adverse effects.
• Information security in healthcare requires a macro-level approach aligned with national policies.