# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
## 5 Challenges and Techniques
However, modern EHR systems have anonymization algorithms that provide privacy, control access to records, and deliver a safe platform to share data between patients and health professionals. Other security measures include recognition and classification algorithms that provide selective encryption to sensitive details about patients' records. Access to such records shows redacted information. The probability of an attack occurrence is medium-low for such a secure EHR system, and the impact is still low, as the information has already been redacted. One study [22] notes that the biggest concerns regarding the application of EHRs revolve around security, privacy, and confidentiality. Patients fear their data may be leaked and thus have trust issues when divulging information to healthcare professionals. However, the biggest data leaks do not occur through cyber attackers but through healthcare professionals who share the information among themselves and with other entities. The probability of healthcare professionals sharing patients' data is very high. Despite such data sharing, the impact on patients is minimal, as healthcare professionals tend to share the data to seek solutions and not to expose the patients. Recent research [23] looks into the privacy control mechanisms used by some countries. The first mechanism includes implementing laws and ensuring that all healthcare providers abide by such rules. The second involves management methods such as access control, where various employees in a healthcare organization have different access to the records. The third mechanism involves the use of technology such as data encryption and the use of digital signatures, where the healthcare professional must sign into their account with full credentials to access EHRs. The probability of a cyber-attack in such a system is medium-high. However, in the case of a successful attack, the impact is catastrophic, as attackers can use the full credentials of a healthcare professional to access the system. More security features are required. EHRs face security threats such as malware, phishing attacks, cloud threats from cloud providers, insider attacks, and encryption blind sports. A recent study [24] explains that the origin of the security problems includes a lack of training on EHR security for healthcare professionals. Remote storage, mostly in the cloud, adds another security loophole. Accessing EHRs using mobile devices such as smartphones and laptops increases the attack surface, as such devices are not secure. The probability of a cyber-attack for healthcare organizations allowing employees to access EHRs using personal electronic devices is high, almost certain. The impact of a successful attack is catastrophic, as the attacker has many devices they can compromise and later use to access the EHR database, causing havoc. The cloud systems are not secure by default, and this exposes the healthcare organization to more cyber-attacks. Further research [25] aims to understand security and privacy during the development of the healthcare system. The security of the system is achieved by restricting access to the data in its lifecycle. Privacy is achieved through laws and policies regarding people and entities that can view medical and financial information stored in the system. The authentication of individuals, authorization, and providing access are necessary for a secure system. However, such a system is prone to attack, as attackers use sophisticated methods to penetrate the system. The impact of a successful attack is catastrophic. Such a system is a huge threat to the organization, as the data still needs to be encrypted and communication channels secured.