# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
## 2 Problem Statement  
Healthcare organizations have relied on EHRs for some time, leading to security risks due to the nature of data storage and access. Most healthcare professionals prefer manual methods, as they cite security concerns with using EHRs. On the other hand, patients are cautious when divulging personal information such as infections and infertility whenever they know the information will be stored digitally. Such apprehension by healthcare  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Scale** & **Safety** & **Effectiveness** & **Security** \\ \hline \multirow{3}{*}{Catastrophic} & \multirow{3}{*}{Severe injury, death} & \multirow{3}{*}{Planned operation is no longer possible} & May cause system extended outage or permanent closure, causing operations to resume in a Hot Site environment. May result in complete compromise of information or services. \\ \hline \multirow{3}{*}{High} & \multirow{3}{*}{\begin{tabular}{c} Permanent impairment of body function or permanent damage to a body structure \\ \end{tabular} } & \multirow{3}{*}{Planned operation is disrupted or delayed} & May cause considerable system outage and loss of control, customers, and business confidence. May result in the compromise of large amounts of information or services. \\ \hline \multirow{3}{*}{Medium} & \multirow{3}{*}{\
\begin{tabular}{c} Temporary and minor injury, medical intervention required \\ \end{tabular} } & \multirow{3}{*}{Inconveniencing effect to planned operation} & Will result in some tangible consequence, albeit negligible and perhaps only noted by a few individuals or agencies. May cause embarrassment. Will require some expenditure of resources to repair. \\ \hline \multirow{3}{*}{Low} & \multirow{3}{*}{
\begin{tabular}{c} Temporary discomfort, reversible without medical intervention \\ \end{tabular} } & Very limited or no impact on operation & Will have some minor effect on the system. It may require minimal effort to repair or reconfigure the system. \\ \hline \multirow{2}{*}{Negligible} & \multirow{2}{*}{Minor and short-term discomfort realized and exploits vulnerability} & Will have no impact if threat is realized and exploits vulnerability \\ \hline \multicolumn{2}{c}{**Description**} \\ \hline Improbable & Very unlikely that use will result in any unintended consequence \\ \hline Remote & Not likely to result in any unintended consequence \\ \hline Occasional & Somewhat likely to result in any unintended consequence \\ \hline Probable & Very likely to result in any unintended consequence \\ \hline Frequent & Unintended consequences occur frequently or occur every time \\ \hline \hline \end{tabular}
\end{table}
Table 1: Levels of probability and severity of risk [6].  
professionals and patients shows a problem with EHRs. The technology used in storing, transmitting, and accessing EHRs is outdated and poses a high risk to the data. In the case of a successful cyber-attack, the risk is high, as an attacker who compromises the software used in the computer systems can obtain and leak all the data stored in such systems. Besides technology, employees working in a healthcare center pose the greatest danger to EHRs, as carelessness and ignorance can expose patients' records to the wrong person. Employees pose the highest risk of exposing patient records due to a lack of knowledge of national and regional laws and security best practices when handling patients' data.