# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
## 5 Challenges and Techniques
Electronic records are vulnerable to external attacks through cyber breaches. The biggest attacks on EHR systems are insider threats, where employees access the information for malicious activities. Some employees can share their access credentials with external actors who intend to collect patients' data for personal purposes. Sometimes, the employee's credentials are stolen and used to access the system. In other circumstances, employees pretend to be real users of the computer system and access information they have no right to access. Other employees tend to be careless while accessing EHRs, disregarding the organization's security policies and, in the process, risking data stored in institutions' computer systems. The risks are organizational, as the employees are the source of the data breach. The probability of the risk occurring is high, as staffs may be careless due to a lack of knowledge of security best practices or the institution's lack of training on security best practices. The risk impact is high, as a compromised employee is a high risk for a healthcare institution. Also, careless employees are at high risk, as attackers can target their behavior and use it to access the EHRs. One study [14] examines the common vulnerabilities in the implementation of EHR. Most of the databases used in healthcare institutions do not have the same security levels as those used in financial institutions. The lack of advanced technologies in healthcare to protect patient information leads to SQL injections, brute force, cross-site scripting, and cross-site request forgery. Web frameworks used in developing web interfaces to access patients' records tend to have security vulnerabilities that attackers use to access the database. Attacks on web frameworks and databases pose technical risks with a high probability of occurrence. For large hospitals and other healthcare centers, the chances of an attack are 100%, as cyber attackers try to steal personally identifiable information for financial reasons. The risk impact of an attack is catastrophic, as a leak of patients' information exposes the hospital's weakness, with patients losing trust in such a health institution, leading to a loss of revenue. Patients are the biggest losers, as their personally identifiable information is leaked to people with malicious intent. Patients' sensitive health records are also leaked to people who can blackmail them with such information. Another study [15] focuses on the security of EHRs as used by healthcare professionals within the boundaries of healthcare institutions. Whenever healthcare professionals access patients' information remotely, the data is transmitted through a secure channel and encrypted to ensure attackers cannot read the data in the case of a successful attack on the transmission. However, EHRs are not encrypted within the healthcare institution, and healthcare professionals use their devices to access unencrypted data. The lack of encryption poses a significant risk to healthcare institutions. To manage EHRs, a healthcare institution needs an IT team with skills in telecommunications, computer sciences, and sensors. The risk category for a lack of encryption is technical, while that for IT skills is administrative. The probability of an attack risk for data transmitted within a healthcare institution is high. However, the impact of the risk is low, as other factors, such as firewalls and the levels of access of an employee, determine how much information an attacker gets in the case of a successful cyber-attack. A study [16] conducted in Saudi Arabia shows that 38% of physicians are worried about EHR data being leaked through the internet. Also, only 58% of physicians agree that EHRs offer more privacy than paper-based records. Moreover, 82% of physiciansreported sharing patients' data with other physicians using electronic devices. Computers and, by extension, EHRs are important in healthcare, as they can be utilized to analyze how to treat a condition through the provided feedback.