# Cybersecurity in Hospitals: An Evaluation Model
## 8 Discussion  
Before discussing the results obtained from compiling the datasets into the evaluation model, the weights used in the equations of the model were assigned a value of 0.1 to ensure every indicator has the same importance. Those weights can be altered in the future depending on the importance of the indicators for each hospital. Regulatory agencies can also alter the weights according to their standards if the model is being used in their accreditation process. In addition, the final score that is assigned to hospitals is a value between 0 and 100%. The score determines how strong the hospital's cybersecurity system is. According to Table 3, hospital \"A\" achieved the highest score among all three hospitals. The score the hospital received was 80.9%. This score means that the hospital is fairly strong in the area of cybersecurity. The model identified the hospitals' weak and strong measures. The only weak measure was their email protection system. The hospital is not implementing enough spam filters to filter the received emails. As mentioned previously, there are three different types of spam filters that can be used in an email protection system. On the other hand, the hospital is strong enough in four different areas. The hospital has a great inventory policy or system that makes sure all electronic devices (medical and non-medical) are updated at least once a year. Additionally, the hospital prevents unauthorized personnel from accessing medical devices, which prevents any harm being caused to the patients, as well as preventing patient privacy violations. Finally, the hospital implements a cybersecurity policy that instructs employees on dealing with any cybersecurity aspect. The hospital that achieved the second highest score was hospital \"C\" according to Table 3. This score, 65.5%, means that the hospital is moderately vulnerable against cyber \begin{table}
\begin{tabular}{c c c c} \hline
**Measure** & **Hospital** & **A** & **B** & **C** \\ \hline Average number of Up-to-date non-medical devices in every inventory & 150 & 80 & 600 \\ \hline Number of electronic medical devices & 3200 & 1600 & 10,000 \\ \hline Number of inventories of medical devices & 12 & 4 & 12 \\ \hline Average number of Up-to-date medical devices in every inventory & 300 & 250 & 550 \\ \hline Number of employees who can access HIS & 1000 & 450 & 3000 \\ \hline Actual access to HIS & 1300 & 500 & 2800 \\ \hline Number of employees that access medical devices & 700 & 350 & 3600 \\ \hline Actual access to medical devices & 500 & 400 & 3800 \\ \hline Availability of Cybersecurity policy & Yes & No & Yes \\ \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{c c c c} \hline
**Hospital** & **Minimum Indicator** & **Maximum Indicator** & **Final Score** \\ \hline A & Email Protection System & \
\begin{tabular}{c} Medical device access, Updating Medical and \\ non-medical devices, and Cybersecurity Policy \\ \end{tabular} & 80.9\% \\ \hline B & Cybersecurity Policy and \\ Email Protection System &
\begin{tabular}{c} Endpoint Protection System \\ \end{tabular} & 50.2\% \\ \hline C & Cybersecurity Training & Non-medical device Update and Access Management & 65.5\% \\ \hline \end{tabular}
\end{table} 
Table 3: The results of the evaluation model using the three hospitals’ data. attacks. This score indicates that the hospital needs to improve more than one measure in order to improve their cybersecurity. The hospital's weakest measure is training employees on cybersecurity measures and cyber-attacks. In other words, having cybersecurity training as the weakest measure indicates that the hospital either does not perform training sessions or does not train every employee at least once a year. On the other hand, the hospital's strongest measures are updating non-medical devices and access management. This proves that the hospital's maintenance and inventory system is working as desired and does not currently need improvement.