# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
###### Abstract  
The healthcare industry has been shifting toward electronic health records to improve operations, reduce overhead expenditure, and provide better healthcare. Electronic health records (EHRs) are supposed to offer the same levels of confidentiality and privacy as paper records, which have been used for decades. However, this is not the case, as the technology used to access, transmit, and store records poses a high risk to patients and healthcare organizations. Employees are a big risk to EHRs, as they use their devices to access information about a patient and discuss such records with other employees. Healthcare professionals also access patients' records illegally. Such security loopholes have a high impact on EHRs, as people with malicious intent can use the records to access their financial records or blackmail them. External access to EHRs by cyber attackers poses the highest risk to the records and patients, as attackers are primarily driven by financial gain. On the contrary, internal access to data, though unethical, does not pose a grave danger to patients, as the employees mainly discuss the cases within themselves without any financial incentive to access the data. The current research provides a risk analysis of EHRs, the source of security problems, the impact of the risks involved, and risk management best practices that healthcare organizations can use to protect patients' data.  
electronic health records; security; risk; confidentiality; healthcare organizations +
Footnote †: journal:  
+++ ==WARNING: Truncated because of repetitions==
The security concerns of EHRs make many patients and healthcare professionals overly cautious about them. A study [2] in the U.S. shows that more than two million Americans with mental illnesses never sought medical care due to privacy concerns. A study by [PERSON] and [PERSON] [5] shows that patients with infections and those who face infertility or who procured an abortion tend to avoid divulging their medical history due to privacy, and EHRs make this worse. Such patients avoid medical support altogether if they have any feelings that their data will be stored digitally.  
A risk analysis of EHRs involves identifying the risks involved in digitizing hospital records. The sources of security problems are identified. The probability of occurrence is evaluated, with the possible impact on the organization being investigated to provide an overview of the extent of the damage the problem poses to the organization [6]. A risk probability and assessment scale shown in Table 1 below is used to analyze the risk of implementing EHRs. Solutions are offered to manage the risk, and monitoring is carried out to eliminate or minimize the risk.  
The current research paper aims to explore security risks because of the implementation of EHRs. The study examines the significance of the risks, their impact on the healthcare institution and patients, and whether they warrant risk management. The research proposes implementing risk control to eliminate or reduce the risks to acceptable levels where patients feel safe in a healthcare institution.  
The current study proposes using firewalls to control data flow and access control to restrict people from accessing the records. The use of artificial intelligence/machine learning (AI/ML) to restrict the flow of information in EHRs is suggested for further research.