# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
## 5 Challenges and Techniques
Three-quarters of healthcare providers tend to share patients' data using their personal smartphones. Personal smartphones do not have the same security features as institutional computers; in some circumstances, they get lost or stolen, exposing such data to third parties. Additionally, healthcare centers use off-the-shelf software such as Windows operating systems in medical devices such as MRI scanners, patient monitors, and X-ray machines. Other software includes commonly used databases and browsers. Like any other computer system, such software is vulnerable to attacks and viruses, exposing EHRs to the same attacks. The risks associated with the software are technical and have a low probability of occurrence due to the type of data stored in machines such as X-ray and MRI machines. Very few cyber terminals are interested in such data. In the case of a successful attack, the risk impact is minimal, since the data lost is about the patients' images of part of their internal organs. To manage such a risk, the research paper proposes using technical and administrative measures to protect EHRs. Educating health professionals on security best practices helps. Also, firewalls and data encryption prevent intrusion in the network. Another study [10] considers using packet-filtering firewalls to protect EHR data from cyber-attacks. Status inspection firewalls can also be utilized to protect the records using previously filtered data as the basis to filter malicious activities. Application-level filters can also be applied to prevent intrusion into the network. The study offers some basic concepts of the application of firewalls. Using such technology poses serious risks, as such firewalls cannot prevent attacks using modern hacking methods and tools. The risk impact of using such firewalls is great, as they offer little security. One study [11] focuses on nurses working in various healthcare facilities in the UAE. Most nurses claimed improper access to patients' data, which is a big issue affecting the security of EHRs. Most nurses also lacked knowledge of the use and benefits of simple software such as antivirus programs and their use in protecting their computers. The UAE has nurses from different countries who may unknowingly lack knowledge about its EHR laws and thus can expose EHR data to third parties. The sources of the risks include ignorance about privacy concerns on the part of the healthcare center employees. The risks involved are organizational, and healthcare centers need to train all their professionals about the privacy of patients' information. The probability of the risk occurring is high, as healthcare professionals and other employees are bound to discuss a patient. Despite the high probability, the impact of the data breach is very low, as the employees are the ones with the information and not third parties such as cyber attackers or third parties intending to extort or blackmail the patient. A recent study [12] focuses on the use of blockchain as a security measure for EHRs. Blockchain ensures that patients' data is immutable and cannot be changed by third parties, and once written down, the patient or healthcare professional cannot modify it. Additionally, blockchain offers security for the data against external attacks, as only authorized persons can access the data. The access control only authorizes the patient and their healthcare professional to access the data. Once written, the information is encrypted, and a user must decrypt it to read it. Risks involved in blockchain security are minimal, as the technology is secure by nature. The solution offered is technical. The only source of security breaches is healthcare professionals who read and share the data with others. Otherwise, it is watertight. The probability of a security breach occurring for blockchain applications is very low, in the single digits. Risk impact can be catastrophic, as patients and healthcare professionals trust the technology. Further research [13] focuses on insider attacks on EHR systems.