# The Risk Assessment of the Security of Electronic Health Records Using Risk Matrix
## 5 Challenges and Techniques
According to the physicians, there is no difference between paper-based records and EHRs. The probability of physicians sharing health records is high, at least 80%, though the risk impact from such actions is low, probably 0%. Sharing medical records between physicians does not pose any danger to the patients. However, the leakage of information through the internet poses a high risk to the patients. The probability of EHR data leakage is high, and the impact of the leak is high. A recent study [17] explains the integration of big data into healthcare and the security threat that the digitization of healthcare information poses to patients. The largest internet leak of personal information is through medical websites and technology. The leak happens through both external cyber-attacks and internal sabotage. However, restricting access through blockchain solves the problem through access control, as internal players in the health sector have a small amount of data to leak, and external attacks do not leak the entire database. The probability of internal and external leakage is high. However, the impact of internal sabotage is low, as the people involved may be targeting specific people. At the same time, the effects of external attacks are high since attackers target the entire database. Blockchain applications reduce the impact of both internal and external data leaks. Further research [18] shows that cryptographic and mathematical algorithms are applicable to EHR security. Asymmetric cryptography with both private and public keys can protect data against cyber-attacks. Additionally, role-based access control can ensure that only patients and healthcare professionals can access the medical records, with everyone else, including hospital administration, accessing redacted information. Access control and asymmetric cryptography are essential in case EHRs are stored in the cloud. Mathematical algorithms are used to protect health records while in transit, ensuring the data is not readable except to the receiver and sender. Such security reduces the risks of cyber-attacks. For a successful attack on EHRs, the impact is minimal, as access control ensures data is redacted and the entire database is not accessible. One study [19] exposes the weakness in EHRs. Some of the technologies used in EHRs are outdated and pose a serious security threat to the records. EHRs are integrated into IoT devices and other electronic gadgets such as health insurance IC cards and doctors' smart cards. The smart card is used to retrieve medical records from the database using a unique doctor's signature key. The IC card holds patients' details. The two cards are a security risk, as they have small computational power and memory to enable them to encrypt the data they transmit. The probability of an attack emanating from the cards is medium-low. However, a successful attack can lead to a high-risk impact, as patient details can be leaked to the wrong hands. Recent research [20] explains the vulnerabilities in EHRs as a result of using the cloud. Cloud networks tend to centralize the data. To overcome the vulnerabilities and challenges of data centralization, distributed architecture ensures the data is spread to different servers. On top of decentralization, encryption and proxy re-encryption can ensure data privacy. EHR sharing protocols can be used to secure the data, ensuring only specific devices access the data. Finally, authorization can be added to security protocols to ensure that only authorized people access the data. The probability of a cyber-attack with such security is very low. Even if a successful attack is successful, the impact is still low, as attackers' access only part of the data, and it is hard to store all information in a decentralized system. Further research [21] delves into the evolution of EHRs and how security has been incorporated into their use. Traditional EHRs lacked privacy features and thus were prone to cyber-attacks.