# Study on Control of Risks Existing in the Construction of Information Management System in Public Hospitals

Authors: Feifei Xu; Qingya Guan
Journal: Security and Communication Networks
 (2022)

---

## Abstract

In terms of the medical information management system, it can effectively increase the resource utilization rate of medical and health institutions, optimize the management process, and provide relevant, efficient management approaches, all of which help medical and health institutions meet their internal and external demands to the greatest possible extent. However, the projects related to the information management system in hospitals or other medical institutions are characterized by high system complexity, multiple related links, and uncertainty of project demands due to their own professional and industrial characteristics, which are frequently manifested as many limiting factors in the construction process. It is essential to determine the kind of risk and evaluation methods to explore the risk evaluation indicators and formulate corresponding countermeasures for ongoing medical institution information systems projects. In such a background, this study establishes a perfect risk identification and evaluation system by taking the risk management of projects related to medical institution information system in R hospital as the research object and proposes the corresponding countermeasures as the reference for the establishment of the information management system.


---

## Body

## 1. Introduction

Presently, the hospital information system offers many benefits in terms of increasing the utilization rate of various resources, optimizing the resource and manpower management process, highly efficient management mode, and meeting the hospital’s internal and external demands to the greatest possible extent [1]. However, owing to its own economic and social benefits, the hospital will undoubtedly and regularly invest more resources in initiatives related to the information management system. Computer information technology and systems, which are widely regarded as one of the most important resources for businesses to improve productivity and maximize internal resources, have reached maturity [2]. If appropriately implemented in hospitals, it has the potential to further optimize hospital management, ultimately assisting in the improvement of treatment management efficiency. However, computer information technology systems are usually associated with different types of risks so hospitals are required to reasonably identify and evaluate the potential risk status accordingly [3].Hospital management information systems provide an institutional framework consisting of different information about the medical, financial, and managerial functions of a particular hospital [4]. The expert workforce, computer networks, system models, and system information necessary to execute different operations such as information collection, processing, storage, access, and dissemination are all included in information systems. Information systems can be viewed as systems that aim to provide accurate, up-to-date information when and where it is needed [5]. According to Dalairi et al. [6], information management systems are used to monitor the environment and consider how external elements interact with one another and with government agencies. Ayatollahi and Shagerdi [7] conducted a health information security risk analysis. Among the information security risks, fire was found to be a high probability/high impact risk factor. Human and physical/environmental threats were among the low probability risk factors. Zahra et al. [8] argued that the hospital information management system is a computer-based system that allows hospitals to gather and process all relevant information on healthcare services and management. The automation system in the electronic environment may communicate this information across the components. It integrates many pieces of information that arise from the hospital’s medical, financial, and managerial operations.According to Zahra and Nasir [9], the hospital information management system is a privatized institutional resource planning system that has been upgraded to meet the demands of the healthcare industry. Because hospitals have so many operations, hospital information management systems store a lot of data. In this sort of system, a wide range of data is available, from the patient’s workforce to what the staff can manufacture or perform to monitor hospital operations and streamline administrative activities [10].The traditional risk analysis methods are not able to meet the requirements for undertaking the risks in projects related to hospital information systems. Such category of demand analyzes and evaluates the hospital information system in various stages of project implementation and establishes a complete hospital information system risk assessment system; moreover, it is also able to evaluate the risk factors quantitatively. Therefore, this study takes the risk management of projects related to the information management system in R hospital as the research object and highlights and establishes a set of risk identification and evaluation methods; then, the corresponding countermeasures are proposed as the reference for the establishment of the information management system.The rest of the manuscript is ordered as follows: Section2 provides an overview of the relevant concepts and theories. Section 3 describes the different methods and ideas for risk identification. In Section 4, different results are presented and Section 5 concludes the manuscript.


## 2. Concepts and the Relevant Theoretical Basis

### 2.1. Concepts

Project risk management refers to the matter of fact that the project manager defines the potential risks possibly existing in various stages of design, construction, and acceptance based on the risk assessment of the whole project, analyzes the probability of risk problems, and timely adopts correspondence strategies for tackling such risks [11]. The features of project risk are specified as follows:Objectivity: the various potential risks exist in the implementation process of engineering projects to some extent. However, the risks are material and objective without being transferred by human will. Moreover, in different areas and different external natural environments, the potential risk factors are also different.Uncertainty: there are certainly various influencing factors within the execution of the project while the various risk factors are random when it comes to the occurrence time, frequency, and consequences brought by such risks [12]. For the same risk factors, there are different forms for the different construction projects, so the uncertainty is obvious.Estimability: considerable stakeholders are concerned in the entire process from project initiation to final acceptance. Additionally, different stakeholders are also going to initiate gaming with each other. With the impact of internal and external complex environment, risks are diverse; however, they can still be predicted and evaluated through certain technical means.Secondly, the causes and types of project risk are defined as follows:Cognitive limitations: many processes are closely related to the engineering projects within the process of implementation; moreover, there are great differences for different processes in terms of the manifestation forms and occurrence probability [13]. While the technical means are constantly improved, the awareness of managers of the project risks is also enhanced accordingly. However, compared with the ever-changing risk factors outside, human beings’ limited cognition and means still cannot fully recognize all the possible risk factors [14].The backwardness of information technology: the current information technologies are still insufficient compared with different forms of risk events; furthermore, the technology renewal is still lagging behind the variation of risk events. If the project managers are willing to realize the effective control of personnel, materials, and other factors in the actual risk management, as well as control the project risk at the optimal level, they are required to take reasonable technical means, master the historical data of risk events, and timely take countermeasures [15].


### 2.2. Foundation of Theories and Methods

As for the project of risk identification, the key step lies in selecting the proper analysis methods or tools which are taken as the necessary means for managers to seek, understand, and determine project risks. In general, the mostly used risk management methods in engineering projects include the literature method, scholar estimation method, Delphi method, practical research method, brainstorming method, and so on. Each method is limited by certain conditions, so they must be comprehensively selected by taking the project construction content, risk characteristics, the number of relevant information materials, and whether the risks of similar projects can be taken into consideration [16].This study attempts to evaluate the risks of projects related to the information management system in R hospital. The selected method is the fuzzy comprehensive evaluation method based on the analytic hierarchy process. The analytic hierarchy process aims at obtaining the basic matrix required for fuzzy comprehensive evaluation [17]. The analytic hierarchy process is mainly used to determine the weight of various risk factors and its calculation process is relatively complex. The hierarchical classification based on various factors is carried out by relying on the judgment of matrix learning experience and professional knowledge with the help of experts in the industry; then, the relevant calculation is started according to steps and formulas for calculating the weight value and the relative weight of consistency indexes [18].


## 2.1. Concepts

Project risk management refers to the matter of fact that the project manager defines the potential risks possibly existing in various stages of design, construction, and acceptance based on the risk assessment of the whole project, analyzes the probability of risk problems, and timely adopts correspondence strategies for tackling such risks [11]. The features of project risk are specified as follows:Objectivity: the various potential risks exist in the implementation process of engineering projects to some extent. However, the risks are material and objective without being transferred by human will. Moreover, in different areas and different external natural environments, the potential risk factors are also different.Uncertainty: there are certainly various influencing factors within the execution of the project while the various risk factors are random when it comes to the occurrence time, frequency, and consequences brought by such risks [12]. For the same risk factors, there are different forms for the different construction projects, so the uncertainty is obvious.Estimability: considerable stakeholders are concerned in the entire process from project initiation to final acceptance. Additionally, different stakeholders are also going to initiate gaming with each other. With the impact of internal and external complex environment, risks are diverse; however, they can still be predicted and evaluated through certain technical means.Secondly, the causes and types of project risk are defined as follows:Cognitive limitations: many processes are closely related to the engineering projects within the process of implementation; moreover, there are great differences for different processes in terms of the manifestation forms and occurrence probability [13]. While the technical means are constantly improved, the awareness of managers of the project risks is also enhanced accordingly. However, compared with the ever-changing risk factors outside, human beings’ limited cognition and means still cannot fully recognize all the possible risk factors [14].The backwardness of information technology: the current information technologies are still insufficient compared with different forms of risk events; furthermore, the technology renewal is still lagging behind the variation of risk events. If the project managers are willing to realize the effective control of personnel, materials, and other factors in the actual risk management, as well as control the project risk at the optimal level, they are required to take reasonable technical means, master the historical data of risk events, and timely take countermeasures [15].


## 2.2. Foundation of Theories and Methods

As for the project of risk identification, the key step lies in selecting the proper analysis methods or tools which are taken as the necessary means for managers to seek, understand, and determine project risks. In general, the mostly used risk management methods in engineering projects include the literature method, scholar estimation method, Delphi method, practical research method, brainstorming method, and so on. Each method is limited by certain conditions, so they must be comprehensively selected by taking the project construction content, risk characteristics, the number of relevant information materials, and whether the risks of similar projects can be taken into consideration [16].This study attempts to evaluate the risks of projects related to the information management system in R hospital. The selected method is the fuzzy comprehensive evaluation method based on the analytic hierarchy process. The analytic hierarchy process aims at obtaining the basic matrix required for fuzzy comprehensive evaluation [17]. The analytic hierarchy process is mainly used to determine the weight of various risk factors and its calculation process is relatively complex. The hierarchical classification based on various factors is carried out by relying on the judgment of matrix learning experience and professional knowledge with the help of experts in the industry; then, the relevant calculation is started according to steps and formulas for calculating the weight value and the relative weight of consistency indexes [18].


## 3. Risk Identification

### 3.1. Thoughts and Ideas for Risk Identification

The risk factor identification flow chart is designed and shown in Figure1 to fully identify the main risk factors existing in the establishment of the project information management system in R hospital.Figure 1
The flow of risk identification.


### 3.2. Questionnaire Survey on Identification of Project Risk Factors

First, we designed a questionnaire, taking into account the following principles, objects, scales, and implementation methods.(i)
Principles: in the questionnaire design process, the questionnaire is developed based on risk management theory and in line with the questionnaire’s purpose, acceptability, sequential, concise logic, matching, objectivity, answer exhaustiveness, non-oriented, and other design criteria.(ii)
Objects: the expert panel members who participated in the questionnaire survey of this study are selected from three areas: one was the hospital information management and other professional and technical staff of the hospital, and the second was the supervision institution involved in the construction of the project and the third was the technical staff of various other institutions involved in the construction of the project. All of them had some understanding and mastery of the project risk status and were willing to participate in the questionnaire survey of this paper.(iii)
Scales: after multiple communication and coordination, a total of 30 expert group members were finally identified and their source composition is shown in Table1.(iv)
Implementation: before conducting a questionnaire survey on the possible risk factors faced by the information system project in the implementation process of R hospital, the authors first selected “project risk management” and “hospital information construction project” as keywords and collected a large amount of relevant literature through knowledge networks, Wanfang, and other literary tools. A large amount of relevant literature was collected. The collected literature was systematically sorted out to obtain a preliminary list of project risk factors for hospital informatization systems and then a questionnaire was developed and distributed to selected experts and scholars. After the first stage of a questionnaire survey, the results of the 30 questionnaires collected were summarized in this study, and the specific results are shown in Table2.Table 1
Composition of the expert panel for the questionnaire.
SourcePositionQuantityNoteProject ownersProject manager1Responsible for projectimplementation and trackingTechnical director1The first project manager2The contractorDeputy project manager2Participating in the construction managementof the same scale or similar projects,having certain project risk management experienceChief technical engineer1Chief manufacturer engineer2Deputy chief technical engineer6Safety engineer8Treasurer2The teaching unitProfessor1Engaged in project risk management teaching and researchAssociate professor2Risk assessment agencyRisk assessor1Engaged in risk assessment related workTable 2
Summary of the results of the questionnaire Survey.
Name of the riskTinySmallerGeneralLargerGreatRisk of insufficient organizational execution0015105Risk of inadequate system operation capability of personnel0002010Improper system operation and maintenance risks0012162Risk of inadequate organization of personnel0015105Lack of awareness of cost control risks00101010Hardware loss exceeds expected risk0016104Equipment and facilities price rise risk001028Unreasonable risk of capital allocation008814System design failure risk005520The system function cannot meet the risk of hospital demand00101010Network hardware failure risks0010128Core network system operation risks0010515System operation instability risk0051015Hardware network security risks00101010Hospital application needs to change the risk00101010Risk of uncorrected progress0012108Risk of delivery delay0015105Risk of schedule delay due to rework00101010Technical disclosure execution risk is not in place008814Failure risk of new technology application006618Risk of non-standard operation by technical personnel0051015Risk of system security failure00101010Database backup risks0012162Equipment room security risks0012126User rights are incorrectly configured0051510Network security management software upgrade risk0012108


### 3.3. Identification of Project Risk Factors

The Delphi method was used to obtain the final identification of risk factors. Moreover, through the comparison of before and after data, the risk factors of information technology projects in R hospital during the construction phase reduced from the initial 30 to 26. The risk factors for information technology projects in R hospital are summarized in Table3.Table 3
Summary of risk factors in the construction stage of R hospital informatization project.
Risk factorsRisk categoriesOrganizational management riskRisk of insufficient organizational executionRisk of inadequate system operation capability of personnelImproper system operation and maintenance risksRisk of inadequate organization of personnelThe cost of riskLack of awareness of cost control risksHardware loss exceeds expected riskEquipment and facilities price rise riskUnreasonable risk of capital allocationSystem operation riskSystem design failure riskThe system function cannot meet the risk of hospital demandNetwork hardware failure risksCore network system operation risksSystem operation instability riskHardware network security risksSchedule riskHospital application needs to change the riskRisk of uncorrected progressRisk of delivery delayRisk of schedule delay due to reworkTechnical riskTechnical disclosure execution risk is not in placeFailure risk of new technology applicationRisk of non-standard operation by technical personnelSecurity risksRisk of system security failureDatabase backup risksEquipment room security risksUser rights are incorrectly configuredNetwork security management software upgrade risk


## 3.1. Thoughts and Ideas for Risk Identification

The risk factor identification flow chart is designed and shown in Figure1 to fully identify the main risk factors existing in the establishment of the project information management system in R hospital.Figure 1
The flow of risk identification.


## 3.2. Questionnaire Survey on Identification of Project Risk Factors

First, we designed a questionnaire, taking into account the following principles, objects, scales, and implementation methods.(i)
Principles: in the questionnaire design process, the questionnaire is developed based on risk management theory and in line with the questionnaire’s purpose, acceptability, sequential, concise logic, matching, objectivity, answer exhaustiveness, non-oriented, and other design criteria.(ii)
Objects: the expert panel members who participated in the questionnaire survey of this study are selected from three areas: one was the hospital information management and other professional and technical staff of the hospital, and the second was the supervision institution involved in the construction of the project and the third was the technical staff of various other institutions involved in the construction of the project. All of them had some understanding and mastery of the project risk status and were willing to participate in the questionnaire survey of this paper.(iii)
Scales: after multiple communication and coordination, a total of 30 expert group members were finally identified and their source composition is shown in Table1.(iv)
Implementation: before conducting a questionnaire survey on the possible risk factors faced by the information system project in the implementation process of R hospital, the authors first selected “project risk management” and “hospital information construction project” as keywords and collected a large amount of relevant literature through knowledge networks, Wanfang, and other literary tools. A large amount of relevant literature was collected. The collected literature was systematically sorted out to obtain a preliminary list of project risk factors for hospital informatization systems and then a questionnaire was developed and distributed to selected experts and scholars. After the first stage of a questionnaire survey, the results of the 30 questionnaires collected were summarized in this study, and the specific results are shown in Table2.Table 1
Composition of the expert panel for the questionnaire.
SourcePositionQuantityNoteProject ownersProject manager1Responsible for projectimplementation and trackingTechnical director1The first project manager2The contractorDeputy project manager2Participating in the construction managementof the same scale or similar projects,having certain project risk management experienceChief technical engineer1Chief manufacturer engineer2Deputy chief technical engineer6Safety engineer8Treasurer2The teaching unitProfessor1Engaged in project risk management teaching and researchAssociate professor2Risk assessment agencyRisk assessor1Engaged in risk assessment related workTable 2
Summary of the results of the questionnaire Survey.
Name of the riskTinySmallerGeneralLargerGreatRisk of insufficient organizational execution0015105Risk of inadequate system operation capability of personnel0002010Improper system operation and maintenance risks0012162Risk of inadequate organization of personnel0015105Lack of awareness of cost control risks00101010Hardware loss exceeds expected risk0016104Equipment and facilities price rise risk001028Unreasonable risk of capital allocation008814System design failure risk005520The system function cannot meet the risk of hospital demand00101010Network hardware failure risks0010128Core network system operation risks0010515System operation instability risk0051015Hardware network security risks00101010Hospital application needs to change the risk00101010Risk of uncorrected progress0012108Risk of delivery delay0015105Risk of schedule delay due to rework00101010Technical disclosure execution risk is not in place008814Failure risk of new technology application006618Risk of non-standard operation by technical personnel0051015Risk of system security failure00101010Database backup risks0012162Equipment room security risks0012126User rights are incorrectly configured0051510Network security management software upgrade risk0012108


## 3.3. Identification of Project Risk Factors

The Delphi method was used to obtain the final identification of risk factors. Moreover, through the comparison of before and after data, the risk factors of information technology projects in R hospital during the construction phase reduced from the initial 30 to 26. The risk factors for information technology projects in R hospital are summarized in Table3.Table 3
Summary of risk factors in the construction stage of R hospital informatization project.
Risk factorsRisk categoriesOrganizational management riskRisk of insufficient organizational executionRisk of inadequate system operation capability of personnelImproper system operation and maintenance risksRisk of inadequate organization of personnelThe cost of riskLack of awareness of cost control risksHardware loss exceeds expected riskEquipment and facilities price rise riskUnreasonable risk of capital allocationSystem operation riskSystem design failure riskThe system function cannot meet the risk of hospital demandNetwork hardware failure risksCore network system operation risksSystem operation instability riskHardware network security risksSchedule riskHospital application needs to change the riskRisk of uncorrected progressRisk of delivery delayRisk of schedule delay due to reworkTechnical riskTechnical disclosure execution risk is not in placeFailure risk of new technology applicationRisk of non-standard operation by technical personnelSecurity risksRisk of system security failureDatabase backup risksEquipment room security risksUser rights are incorrectly configuredNetwork security management software upgrade risk


## 4. Evaluation and Analysis

### 4.1. Flow of Evaluation of Project Risks

In this study, the Delphi method was used to identify a total of 26 risk factors in six categories in the IT system project in R hospital, which achieved the first process of this risk management. The next step was to quantitatively assess the project risks by using the fuzzy comprehensive evaluation method to obtain the project risk level, identify important risk factors, and develop control measures. In this regard, it was conducive to guiding the project manager to effectively control the occurrence of various risks when participating in future project management.


### 4.2. Steps of Project Risk Evaluation

First, the evaluation index system was constructed according to the 26 risk factors of the information system and used as evaluation indexes. The six risks described referred to the standard level index, while the overall risk of the project was the target level index. The framework structure and letter representation are shown in Table4.Table 4
Hierarchical structure of risk evaluation index system of information system project in R hospital.
The target layerRule layerIndex layerCode nameThe nameof the riskCode nameThe nameof the riskCode nameThe name of the riskAR hospitalinformationsystem project riskA1Organizationalmanagement riskA11Risk of insufficient organizational executionA12Risk of inadequate system operation capability of personnelA13Improper system operation and maintenance risksA14Risk of inadequate organization of personnelA2The cost of riskA21Lack of awareness of cost control risksA22Hardware loss exceeds expected riskA23Equipment and facilities price rise riskA24Unreasonable risk of capital allocationA3Systemoperation riskA31System design failure riskA32The system function cannot meet the risk of hospital demandA33Network hardware failure risksA34Core network system operation risksA35System operation instability riskA36Hardware network security risksA4Schedule riskA41Hospital application needs to change the riskA42Risk of uncorrected progressA43Risk of delivery delayA44Risk of schedule delay due to reworkA5Technical riskA51Technical disclosure execution risk is not in placeA52Failure risk of new technology applicationA53Risk of non-standard operation by technical personnelA6Security risksA61Risk of system security failureA62Database backup risksA63Equipment room security risksA64User rights are incorrectly configuredA65Network security management software upgrade risk(1)A2=A21×A24;A3=A31×A36;A4=A41×A44;A5=A51×A53;A6=A61×A65.Based on this hierarchical model, a criterion level judgment matrix was established with “A1 organizational management risk,” “A2 cost risk,” “A3 system risk,” “A4 progress risk,” “A5 technology risk,” and “A6 security risk” as indicators, which can be expressed as follows:A=A1×A6. In this way, the judgment matrix of the indicator layer is constructed, respectively, and can be expressed as(2)A1=A11×A14;A2=A21×A24;A3=A31×A36;A4=A41×A44;A5=A51×A53;A6=A61×A65.Secondly, the judgment matrix is constructed. In constructing the judgment matrix at the criterion level and the judgment matrix at the indicator level, the basic data of each indicator required is determined with the help of expert scoring [17]. The importance of all risk factors in different judgment matrices is evaluated according to Saaty’s nine importance levels and the way they are assigned set in Table 5.Table 5
Comparison table of relative importance scale and quantity ratio.
The factorI over factor JThe volume ratioNoteAs important1Otherwise, the reciprocal of the ratio of each quantity is takenA little important3More important5Highly important7Extremely important9The intermediate value of two adjacent judgments2, 4, 6, 8In terms of scoring expert selection, 30 experts involved in the project risk factor prediction of the information technology system were still invited to compare the relative importance of all indicators in the judgment matrix of one criterion layer and six indicator layers with the ratios being assigned; then the average value is calculated to obtain the composition of the corresponding judgment matrix. The judgment matrix A of the criterion layer is expressed as shown in Table6.Table 6
Judgment matrix A in criterion level.
AA1Organizationalmanagement riskA2The costof riskA3Systemoperation RiskA4Schedule riskA5Technical riskA6Security risksA1Organizational management risk11/41/5311/3A2The cost of risk2121/41/31/4A3System operation Risk41/31431/5A4Schedule risk1/221/321/31/3A5Technical risk111/41/321/3A6Security risks235232The judgment matrix A1 in the indicator level can be expressed as follows (Table7).Table 7
Judgment matrix A1 in the indicator level.
A1Organizational management riskA11Risk of insufficient organizational executionA12Risk of inadequate system operation capability of personnelA13Improper system operation and maintenance risksA14Risk of inadequate organization of personnelA11Risk of insufficient organizational execution141/51/4A12Risk of inadequate system operation capability of personnel1/311/21/4A13Improper system operation and maintenance risks6211/3A14Risk of inadequate organization of personnel5341The judgment matrix A2 in the indicator level can be expressed as follows (Table8).Table 8
Judgment matrix A2 in the indicator level.
A2The cost of riskA21Lack of awareness of cost control risksA22Hardware loss exceeds expected riskA23Equipment and facilities price rise riskA24Unreasonable risk of capital allocationA21Lack of awareness of cost control risks11/41/21/7A22Hardware loss exceeds expected risk4134A23Equipment and facilities price rise risk21/312A24Unreasonable risk of capital allocation71/41/21Similarly, the judgment matrix A3 in the indicator level can be expressed as shown in Table9.Table 9
Judgment matrix A3 in the indicator level.
A3System operation riskA31System design failure riskA32The system function cannot meet the risk of hospital demandA33Network hardware failure risksA34Core network system operation risksA35System operation instability riskA36Hardware network security risksA31System design failure risk11/31/41/51/51/4A32The system function cannot meet the risk of hospital demand312343A33Network hardware failure risks41/211/235A34Core network system operation risks31/32131/2A35System operation instability risk51/41/31/311/4A36Hardware network security risks41/31/5241The judgment matrix A4 in the indicator level can be represented as in Table10.Table 10
Judgment matrix A4 in the indicator level.
A4Schedule riskA41Hospital application needs to change the riskA42Risk of uncorrected progressA43Risk of delivery delayA44Risk of schedule delay due to reworkA41Hospital application needs to change the risk11/21/31/3A42Risk of uncorrected progress2161/3A43Risk of delivery delay31/611/4A44Risk of schedule delay due to rework3341Judgment matrix A5 in the indicator level is given in Table11.Table 11
Judgment matrix A5 in the indicator level.
A5Technical riskA51Technical disclosure execution risk is not in placeA52Failure risk of new technology applicationA53Risk of non-standard operation by technical personnelA51Technical disclosure execution risk is not in place11/41/3A52Failure risk of new technology application216A53Risk of non-standard operation by technical personnel31/61Judgment matrix A6 in the indicator level is expressed as follows (Table12).Table 12
Judgment matrix A6 in the indicator level.
A6Security risksA61Risk of system security failureA62Database Backup RisksA63Equipment Room Security RisksA64User rights are incorrectly configuredA65Network security management software upgrade riskA61Risk of system security failure121/21/21A62Database Backup Risks1/211/31/31/2A63Equipment Room Security Risks1/211/31/31/2A64User rights are incorrectly configured23123A65Network security management software upgrade risk121/31/21According to the main statistical methods and detailed steps of the weight values in the hierarchical analysis method, the scores of each index in the judgment matrix of the criteria and index layers are recorded in a table; moreover, the weights are calculated using the formula function. To verify the consistency of the indexes by using the hierarchical analysis method, it was necessary to calculate the CI which can be expressed as(3)CI=λmaxn−1.Usually, the average consistency index RI is obtained after the calculation and then the obtained index is substituted in (4) to obtain CR:(4)CR=CIRI.WhenCR<0.1, it implied a high level of consistency for the judgment matrix.The standard value of the average random consistency index RI is used to guarantee the consistency of the validation index, which is shown in Table13.Table 13
Standard values of average random consistency index RI.
Matrix order12345678910RI000.580.911.141.261.351.421.461.52In this study, the indicator weights of various risk elements in the judgment matrix of the criterion layer are obtained, as well as the six indicator layers through arithmetic operations while verifying their consistency. The conclusions are listed in Table14.Table 14
Weight scores of each judgment matrix and conclusions of consistency test.
Target layerWeight valueStandard layerRelative weight valueConsistency verificationIndicator layerRelative weight valueConsistency verificationA1A10.1398λmaxCI=0.064RI=1.26CR=0.06<0.1A110.1638λmaxCI=0.007RI=0.91CR=0.008<0.1A120.1488A130.3272A140.3619A20.1569A210.1622λmaxCI=0.018RI=0.92CR=0.019<0.1A220.4244A230.2706A240.1456A30.2114A310.0992λmaxCI=0.022RI=1.25CR=0.018<0.1A320.3056A330.2018A340.1682A350.0882A360.1602A40.0862A410.1475λmaxCI=0.018RI=0.91CR=0.019<0.1A420.1948A430.2305A440.4296A50.1398A510.1659λmaxCI=0.026RI=0.59CR=0.043<0.1A520.4956A530.3109A60.2664A610.1545λmaxCI=0.04RI=1.14CR=0.018<0.1A620.0896A630.3645A640.2548A650.1458After calculating the relative weights of each index value in each judgment matrix, it was feasible to further calculate the comprehensive weight value of each risk factor index, which was the comprehensive importance of each risk factor index in the index layer for the “information system project risk in R hospital.” When calculating the relative weight of the index, the index value is multiplied by calculating the relative weight of the index, the index value is multiplied by the relative weight of the index of the standard layer to which it belonged, and then it is multiplied by the combined weight of the index value of each risk factor. The results are shown in Table15.Table 15
Calculation results of integrated weight values of indicators in the indicator layer.
Standard layerIndicator layerCodeRisk factorsRelative weight valueCodeRisk factorsRelative weight valueCombined weight valueA1Organizational management risk0.1398A11Risk of insufficient organizational execution0.16380.0229A12Risk of inadequate system operation capability of personnel0.14880.0208A13Improper system operation and maintenance risks0.32720.0458A14Risk of inadequate organization of personnel0.36190.0606A2The cost of risk0.1569A21Lack of awareness of cost control risks0.16220.0254A22Hardware loss exceeds expected risk0.42440.0665A23Equipment and facilities price rise risk0.27060.0425A24Unreasonable risk of capital allocation0.14560.0229A3System operation risk0.2114A31System design failure risk0.09920.0188A32The system function cannot meet the risk of hospital demand0.30560.0656A33Network hardware failure risks0.20180.0428A34Core network system operation risks0.16820.0366A35System operation instability risk0.08820.0465A36Hardware network security risks0.16020.0339A4Schedule risk0.0862A41Hospital application needs to change the risk0.14750.0138A42Risk of uncorrected progress0.19480.0172A43Risk of delivery delay0.23050.0299A44Risk of schedule delay due to rework0.42960.0375A5Technical risk0.1398A51Technical disclosure execution risk is not in place0.16590.0526A52Failure risk of new technology application0.49560.0688A53Risk of non-standard operation by technical personnel0.31090.0452A6Security risks0.2664A61Risk of system security failure0.15450.0978A62Database backup risks0.08960.0236A63Equipment room security risks0.36450.0978A64User rights are incorrectly configured0.25480.0748A65Network security management software upgrade risk0.14580.0452Next, a fuzzy evaluation matrix was established.(i)
Establishment of weight matrix: after calculating the relative weight values of risk factor indicators in each judgment matrix in an information system project in R hospital by using hierarchical analysis, the base matrix required for fuzzy evaluation is constructed based on the calculated relative weight values. It mainly adopts the weight scores of each risk element to compile the weight matrix. The weight matrix of the criterion layer A-A6 can be expressed as(5)A=0.13980.15690.21140.08620.13980.2664,A1=0.13980.14880.32720.3619,A2=0.16220.42440.27060.1456,A3=0.09920.30560.20180.16820.08820.1602,A4=0.14750.19480.23050.4296,A5=0.16590.49560.3109,A6=0.15450.08960.36450.25480.1458.(ii)
Construct the affiliation matrix: in this study, expert scoring was used to obtain the base values for constructing the affiliation matrix of each tier structure. Thirty experts were invited to participate in the risk level evaluation of the 26 risk factors in the index level. In terms of evaluation criteria, the authors referred to the common practice of other scholars in China and set five risk levels in this study with corresponding scores, namely, “very high (9 points),” “high (7 points),” “average (5 points),” “low (3 points),” and “very low (1 point)” [19]. The results of the statistical analysis of the risk level of each risk element indicator and the total number of scoring scholars by using the scores assigned by the relevant scholars are shown in Table 16.Table 16
Summary of the number of experts scoring converted into affiliation values for project risk factor indicators.
Risk factor indicatorsRisk levelVery highHighAverageLowVery lowA11 Risk of insufficient organizational execution0.03340.10020.36680.40020.2000A12 Risk of inadequate system operation capability of personnel0.04440.06680.54440.40000.0886A13 Improper system operation and maintenance risks0.08860.18870.34420.06680.0668A14 Risk of inadequate organization of personnel0.06680.30000.24440.50000.2000A21 Lack of awareness of cost control risks0.04440.20000.08870.60000.2000A22 Hardware loss exceeds expected risk0.20000.40000.18880.28860.1886A23 Equipment and facilities price rise risk0.06680.17780.40000.40000.0887A24 Unreasonable risk of capital allocation0.04440.20000.28860.60000.2000A31 System design failure risk0.04440.08860.40000.54440.0886A32 The system function cannot meet the risk of hospital demand0.20000.18860.44440.40000.2000A33 Network hardware failure risks0.08860.18860.28860.44420.1886A34 Core network system operation risks0.08860.14440.38860.40000.1444A35 System operation instability risk0.04430.08870.38820.48880.0889A36 Hardware network security risks0.07790.14440.04440.04440.1445A41 Hospital application needs to change the risk0.04440.04450.28860.48820.4000A42 Risk of uncorrected progress0.04450.08820.50000.45560.0882A43 Risk of delivery delay0.04460.08820.46250.37820.0778A44 Risk of schedule delay due to rework0.08820.14450.40000.38520.1452A51 Technical disclosure execution risk is not in place0.04450.20000.44560.45250.2000A52 Failure risk of new technology application0.20000.40000.30000.24560.1882A53 Risk of non-standard operation by technical personnel0.08850.17850.27850.44520.1852A61 Risk of system security failure0.06820.17850.40000.44440.1444A62 Database backup risks0.04450.20000.48820.50000.2000A63 Equipment room security risks0.14440.40000.18850.28850.4444A64 User rights are incorrectly configured0.04450.30000.40000.50000.0882A65 Network security management software upgrade risk0.08850.14520.28520.14520.2526Based on the affiliation values of each risk factor indicator calculated in the above content, the affiliation matrices of each of the six criterion layers are given as(6)IA1=0.03340.10020.36680.40020.20000.04440.06680.54440.40000.08860.08860.18870.34420.06680.06680.06680.30000.24440.50000.2000,IA2=0.04440.20000.08870.60000.20000.20000.40000.18880.28860.18860.06680.17780.40000.40000.08870.04440.20000.28860.60000.2000,IA3=0.04440.08860.40000.54440.08860.20000.18860.44440.40000.20000.08860.18860.28860.44420.18860.08860.14440.38860.40000.14440.04430.08870.38820.48880.08890.07790.14440.04440.04440.1445,IA4=0.04440.04450.28860.48820.40000.04450.08820.50000.45560.08820.04460.08820.46250.37820.07780.08820.14450.40000.38520.1452,IA5=0.04450.20000.44560.45250.20000.20000.40000.30000.24560.18820.08850.17850.27850.44520.1852,IA6=0.06820.17850.40000.44440.14440.04450.20000.48820.50000.20000.14440.40000.18850.28850.44440.04450.30000.40000.50000.08820.08850.14520.28520.14520.2526.Next, in the fuzzy comprehensive evaluation, the formula for conducting the first-level fuzzy comprehensive evaluation can be expressed as(7)Wi=Hi×Ii.Based on previous studies, this study obtained the weight matrix and affiliation matrix corresponding to each indicator layer; then the product operation between the matrices could be performed according to (7), which could be obtained as(8)WA1=A1×IA1=0.13980.14880.32720.3619×0.03340.10020.36680.40020.20000.04440.06680.54440.40000.08860.08860.18870.34420.06680.06680.06680.30000.24440.50000.2000=0.05640.15320.33260.38420.0845,WA2=A2×IA2=0.16220.42440.27060.1456×0.04440.20000.08870.60000.20000.20000.40000.18880.28860.18860.06680.17780.40000.40000.08870.04440.20000.28860.60000.2000=0.07080.20280.24440.34720.1465,WA3=A3×IA3=0.09920.30560.20180.16820.08820.1602×0.04440.08860.40000.54440.08860.20000.18860.44440.40000.20000.08860.18860.28860.44420.18860.08860.14440.38860.40000.14440.04430.08870.38820.48880.08890.07790.14440.04440.04440.1445=0.07160.13920.32520.34520.1192,WA4=A4×IA4=0.14750.19480.23050.4296×0.04440.04450.28860.48820.40000.04450.08820.50000.45560.08820.04460.08820.46250.37820.07780.08820.14450.40000.38520.1452=0.04780.09050.3520.39480.1152,WA5=A5×IA5=0.16590.49560.3109×0.04450.20000.44560.45250.20000.20000.40000.30000.24560.18820.08850.17850.27850.44520.1852=0.07860.21950.25720.2856,WA6=A6×IA6=0.15450.08960.36450.25480.1458×0.06820.17850.40000.44440.14440.04450.20000.48820.50000.20000.14440.40000.18850.28850.44440.04450.30000.40000.50000.08820.08850.14520.28520.14520.2526=0.15460.08780.25680.30360.1548.After summarizing the results of the above calculations into a matrix, we can obtain(9)WA=WA1WA2WA3WA4WA5WA6=0.05640.15320.33260.38420.08450.07080.20280.24440.34720.14650.07160.13920.32520.34560.11920.04780.09050.35260.39480.11520.07860.21950.25720.15480.28560.15460.08780.25680.30360.1548.Next, the second-level fuzzy integrated evaluation is performed. According to the primary evaluation matrix obtained from the primary fuzzy operation, followed immediately by the secondary fuzzy operation, the calculation formula could be expressed as(10)N=A×WA=0.13980.15690.21140.08620.13980.2664×0.05640.15320.33260.38420.08450.07080.20280.24440.34720.14650.07160.13920.32520.34560.11920.04780.09050.35260.39480.11520.07860.21950.25720.15480.28560.15460.08780.25680.30360.1548=0.08000.18880.28460.36820.1128.


### 4.3. Analysis of the Results of the Comprehensive Evaluation of Project Risks

Based on the fuzzy comprehensive evaluation of the project risk of the information system, the final grade was calculated based on the criteria for determining the project risk level. The specific results are shown in Table17.Table 17
Evaluating criteria of project risk level.
Risk levelVery highHighAverageLowVery lowK1K2K3K4K5The value interval corresponding to the judgment value10,88,68,64,22,0Judgment value97531Based on the project risk level determination values, a judgment matrix was established, which could be expressed as(11)K=K1K2K3K4K5=97531.Next, we calculated the results of the determination level of project risk according to (12), which could be expressed as(12)L=M×K=0.08000.18880.28460.36820.1128∗97531=4.4854.According to the calculatedL value, it can be seen that this value is within [4, 6]. Combined with the description of the judging criteria of risk level in Tables 5–15, it could be judged that the risk level of the R hospital information system project was “average.”


## 4.1. Flow of Evaluation of Project Risks

In this study, the Delphi method was used to identify a total of 26 risk factors in six categories in the IT system project in R hospital, which achieved the first process of this risk management. The next step was to quantitatively assess the project risks by using the fuzzy comprehensive evaluation method to obtain the project risk level, identify important risk factors, and develop control measures. In this regard, it was conducive to guiding the project manager to effectively control the occurrence of various risks when participating in future project management.


## 4.2. Steps of Project Risk Evaluation

First, the evaluation index system was constructed according to the 26 risk factors of the information system and used as evaluation indexes. The six risks described referred to the standard level index, while the overall risk of the project was the target level index. The framework structure and letter representation are shown in Table4.Table 4
Hierarchical structure of risk evaluation index system of information system project in R hospital.
The target layerRule layerIndex layerCode nameThe nameof the riskCode nameThe nameof the riskCode nameThe name of the riskAR hospitalinformationsystem project riskA1Organizationalmanagement riskA11Risk of insufficient organizational executionA12Risk of inadequate system operation capability of personnelA13Improper system operation and maintenance risksA14Risk of inadequate organization of personnelA2The cost of riskA21Lack of awareness of cost control risksA22Hardware loss exceeds expected riskA23Equipment and facilities price rise riskA24Unreasonable risk of capital allocationA3Systemoperation riskA31System design failure riskA32The system function cannot meet the risk of hospital demandA33Network hardware failure risksA34Core network system operation risksA35System operation instability riskA36Hardware network security risksA4Schedule riskA41Hospital application needs to change the riskA42Risk of uncorrected progressA43Risk of delivery delayA44Risk of schedule delay due to reworkA5Technical riskA51Technical disclosure execution risk is not in placeA52Failure risk of new technology applicationA53Risk of non-standard operation by technical personnelA6Security risksA61Risk of system security failureA62Database backup risksA63Equipment room security risksA64User rights are incorrectly configuredA65Network security management software upgrade risk(1)A2=A21×A24;A3=A31×A36;A4=A41×A44;A5=A51×A53;A6=A61×A65.Based on this hierarchical model, a criterion level judgment matrix was established with “A1 organizational management risk,” “A2 cost risk,” “A3 system risk,” “A4 progress risk,” “A5 technology risk,” and “A6 security risk” as indicators, which can be expressed as follows:A=A1×A6. In this way, the judgment matrix of the indicator layer is constructed, respectively, and can be expressed as(2)A1=A11×A14;A2=A21×A24;A3=A31×A36;A4=A41×A44;A5=A51×A53;A6=A61×A65.Secondly, the judgment matrix is constructed. In constructing the judgment matrix at the criterion level and the judgment matrix at the indicator level, the basic data of each indicator required is determined with the help of expert scoring [17]. The importance of all risk factors in different judgment matrices is evaluated according to Saaty’s nine importance levels and the way they are assigned set in Table 5.Table 5
Comparison table of relative importance scale and quantity ratio.
The factorI over factor JThe volume ratioNoteAs important1Otherwise, the reciprocal of the ratio of each quantity is takenA little important3More important5Highly important7Extremely important9The intermediate value of two adjacent judgments2, 4, 6, 8In terms of scoring expert selection, 30 experts involved in the project risk factor prediction of the information technology system were still invited to compare the relative importance of all indicators in the judgment matrix of one criterion layer and six indicator layers with the ratios being assigned; then the average value is calculated to obtain the composition of the corresponding judgment matrix. The judgment matrix A of the criterion layer is expressed as shown in Table6.Table 6
Judgment matrix A in criterion level.
AA1Organizationalmanagement riskA2The costof riskA3Systemoperation RiskA4Schedule riskA5Technical riskA6Security risksA1Organizational management risk11/41/5311/3A2The cost of risk2121/41/31/4A3System operation Risk41/31431/5A4Schedule risk1/221/321/31/3A5Technical risk111/41/321/3A6Security risks235232The judgment matrix A1 in the indicator level can be expressed as follows (Table7).Table 7
Judgment matrix A1 in the indicator level.
A1Organizational management riskA11Risk of insufficient organizational executionA12Risk of inadequate system operation capability of personnelA13Improper system operation and maintenance risksA14Risk of inadequate organization of personnelA11Risk of insufficient organizational execution141/51/4A12Risk of inadequate system operation capability of personnel1/311/21/4A13Improper system operation and maintenance risks6211/3A14Risk of inadequate organization of personnel5341The judgment matrix A2 in the indicator level can be expressed as follows (Table8).Table 8
Judgment matrix A2 in the indicator level.
A2The cost of riskA21Lack of awareness of cost control risksA22Hardware loss exceeds expected riskA23Equipment and facilities price rise riskA24Unreasonable risk of capital allocationA21Lack of awareness of cost control risks11/41/21/7A22Hardware loss exceeds expected risk4134A23Equipment and facilities price rise risk21/312A24Unreasonable risk of capital allocation71/41/21Similarly, the judgment matrix A3 in the indicator level can be expressed as shown in Table9.Table 9
Judgment matrix A3 in the indicator level.
A3System operation riskA31System design failure riskA32The system function cannot meet the risk of hospital demandA33Network hardware failure risksA34Core network system operation risksA35System operation instability riskA36Hardware network security risksA31System design failure risk11/31/41/51/51/4A32The system function cannot meet the risk of hospital demand312343A33Network hardware failure risks41/211/235A34Core network system operation risks31/32131/2A35System operation instability risk51/41/31/311/4A36Hardware network security risks41/31/5241The judgment matrix A4 in the indicator level can be represented as in Table10.Table 10
Judgment matrix A4 in the indicator level.
A4Schedule riskA41Hospital application needs to change the riskA42Risk of uncorrected progressA43Risk of delivery delayA44Risk of schedule delay due to reworkA41Hospital application needs to change the risk11/21/31/3A42Risk of uncorrected progress2161/3A43Risk of delivery delay31/611/4A44Risk of schedule delay due to rework3341Judgment matrix A5 in the indicator level is given in Table11.Table 11
Judgment matrix A5 in the indicator level.
A5Technical riskA51Technical disclosure execution risk is not in placeA52Failure risk of new technology applicationA53Risk of non-standard operation by technical personnelA51Technical disclosure execution risk is not in place11/41/3A52Failure risk of new technology application216A53Risk of non-standard operation by technical personnel31/61Judgment matrix A6 in the indicator level is expressed as follows (Table12).Table 12
Judgment matrix A6 in the indicator level.
A6Security risksA61Risk of system security failureA62Database Backup RisksA63Equipment Room Security RisksA64User rights are incorrectly configuredA65Network security management software upgrade riskA61Risk of system security failure121/21/21A62Database Backup Risks1/211/31/31/2A63Equipment Room Security Risks1/211/31/31/2A64User rights are incorrectly configured23123A65Network security management software upgrade risk121/31/21According to the main statistical methods and detailed steps of the weight values in the hierarchical analysis method, the scores of each index in the judgment matrix of the criteria and index layers are recorded in a table; moreover, the weights are calculated using the formula function. To verify the consistency of the indexes by using the hierarchical analysis method, it was necessary to calculate the CI which can be expressed as(3)CI=λmaxn−1.Usually, the average consistency index RI is obtained after the calculation and then the obtained index is substituted in (4) to obtain CR:(4)CR=CIRI.WhenCR<0.1, it implied a high level of consistency for the judgment matrix.The standard value of the average random consistency index RI is used to guarantee the consistency of the validation index, which is shown in Table13.Table 13
Standard values of average random consistency index RI.
Matrix order12345678910RI000.580.911.141.261.351.421.461.52In this study, the indicator weights of various risk elements in the judgment matrix of the criterion layer are obtained, as well as the six indicator layers through arithmetic operations while verifying their consistency. The conclusions are listed in Table14.Table 14
Weight scores of each judgment matrix and conclusions of consistency test.
Target layerWeight valueStandard layerRelative weight valueConsistency verificationIndicator layerRelative weight valueConsistency verificationA1A10.1398λmaxCI=0.064RI=1.26CR=0.06<0.1A110.1638λmaxCI=0.007RI=0.91CR=0.008<0.1A120.1488A130.3272A140.3619A20.1569A210.1622λmaxCI=0.018RI=0.92CR=0.019<0.1A220.4244A230.2706A240.1456A30.2114A310.0992λmaxCI=0.022RI=1.25CR=0.018<0.1A320.3056A330.2018A340.1682A350.0882A360.1602A40.0862A410.1475λmaxCI=0.018RI=0.91CR=0.019<0.1A420.1948A430.2305A440.4296A50.1398A510.1659λmaxCI=0.026RI=0.59CR=0.043<0.1A520.4956A530.3109A60.2664A610.1545λmaxCI=0.04RI=1.14CR=0.018<0.1A620.0896A630.3645A640.2548A650.1458After calculating the relative weights of each index value in each judgment matrix, it was feasible to further calculate the comprehensive weight value of each risk factor index, which was the comprehensive importance of each risk factor index in the index layer for the “information system project risk in R hospital.” When calculating the relative weight of the index, the index value is multiplied by calculating the relative weight of the index, the index value is multiplied by the relative weight of the index of the standard layer to which it belonged, and then it is multiplied by the combined weight of the index value of each risk factor. The results are shown in Table15.Table 15
Calculation results of integrated weight values of indicators in the indicator layer.
Standard layerIndicator layerCodeRisk factorsRelative weight valueCodeRisk factorsRelative weight valueCombined weight valueA1Organizational management risk0.1398A11Risk of insufficient organizational execution0.16380.0229A12Risk of inadequate system operation capability of personnel0.14880.0208A13Improper system operation and maintenance risks0.32720.0458A14Risk of inadequate organization of personnel0.36190.0606A2The cost of risk0.1569A21Lack of awareness of cost control risks0.16220.0254A22Hardware loss exceeds expected risk0.42440.0665A23Equipment and facilities price rise risk0.27060.0425A24Unreasonable risk of capital allocation0.14560.0229A3System operation risk0.2114A31System design failure risk0.09920.0188A32The system function cannot meet the risk of hospital demand0.30560.0656A33Network hardware failure risks0.20180.0428A34Core network system operation risks0.16820.0366A35System operation instability risk0.08820.0465A36Hardware network security risks0.16020.0339A4Schedule risk0.0862A41Hospital application needs to change the risk0.14750.0138A42Risk of uncorrected progress0.19480.0172A43Risk of delivery delay0.23050.0299A44Risk of schedule delay due to rework0.42960.0375A5Technical risk0.1398A51Technical disclosure execution risk is not in place0.16590.0526A52Failure risk of new technology application0.49560.0688A53Risk of non-standard operation by technical personnel0.31090.0452A6Security risks0.2664A61Risk of system security failure0.15450.0978A62Database backup risks0.08960.0236A63Equipment room security risks0.36450.0978A64User rights are incorrectly configured0.25480.0748A65Network security management software upgrade risk0.14580.0452Next, a fuzzy evaluation matrix was established.(i)
Establishment of weight matrix: after calculating the relative weight values of risk factor indicators in each judgment matrix in an information system project in R hospital by using hierarchical analysis, the base matrix required for fuzzy evaluation is constructed based on the calculated relative weight values. It mainly adopts the weight scores of each risk element to compile the weight matrix. The weight matrix of the criterion layer A-A6 can be expressed as(5)A=0.13980.15690.21140.08620.13980.2664,A1=0.13980.14880.32720.3619,A2=0.16220.42440.27060.1456,A3=0.09920.30560.20180.16820.08820.1602,A4=0.14750.19480.23050.4296,A5=0.16590.49560.3109,A6=0.15450.08960.36450.25480.1458.(ii)
Construct the affiliation matrix: in this study, expert scoring was used to obtain the base values for constructing the affiliation matrix of each tier structure. Thirty experts were invited to participate in the risk level evaluation of the 26 risk factors in the index level. In terms of evaluation criteria, the authors referred to the common practice of other scholars in China and set five risk levels in this study with corresponding scores, namely, “very high (9 points),” “high (7 points),” “average (5 points),” “low (3 points),” and “very low (1 point)” [19]. The results of the statistical analysis of the risk level of each risk element indicator and the total number of scoring scholars by using the scores assigned by the relevant scholars are shown in Table 16.Table 16
Summary of the number of experts scoring converted into affiliation values for project risk factor indicators.
Risk factor indicatorsRisk levelVery highHighAverageLowVery lowA11 Risk of insufficient organizational execution0.03340.10020.36680.40020.2000A12 Risk of inadequate system operation capability of personnel0.04440.06680.54440.40000.0886A13 Improper system operation and maintenance risks0.08860.18870.34420.06680.0668A14 Risk of inadequate organization of personnel0.06680.30000.24440.50000.2000A21 Lack of awareness of cost control risks0.04440.20000.08870.60000.2000A22 Hardware loss exceeds expected risk0.20000.40000.18880.28860.1886A23 Equipment and facilities price rise risk0.06680.17780.40000.40000.0887A24 Unreasonable risk of capital allocation0.04440.20000.28860.60000.2000A31 System design failure risk0.04440.08860.40000.54440.0886A32 The system function cannot meet the risk of hospital demand0.20000.18860.44440.40000.2000A33 Network hardware failure risks0.08860.18860.28860.44420.1886A34 Core network system operation risks0.08860.14440.38860.40000.1444A35 System operation instability risk0.04430.08870.38820.48880.0889A36 Hardware network security risks0.07790.14440.04440.04440.1445A41 Hospital application needs to change the risk0.04440.04450.28860.48820.4000A42 Risk of uncorrected progress0.04450.08820.50000.45560.0882A43 Risk of delivery delay0.04460.08820.46250.37820.0778A44 Risk of schedule delay due to rework0.08820.14450.40000.38520.1452A51 Technical disclosure execution risk is not in place0.04450.20000.44560.45250.2000A52 Failure risk of new technology application0.20000.40000.30000.24560.1882A53 Risk of non-standard operation by technical personnel0.08850.17850.27850.44520.1852A61 Risk of system security failure0.06820.17850.40000.44440.1444A62 Database backup risks0.04450.20000.48820.50000.2000A63 Equipment room security risks0.14440.40000.18850.28850.4444A64 User rights are incorrectly configured0.04450.30000.40000.50000.0882A65 Network security management software upgrade risk0.08850.14520.28520.14520.2526Based on the affiliation values of each risk factor indicator calculated in the above content, the affiliation matrices of each of the six criterion layers are given as(6)IA1=0.03340.10020.36680.40020.20000.04440.06680.54440.40000.08860.08860.18870.34420.06680.06680.06680.30000.24440.50000.2000,IA2=0.04440.20000.08870.60000.20000.20000.40000.18880.28860.18860.06680.17780.40000.40000.08870.04440.20000.28860.60000.2000,IA3=0.04440.08860.40000.54440.08860.20000.18860.44440.40000.20000.08860.18860.28860.44420.18860.08860.14440.38860.40000.14440.04430.08870.38820.48880.08890.07790.14440.04440.04440.1445,IA4=0.04440.04450.28860.48820.40000.04450.08820.50000.45560.08820.04460.08820.46250.37820.07780.08820.14450.40000.38520.1452,IA5=0.04450.20000.44560.45250.20000.20000.40000.30000.24560.18820.08850.17850.27850.44520.1852,IA6=0.06820.17850.40000.44440.14440.04450.20000.48820.50000.20000.14440.40000.18850.28850.44440.04450.30000.40000.50000.08820.08850.14520.28520.14520.2526.Next, in the fuzzy comprehensive evaluation, the formula for conducting the first-level fuzzy comprehensive evaluation can be expressed as(7)Wi=Hi×Ii.Based on previous studies, this study obtained the weight matrix and affiliation matrix corresponding to each indicator layer; then the product operation between the matrices could be performed according to (7), which could be obtained as(8)WA1=A1×IA1=0.13980.14880.32720.3619×0.03340.10020.36680.40020.20000.04440.06680.54440.40000.08860.08860.18870.34420.06680.06680.06680.30000.24440.50000.2000=0.05640.15320.33260.38420.0845,WA2=A2×IA2=0.16220.42440.27060.1456×0.04440.20000.08870.60000.20000.20000.40000.18880.28860.18860.06680.17780.40000.40000.08870.04440.20000.28860.60000.2000=0.07080.20280.24440.34720.1465,WA3=A3×IA3=0.09920.30560.20180.16820.08820.1602×0.04440.08860.40000.54440.08860.20000.18860.44440.40000.20000.08860.18860.28860.44420.18860.08860.14440.38860.40000.14440.04430.08870.38820.48880.08890.07790.14440.04440.04440.1445=0.07160.13920.32520.34520.1192,WA4=A4×IA4=0.14750.19480.23050.4296×0.04440.04450.28860.48820.40000.04450.08820.50000.45560.08820.04460.08820.46250.37820.07780.08820.14450.40000.38520.1452=0.04780.09050.3520.39480.1152,WA5=A5×IA5=0.16590.49560.3109×0.04450.20000.44560.45250.20000.20000.40000.30000.24560.18820.08850.17850.27850.44520.1852=0.07860.21950.25720.2856,WA6=A6×IA6=0.15450.08960.36450.25480.1458×0.06820.17850.40000.44440.14440.04450.20000.48820.50000.20000.14440.40000.18850.28850.44440.04450.30000.40000.50000.08820.08850.14520.28520.14520.2526=0.15460.08780.25680.30360.1548.After summarizing the results of the above calculations into a matrix, we can obtain(9)WA=WA1WA2WA3WA4WA5WA6=0.05640.15320.33260.38420.08450.07080.20280.24440.34720.14650.07160.13920.32520.34560.11920.04780.09050.35260.39480.11520.07860.21950.25720.15480.28560.15460.08780.25680.30360.1548.Next, the second-level fuzzy integrated evaluation is performed. According to the primary evaluation matrix obtained from the primary fuzzy operation, followed immediately by the secondary fuzzy operation, the calculation formula could be expressed as(10)N=A×WA=0.13980.15690.21140.08620.13980.2664×0.05640.15320.33260.38420.08450.07080.20280.24440.34720.14650.07160.13920.32520.34560.11920.04780.09050.35260.39480.11520.07860.21950.25720.15480.28560.15460.08780.25680.30360.1548=0.08000.18880.28460.36820.1128.


## 4.3. Analysis of the Results of the Comprehensive Evaluation of Project Risks

Based on the fuzzy comprehensive evaluation of the project risk of the information system, the final grade was calculated based on the criteria for determining the project risk level. The specific results are shown in Table17.Table 17
Evaluating criteria of project risk level.
Risk levelVery highHighAverageLowVery lowK1K2K3K4K5The value interval corresponding to the judgment value10,88,68,64,22,0Judgment value97531Based on the project risk level determination values, a judgment matrix was established, which could be expressed as(11)K=K1K2K3K4K5=97531.Next, we calculated the results of the determination level of project risk according to (12), which could be expressed as(12)L=M×K=0.08000.18880.28460.36820.1128∗97531=4.4854.According to the calculatedL value, it can be seen that this value is within [4, 6]. Combined with the description of the judging criteria of risk level in Tables 5–15, it could be judged that the risk level of the R hospital information system project was “average.”


## 5. Strategy for Tackling Risks in Projects Related to Information System

### 5.1. Organizational Management Risks

The organizational management risks can be categorized into the following types:(i)
Risk of insufficient organizational execution: the R hospital must improve the efficiency of team communication and cooperation in the implementation of information technology projects. Imperfect information-sharing mechanisms, unclear division of labor, and insufficient execution are effectively addressed as the project advances, which may lead to an extension of project tasks and affect project delivery. At the same time, the relatively long period and wide scope of the implementation of information technology projects in the institution lead to more risks in the overall progress. For this risk, several measures can be taken including the reasonable application of engineering management tools, the establishment of a perfect engineering communication and meeting mechanism, creating a good atmosphere of teamwork, and promoting the daily communication of members.(ii)
Risk of insufficient ability of personnel for system operation: regularly organize specialized training related to the application of information technology systems, as well as invite key personnel skilled in the application of technology to explain the specific operation and maintenance of the system to ensure that personnel involved in the R hospital information system can master the specific system operation process. Similarly, regularly updating system operation knowledge and timely delivery of training to individual staff can ensure the smooth application of the R hospital information system.(iii)
Risk of non-standardized system operation and maintenance: at the level of organizational management risk, there is a relatively higher weighting ratio, which requires project managers to focus on dealing with it. According to the actual information technology mechanism operation status of the hospital and the system and relevant regulations implemented by the relevant medical institutions, a scientific and reasonable information technology management mechanism is established, such as “information center regulations,” “computer center management specifications,” and so on, which aims at improving the efficiency and quality of the operation of the information technology management mechanism.(iv)
Risk of inappropriate personnel organization: hierarchical analysis shows that its weight value at the level of organizational management risk is the highest. The institute must pay great attention to the rational use of human resources in the implementation of information management projects, improve sufficient human resources to invest in the construction of the project, effectively improve the professional quality of employees, as well as the technical capabilities, establish a scientific structure system of technical personnel, and provide effective human resources guarantee for the project construction.


### 5.2. The Cost Risk

The personnel of each institution involved in the implementation of the R hospital information technology project should consciously form a sense of material conservation, highlight the loss control, and control the cost of materials from the source. Every manager is required to strengthen the construction management awareness of the project, as far as possible to prevent unnecessary waste in the construction process workers. In addition, for the entire R hospital information technology project in different types of material waste problems, it is necessary to fully absorb past project material loss and experience in saving cost, develop and implement saving measures and incentives, make a reasonable configuration of construction personnel, and enrich the experience of different personnel. Moreover, it is essential to establish the cost accounting system for information technology projects in R hospital, cultivate the awareness of cost accounting, give full play to the accounting role, and mobilize the initiative so that the project manager is fully aware of the importance and significance of project cost management in the project.


### 5.3. Systemic Risk

Since the R hospital information technology system has been built before the adequate requirements testing and application analysis, the system design cannot meet the actual needs for realizing the smallest probability. Project managers can pay proper attention. Specifically, the main framework of the system must be reasonably constructed and its performance must be tested to ensure that the system framework can meet the performance index requirements as the basis for the next work. In addition, before implementing the information system, the technology company should conduct a field mapping study of R hospital to understand the problems that exist in the process of implementing the information system in the hospital and fully collect the opinions and suggestions of various departments and managers to scientifically optimize the information system and meet the demands of all parties to the maximum extent. Moreover, different risks must also be taken into consideration such as the risk of system function, risk of network hardware equipment failure, risk of core network system operation, and risk of unstable system operation.


### 5.4. Schedule Risks

In the process of implementing the plan, the most critical hindering element is the change of requirements, such as a sudden change in engineering functions, thus generating a series of new workloads or a large number of workloads due to imperfect design solutions, which largely affects the improvement of the efficiency of the project progress and leads to possible delayed delivery or even direct stoppage of the project. For such problems, we must understand the design scheme and the purpose of the owner in-depth and practically, communicate with the design department reasonably and actively, and adopt an active offensive approach to improve the ability of prior control, which effectively prevents similar problems from occurring.


### 5.5. Technological Risk

Project managers are required to take certain measures to deal with the risk. It is necessary to strengthen the technical handover management of all aspects of this project and the technical staff should be responsible for implementing technical handover so that workers can accurately understand the content of the handover and effectively understand the core technical elements and the practical operation process. Based on the technical handover, the plan should be implemented effectively and the site technology should be done well to avoid the appearance of quality problems. Moreover, the professional and technical personnel of each stage of work should be reasonably configured. For the organization program of information technology project in R hospital, relevant personnel should do a good job in the technical aspects of the relevant support work. A reasonable allocation of a certain number of professional and technical personnel who do a good job of technical delivery, guidance, supervision, and other work is an important measure to effectively implement the construction organization plan and various technical documents and prevent quality problems. The technical management system headed by the chief technical engineer can be established with sufficient and strong technical personnel strictly by the construction period, quality, cost and other objectives, and organization and planning of the construction process technical control program. In particular, the grassroots technical personnel should take up the heavy responsibility of technical guidance to members of the construction team; then it is necessary to allocate the corresponding number of senior technical personnel who will make on-site supervision and instruction in terms of the effectiveness of completion of the various construction tasks, the content of technical instructions, and technical provision. Finally, they will be able to timely make corrections to some unserious and inattentive behavior.


### 5.6. Security Risks

In the implementation of each subsystem, it is necessary to fully communicate with the hospital application requirements, consider the security of the system and data, and develop a corresponding fallback strategy. If there is an error in the operation that cannot be changed, how to avoid the risk and making the corresponding contingency plan are crucial. After the system is implemented, the data must be backed up in advance before operating the database and a simulation test should be implemented first to ensure that no mistakes are made. Reasonable backup of a database is beneficial to improve the security of data. Therefore, diverse data backup methods must be designed: relevant personnel need to consider whether medical systems such as HIS, LIS, PACS, etc. have dual hot standby function and can realize backup function on the server; other systems can backup data centrally on disk arrays; off-site backup servers can dynamically backup data in the host room, on which basis the security of data preservation can be improved.


## 5.1. Organizational Management Risks

The organizational management risks can be categorized into the following types:(i)
Risk of insufficient organizational execution: the R hospital must improve the efficiency of team communication and cooperation in the implementation of information technology projects. Imperfect information-sharing mechanisms, unclear division of labor, and insufficient execution are effectively addressed as the project advances, which may lead to an extension of project tasks and affect project delivery. At the same time, the relatively long period and wide scope of the implementation of information technology projects in the institution lead to more risks in the overall progress. For this risk, several measures can be taken including the reasonable application of engineering management tools, the establishment of a perfect engineering communication and meeting mechanism, creating a good atmosphere of teamwork, and promoting the daily communication of members.(ii)
Risk of insufficient ability of personnel for system operation: regularly organize specialized training related to the application of information technology systems, as well as invite key personnel skilled in the application of technology to explain the specific operation and maintenance of the system to ensure that personnel involved in the R hospital information system can master the specific system operation process. Similarly, regularly updating system operation knowledge and timely delivery of training to individual staff can ensure the smooth application of the R hospital information system.(iii)
Risk of non-standardized system operation and maintenance: at the level of organizational management risk, there is a relatively higher weighting ratio, which requires project managers to focus on dealing with it. According to the actual information technology mechanism operation status of the hospital and the system and relevant regulations implemented by the relevant medical institutions, a scientific and reasonable information technology management mechanism is established, such as “information center regulations,” “computer center management specifications,” and so on, which aims at improving the efficiency and quality of the operation of the information technology management mechanism.(iv)
Risk of inappropriate personnel organization: hierarchical analysis shows that its weight value at the level of organizational management risk is the highest. The institute must pay great attention to the rational use of human resources in the implementation of information management projects, improve sufficient human resources to invest in the construction of the project, effectively improve the professional quality of employees, as well as the technical capabilities, establish a scientific structure system of technical personnel, and provide effective human resources guarantee for the project construction.


## 5.2. The Cost Risk

The personnel of each institution involved in the implementation of the R hospital information technology project should consciously form a sense of material conservation, highlight the loss control, and control the cost of materials from the source. Every manager is required to strengthen the construction management awareness of the project, as far as possible to prevent unnecessary waste in the construction process workers. In addition, for the entire R hospital information technology project in different types of material waste problems, it is necessary to fully absorb past project material loss and experience in saving cost, develop and implement saving measures and incentives, make a reasonable configuration of construction personnel, and enrich the experience of different personnel. Moreover, it is essential to establish the cost accounting system for information technology projects in R hospital, cultivate the awareness of cost accounting, give full play to the accounting role, and mobilize the initiative so that the project manager is fully aware of the importance and significance of project cost management in the project.


## 5.3. Systemic Risk

Since the R hospital information technology system has been built before the adequate requirements testing and application analysis, the system design cannot meet the actual needs for realizing the smallest probability. Project managers can pay proper attention. Specifically, the main framework of the system must be reasonably constructed and its performance must be tested to ensure that the system framework can meet the performance index requirements as the basis for the next work. In addition, before implementing the information system, the technology company should conduct a field mapping study of R hospital to understand the problems that exist in the process of implementing the information system in the hospital and fully collect the opinions and suggestions of various departments and managers to scientifically optimize the information system and meet the demands of all parties to the maximum extent. Moreover, different risks must also be taken into consideration such as the risk of system function, risk of network hardware equipment failure, risk of core network system operation, and risk of unstable system operation.


## 5.4. Schedule Risks

In the process of implementing the plan, the most critical hindering element is the change of requirements, such as a sudden change in engineering functions, thus generating a series of new workloads or a large number of workloads due to imperfect design solutions, which largely affects the improvement of the efficiency of the project progress and leads to possible delayed delivery or even direct stoppage of the project. For such problems, we must understand the design scheme and the purpose of the owner in-depth and practically, communicate with the design department reasonably and actively, and adopt an active offensive approach to improve the ability of prior control, which effectively prevents similar problems from occurring.


## 5.5. Technological Risk

Project managers are required to take certain measures to deal with the risk. It is necessary to strengthen the technical handover management of all aspects of this project and the technical staff should be responsible for implementing technical handover so that workers can accurately understand the content of the handover and effectively understand the core technical elements and the practical operation process. Based on the technical handover, the plan should be implemented effectively and the site technology should be done well to avoid the appearance of quality problems. Moreover, the professional and technical personnel of each stage of work should be reasonably configured. For the organization program of information technology project in R hospital, relevant personnel should do a good job in the technical aspects of the relevant support work. A reasonable allocation of a certain number of professional and technical personnel who do a good job of technical delivery, guidance, supervision, and other work is an important measure to effectively implement the construction organization plan and various technical documents and prevent quality problems. The technical management system headed by the chief technical engineer can be established with sufficient and strong technical personnel strictly by the construction period, quality, cost and other objectives, and organization and planning of the construction process technical control program. In particular, the grassroots technical personnel should take up the heavy responsibility of technical guidance to members of the construction team; then it is necessary to allocate the corresponding number of senior technical personnel who will make on-site supervision and instruction in terms of the effectiveness of completion of the various construction tasks, the content of technical instructions, and technical provision. Finally, they will be able to timely make corrections to some unserious and inattentive behavior.


## 5.6. Security Risks

In the implementation of each subsystem, it is necessary to fully communicate with the hospital application requirements, consider the security of the system and data, and develop a corresponding fallback strategy. If there is an error in the operation that cannot be changed, how to avoid the risk and making the corresponding contingency plan are crucial. After the system is implemented, the data must be backed up in advance before operating the database and a simulation test should be implemented first to ensure that no mistakes are made. Reasonable backup of a database is beneficial to improve the security of data. Therefore, diverse data backup methods must be designed: relevant personnel need to consider whether medical systems such as HIS, LIS, PACS, etc. have dual hot standby function and can realize backup function on the server; other systems can backup data centrally on disk arrays; off-site backup servers can dynamically backup data in the host room, on which basis the security of data preservation can be improved.


## 6. Conclusion

Due to the urgent construction period, high technology content, on-site construction management, project quality, overall progress, and cost control, there are higher requirements for the safe operation of engineering enterprises during the construction process of an information technology project in a hospital. Once there is chaotic management, it will inevitably lead to some uncertainty risk and it will generate a greater impact on the normal application of hospital information technology systems. Therefore, strengthening engineering risk management has a very important role and the main aspects of risk management include risk identification, assessment and prevention, and control. In this study, a systematic study of risk management in the R hospital information technology project is conducted with the following findings: first, the objective, uncertain, and estimable nature of risk requires that risk management is essential at every stage of project development. Specific problems should be analyzed as risks change and risk response strategies should be proposed in time to achieve dynamic risk management. Secondly, the information technology project process in R hospital shows a high degree of system complexity, associated links, greater uncertainty of project, and complex construction technology. Through the identification, evaluation, and analysis, a greater weight value of the index risk factors is obtained, such as the risk of construction demand change, risk of project schedule delay, and risk of customer interference. Third, all parties involved in the project management of information technology in R hospital can refer to the risk management model constructed, strengthen risk management awareness, and make key prevention and control countermeasures according to the impact weight value.



---

*Source: 9169407-2022-06-08.xml*