Creating a Standardized Risk Assessment Framework Library for Healthcare Information Technology

Abstract

Data breaches are occurring at an unprecedented rate.In February 2019 alone, over a million individuals were reported to the United States government as having been involved in a breach of their medical data by healthcare entities. Although many organizations have some policies, procedures and risk management components in place, few (if any) organizations are centrally connecting legal requirements, penetration tests, policies and procedures into a standardized and consistent methodology for further analysis and auditing. This research produces a new open source risk management standardized library coordinating the aforementioned risk management components. The new library is applied to an open source vulnerable web-application example to emphasize the benefits from the adoption of such a public standardized risk assessment library.

What Can We Learn about Healthcare IT Risk from HITECH? Risk Lessons Learned from the US HHS OCR Breach Portal

“…The healthcare industry has moved to a risk management model, perhaps due to the Federal requirement of risk assessments for systems and processes involving PHI. Currently the healthcare industry has not yet adopted a standard risk framework library (Schmeelk, 2020). The adoption of such a framework would help unify associated breach cost estimates for insurance purposes and improve ad hoc risks assessments from reporting entirely different findings.…”