Security threats categories in healthcare information systems

TLDR

The article investigates the types of threats present in healthcare information systems. The study surveyed three departments (IT, Medical Records, X‑Ray) in a Malaysian government‑supported hospital using structured interviews to collect data on HIS threats. The study identified 22 threat types, with power failure as the most critical, followed by human error and other technical factors, providing a comprehensive taxonomy for HIS risk analysis.

Abstract

This article attempts to investigate the various types of threats that exist in healthcare information systems (HIS). A study has been carried out in one of the government-supported hospitals in Malaysia.The hospital has been equipped with a Total Hospital Information System (THIS). The data collected were from three different departments, namely the Information Technology Department (ITD), the Medical Record Department (MRD), and the X-Ray Department, using in-depth structured interviews. The study identified 22 types of threats according to major threat categories based on ISO/IEC 27002 (ISO 27799:2008). The results show that the most critical threat for the THIS is power failure followed by acts of human error or failure and other technological factors. This research holds significant value in terms of providing a complete taxonomy of threat categories in HIS and also an important component in the risk analysis stage.