Enhancing Information Security and Risk Governance in Hospital Electronic Medical Record Systems

Authors

DOI:

https://doi.org/10.51903/00wfhv86

Keywords:

Risk Management, Electronic Medical Records, ISO 31000:2018, Information Security

Abstract

This study aims to analyse risk management in hospital medical records information systems using the ISO 31000:2018 framework. Electronic medical records play a critical role in storing and managing sensitive patient data, requiring a structured risk management approach to identify, evaluate, and control potential threats. The research method used was a descriptive qualitative approach, using observation and interviews with information technology staff and medical records managers. The results revealed 11 key risks, divided into three categories: high, medium, and low. High risks were primarily related to the lack of system protection against cyber threats. This study concluded that implementing ISO 31000:2018 can help hospitals develop more effective risk mitigation strategies, thereby supporting the security, integrity, and availability of patient data.

References

[1] G. E. Myeong and K. S. Ram, “Blockchain Based Zero Knowledge Proof Protocol For Privacy Preserving Healthcare Data Sharing,” J. Technol. Informatics Eng., vol. 4, no. 1, pp. 171–189, Apr. 2025, doi: 10.51903/jtie.v4i1.296.

[2] A. A. Ashofi and M. Migunani, “The Impact of Data Security, Ease of Use, and Access Speed on User Trust in Mobile Banking Applications,” J. Manag. Informatics, vol. 2, no. 3, pp. 104–117, May 2023, doi: 10.51903/jmi.v2i3.148.

[3] A. Zainudin, A. P. Hadi, and A. Priyadi, “Sistem Informasi Persediaan Obat Berbasis Web di Rumah Sakit Bina Kasih,” J. Ilm. Sist. Inf., vol. 3, no. 3, pp. 30–34, Jan. 2024, doi: 10.51903/2xwvpm83.

[4] C. Pekkari, B. Lund, T. Davidson, A. Naimi-Akbar, A. Marcusson, and C. K. Weiner, “Cost Analysis of Orthognathic Surgery: Outpatient Care versus Inpatient Care,” Int. J. Oral Maxillofac. Surg., vol. 53, no. 10, pp. 829–835, Oct. 2024, doi: 10.1016/j.ijom.2024.02.005.

[5] E. Yudianti and M. Arini, “Penerapan Healthcare Failure Mode and Effect Analysis (HFMEA) pada Implementasi Rekam Medis Elektronik,” J. Kesehat. Vokasional, vol. 9, no. 1, pp. 61–75, Feb. 2024, doi: 10.22146/jkesvo.88541.

[6] F. A. Reegu et al., “Blockchain-Based Framework for Interoperable Electronic Health Records for an Improved Healthcare System,” Sustainability, vol. 15, no. 8, p. 6337, Apr. 2023, doi: 10.3390/su15086337.

[7] K. Mohan, P. Kitsos, S. M. Williamson, and V. Prybutok, “Balancing Privacy and Progress: A Review of Privacy Challenges, Systemic Oversight, and Patient Perceptions in AI-Driven Healthcare,” Appl. Sci., vol. 14, no. 2, p. 675, Jan. 2024, doi: 10.3390/app14020675.

[8] S. H. Björnsdottir, P. Jensson, S. E. Thorsteinsson, I. M. Dokas, and R. J. De Boer, “Benchmarking ISO Risk Management Systems to Assess Efficacy and Help Identify Hidden Organizational Risk,” Sustainability, vol. 14, no. 9, p. 4937, Apr. 2022, doi: 10.3390/su14094937.

[9] L. Purwanti, I. Triyuwono, G. Maski, D. Pusposari, A. Prakoso, and M. Ibrahim, “The Impact of ISO 31000 Adoption on the Performance of Banking Companies in Indonesia,” Cogent Bus. Manag., vol. 12, no. 1, p. 2507222, Dec. 2025, doi: 10.1080/23311975.2025.2507222.

[10] A. Sermhattakit and P. Sae-Lim, “Key Risks and Mitigation Strategies in Enterprise Risk Management for Private Hospitals: A Mixed-Method Study,” Inq. (United States), vol. 62, pp. 1–13, Jan. 2025, doi: 10.1177/00469580251347132.

[11] N. Watted et al., “The Complexity of Skeletal Transverse Dimension: From Diagnosis, Management, and Treatment Strategies to the Application of Collaborative Cross (CC) Mouse Model,” J. Funct. Morphol. Kinesiol., vol. 9, no. 1, p. 51, Mar. 2024, doi: 10.3390/jfmk9010051.

[12] W. S. Admass, Y. Y. Munaye, and A. A. Diro, “Cyber Security: State of the Art, Challenges and Future Directions,” Cyber Secur. Appl., vol. 2, p. 100031, Jan. 2024, doi: 10.1016/j.csa.2023.100031.

[13] H. M. Melaku, “Context-Based and Adaptive Cybersecurity Risk Management Framework,” Risks, vol. 11, no. 6, p. 101, May 2023, doi: 10.3390/risks11060101.

[14] B. Alamri, K. Crowley, and I. Richardson, “Cybersecurity Risk Management Framework for Blockchain Identity Management Systems in Health IoT,” Sensors, vol. 23, no. 1, p. 218, Dec. 2022, doi: 10.3390/s23010218.

[15] A. Pollini et al., “Leveraging Human Factors in Cybersecurity: an Integrated Methodological Approach,” Cogn. Technol. Work, vol. 24, no. 2, pp. 371–390, Jun. 2021, doi: 10.1007/s10111-021-00683-y.

[16] I. Pouliezou, A. P. Gravia, and M. Vasoglou, “Digital Model in Orthodontics: Is It Really Necessary for Every Treatment Procedure? A Scoping Review,” Oral, vol. 4, no. 2, pp. 243–262, Jun. 2024, doi: 10.3390/oral4020020.

[17] A. Azadi and F. J. García-Peñalvo, “Aligning EMR Structure with Treatment Cycles: Enhancing Data Management and CDSS Functionality,” Appl. Sci., vol. 15, no. 10, p. 5273, May 2025, doi: 10.3390/app15105273.

[18] Z. A. Maizura, S. K. Citra, and T. Purwaningrum, “Penerapan Aplikasi SATUSEHAT SDMK Bagi SDM Dinas Kesehatan Kabupaten Ponorogo,” Karya Nyata J. Pengabdi. Kpd. Masy., vol. 2, no. 1, pp. 73–86, Jan. 2025, doi: 10.62951/karyanyata.v2i1.1024.

[19] J. V. Barraza de la Paz, L. A. Rodríguez-Picón, V. Morales-Rocha, and S. V. Torres-Argüelles, “A Systematic Review of Risk Management Methodologies for Complex Organizations in Industry 4.0 and 5.0,” Systems, vol. 11, no. 5, p. 218, Apr. 2023, doi: 10.3390/systems11050218.

[20] S. M. H. S. ; Falcão, M. J. ; De Almeida, S. M. H. S. Rezvani, M. João, F. Silva, and N. Marques De Almeida, “The Risk-Informed Asset-Centric (RIACT) Urban Resilience Enhancement Process: An Outline and Pilot-Case Demonstrator for Earthquake Risk Mitigation in Portuguese Municipalities,” Appl. Sci., vol. 14, no. 2, p. 634, Jan. 2024, doi: 10.3390/app14020634.

[21] S. Ngwenya, N. S. Mashau, S. E. Mhlongo, and A. N. Traoré, “A Systematic Review of the Risk Management Frameworks for Potentially Toxic Chemical Elements,” Toxicol. Ind. Health, vol. 39, no. 12, pp. 679–686, Dec. 2023, doi: 10.1177/0748233723120909.

[22] S. H. Björnsdóttir, P. Jensson, R. J. de Boer, and S. E. Thorsteinsson, “The Importance of Risk Management: What is Missing in ISO Standards?,” Risk Anal., vol. 42, no. 4, pp. 659–691, Apr. 2022, doi: 10.1111/risa.13803.

[23] L. Ispas, C. Mironeasa, and A. Silvestri, “Risk-Based Approach in the Implementation of Integrated Management Systems: A Systematic Literature Review,” Sustainability, vol. 15, no. 13, p. 10251, Jun. 2023, doi: 10.3390/su151310251.

[24] S. Saeed, S. A. Altamimi, N. A. Alkayyal, E. Alshehri, and D. A. Alabbad, “Digital Transformation and Cybersecurity Challenges for Businesses Resilience: Issues and Recommendations,” Sensors, vol. 23, no. 15, p. 6666, Jul. 2023, doi: 10.3390/s23156666.

[25] M. F. Safitra, M. Lubis, and H. Fakhrurroja, “Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity,” Sustainability, vol. 15, no. 18, p. 13369, Sep. 2023, doi: 10.3390/su151813369.

[26] K. T. Kosmowski, E. Piesik, J. Piesik, and M. Śliwiński, “Integrated Functional Safety and Cybersecurity Evaluation in a Framework for Business Continuity Management,” Energies, vol. 15, no. 10, p. 3610, May 2022, doi: 10.3390/en15103610.

[27] Z. Wenhua, F. Qamar, T. A. N. Abdali, R. Hassan, S. T. A. Jafri, and Q. N. Nguyen, “Blockchain Technology: Security Issues, Healthcare Applications, Challenges and Future Trends,” Electronics, vol. 12, no. 3, p. 546, Jan. 2023, doi: 10.3390/electronics12030546.

[28] A. Mishra, Y. I. Alzoubi, A. Q. Gill, and M. J. Anwar, “Cybersecurity Enterprises Policies: A Comparative Study,” Sensors, vol. 22, no. 2, p. 538, Jan. 2022, doi: 10.3390/s22020538.

[29] Q. Aini, D. Manongga, U. Rahardja, I. Sembiring, and Y. M. Li, “Understanding Behavioral Intention to Use of Air Quality Monitoring Solutions with Emphasis on Technology Readiness,” Int. J. Human–Computer Interact., vol. 41, no. 8, pp. 5079–5099, 2025, doi: 10.1080/10447318.2024.2357860.

[30] D. M. Lengyel, T. A. Mazzuchi, and W. E. Vesely, “Establishing Risk Matrix Standard Criteria for Use in the Continuous Risk Management Process,” J. Sp. Saf. Eng., vol. 10, no. 3, pp. 276–283, Sep. 2023, doi: 10.1016/j.jsse.2023.05.001.

Downloads

Published

2025-11-30

Issue

Vol. 4 No. 3 (2025): November: Jurnal Ilmiah Sistem Informasi

Section

Articles

License

Copyright (c) 2025 Evva Choirotul Mahfazza, Yusuf Amrozi, Faris Muslihul Amin

Creative Commons License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).

Under this license:

  • Authors retain copyright of their work.

  • Others are free to:

    • Share — copy and redistribute the material in any medium or format;

    • Adapt — remix, transform, and build upon the material for any purpose, even commercially;

  • As long as they:

    • Give appropriate credit to the original author(s) and the source;

    • Provide a link to the license;

    • Indicate if changes were made;

    • Distribute their contributions under the same license as the original.

This ensures that derivative works will also remain free and open under the same terms.