Risk Assessment for Non-profit Hospital - Essay Example

? Risk Assessment for Non-profit Hospital Risk Assessment for Non-profit Hospital Introduction Risk assessment is a management technique to analyze the quantitative or qualitative risk value associated with a specific situation and a recognized threat. According to a definition, this idea is “a systematic process for describing and quantifying the risks associated with hazardous substances, processes, action, or events” (Covello & Merkhoher 1993, p.3). While performing a risk assessment, prime priority is given to the magnitude of the possible loss and the probability that the identified loss would occur. Generally, non-profit organizations do not perform risk assessments mainly due to insufficiency of funds. Since non-profit organizations have only limited sources to raise funds, they would find difficulties in their day to day operations if they allot money for risk assessment program. This paper will particularly perform a risk assessment for non-profit hospitals and discuss various aspects related to the issue. Importance of Hospital Data Hospital data may include a pool of documents including inpatient data, outpatient data, pricing data, hospital room rates, hospital financial data, patient case sheets, medicine stock data, medicine details, length of patient stay and discharge data, staff data, and other administrative and strategic documents. Evidently, hospital data have considerable significance on a healthcare environment because they play an inevitable role in promoting quality care and patient safety. According to the Hospital Data Project, “hospital data are now required to serve a variety of purposes including supporting activity monitoring, performance measurement, casemix-based funding, service planning, and epidemiological analysis” (HDP, 2003). This project also points the fact that hospitals are the major ‘consumers of health service resources’ and hence their data require greater level of confidentiality and integrity. Today, hospital data are increasingly used to evaluate regional performances and to identify potential areas of improvement. In addition, properly documented hospital data are helpful for different hospitals and governmental authorities to analyze the performance of their healthcare. In the view of Sorgente, Fernandez, and Petrie (n.d.), past patient treatment records are necessary for hospitals to give immediate and quality care to patients in future visits. In addition, staff data are very crucial to facilitate better distribution of duties and responsibilities among the hospital staff, particularly nurses. Therefore, it is extremely important to keep the hospital data secure and unreachable to unauthorized parties. If the data are improper or unsecure, they would be accessible to external people and this situation would adversely affect the confidentiality, availability, and integrity of data. To illustrate, when the hospital data are lost due to network attacks or any other reason, the hospital management cannot obtain access to past patient case records and medicine stock details whenever needed. Undoubtedly, this situation would reduce the quality of the care and hence challenge the patient safety. Likewise, some important data like diagnosis reports and other patient/disease detail would lose their confidentiality once the hospital data become unsecured. Under such circumstances, the victims (patients) may file lawsuits against the hospital. Finally, the authorities concerned cannot the ensure integrity of hospital data if those data are prone to unauthorized access. According to a report by UC Davis Health System, cancelled operations, false or delayed test results, and poor quality patient can be the direct implications of unsecure hospital databases. Kinds of Attacks Malware attack is likely to threaten a hospital database. Experts suggest that hospital databases are under the threat of malware attacks. Hackers try to access hospital data and thus manipulate hospital records. Such attacks can cause dreadful harms to hospital operations because most of the hospital functions are computerized today. To illustrate, Burger (2010) reports that the Kern Medical Center (Bakersfield) computer database was hit by a virus attack on July 2010. The malware attack resulted in havoc for the following three days. The attack forced the hospital staff to go back to the paper age so as to operate billing systems and administrative servers. The intruded virus downloaded ‘tons of porn documents’ into the hospital computers. Technicians took three days to remove the virus from the KMC database. Today, there are many professional hacker teams to steal or damage hospital data in exchange for remuneration. In addition, phishing, smishing, and vishing attacks raise a range of potential threats to the security of hospital data. Similarly, hospital data may be stolen if the computer system passwords are kept carelessly. It is very easy for someone working within the hospital to access hospital databases if he/she obtains system passwords. Referring to the findings of Liu (2011, p.92), today, the popularity of key logging software also raise potential challenges to the security of hospital data. By using such software, an individual can obtain unauthorized access to hospital’s computer databases even if the person is not a computer savvy. Nessus Nessus is a comprehensive vulnerability scanning program which can be deployed to enhance computer security (Nessus: NationMaster). For non-profit organizations like hospitals, Nessus will be available free of charge. According to the surveys conducted by sectools.org, Nessus is the most popular vulnerability scanner in the world; the software achieved first place in 2000, 2003, and 2006 surveys. As stated in Rogers (2011), by using Nessus, it is easy for hospitals to scan for vulnerabilities that may allow a remote hacker to access sensitive data stored. This software can also be used to check for misconfiguration vulnerabilities like open mail relay and missing patches (p.291). Nessus begins its operation by initiating a port scan using its one of four portscanners. From this port scan, the software can identify the ports which are more open on the target. Once opens ports are identified, Nessus tries different exploits on those ports (Nessus). This software would greatly assist hospitals to keep their data secure. Conclusion From the above risk assessment, it is clear that hospital data are vulnerable to different threats like malware attacks or hacking. Losing hospital data can have dreadful impacts on the care quality and patient safety because such a condition affects the availability, integrity, and confidentiality of data. In addition, such troubles would cause hospital to incur huge financial losses. Nessus is a software that can be employed to reduce the vulnerability of hospital data and thereby avoid malware attacks. References Burger, J. (2010). Kern medical center battling virus. July 29. Retrieved from http://www.bakersfieldcalifornian.com/local/x534570019/Kern-Medical-Center-battling-virus Covello, V. T & Merkhoher, M, W. (1993). Risk Assessment Methods: Approaches for Assessing Health and Environmental Risks. Springer. HDP. Hospital Data Project. (2003). Retrieved from http://ec.europa.eu/health/ph_projects/2000/monitoring/fp_monitoring_2000_frep_09_en.pdf Liu, D. (2011). Next Generation SSH2 Implementation: Securing Data in Motion. Syngress. Nessus. NationMaster.com. retrieved from http://www.nationmaster.com/encyclopedia/Nessus-(software) Nessus :  A security vulnerability scanning tool. Retrieved from http://www.cs.cmu.edu/~dwendlan/personal/nessus.html Rogers, R. (2011). Nessus Network Auditing. Syngress. SecTools.Org: Top 125 Network Security Tools. sectools.org. retrieved from http://sectools.org/ Sorgente, T., Fernandez, E. B & Petrie, M. M. L. (n.d.). Analysis Patterns for Patient Treatment Records. Retrieved from http://www.cse.fau.edu/~security/public/docs/analysis%20patterns%20for%20medical%20informationV5.pdf UC Davis Health System. (2010). ‘Experts; cyber attacks threatens hospitals’. Retrieved from http://www.ucdmc.ucdavis.edu/welcome/features/2010- 2011/08/20100811_cyberterrorism.html Read More