INFORMATION SECURITY RISK ASSESSMENT USING FACTOR OF ANALYSIS INFORMATION RISK (FAIR) IN THE HEALTHCARE SECTOR: SCOPING REVIEW

Abstract

Risk assessment is an effective way to reduce information technology risks in healthcare facilities by determining the severity of potential dangers and weaknesses affecting each vital data element. This enables appropriate actions to be taken by prioritizing data with the highest risk. However, there is still a lack of research on information security risk assessment using Factor Analysis of Information Risk (FAIR) in healthcare information systems, necessitating further studies to understand its implementation in Indonesia. A 21,939 articles were found in four databases, but only three met the inclusion criteria from Indonesia, Japan, and the United States. These studies focus on risk assessment and management in the healthcare sector, including ISO 27005, cloud ecosystem risk analysis, cybersecurity standards, and IoT risk management for COVID-19. The review stresses the significance of risk assessment and management in the health sector to sustain health facilities amidst policy changes, technological advancements, and globalization. FAIR is vital in determining the likelihood and potential consequences of events that can affect organizations, particularly in the competitive healthcare industry where a secure health information system is necessary for business continuity. Hence, studies must develop methods to reduce information security risks in Healthcare services information systems.