Discrete risk assessment models for healthcare cybersecurity
*Wasim A. BagwanCorresponding authorwasim.bagwan16@gmail.comDepartment of Apllied SciencesKrishna Institute of Science & TechnologyKrishna Vishwa Vidyapeeth (Deemed to be University)Karad, Maharashtra, 415539, IndiaView full profile → , Shilpy SinghShilpy.singh@niu.edu.inDepartment of Biotechnology and MicrobiologyNoida International UniversityGreater Noida, Uttar Pradesh, 201312, IndiaView full profile → , Swati Sucharitasucharita1614@vardhaman.orgDepartment of Computer Science and Engineering (Artificial Intelligence & Machine Learning)Vardhaman College of EngineeringShamshabad, Hyderabad, Telangana, 501218, IndiaView full profile → , D. Ganesh Kumargkumar@maher.ac.inDepartment of PharmacologyMeenakshi Medical College Hospital & Research InstituteMeenakshi Academy of Higher Education & ResearchKanchipuram, Tamil Nadu, 631552, IndiaView full profile → , Alugolu Avinashalugoluavinash@outlook.comDepartment of Computer Science & EngineeringPragati Engineering CollegeKakinada, Andhra Pradesh, 533437, IndiaView full profile → , Avinash Somatkaravinash.somatkar@vit.eduDepartment of Mechanical EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411037, IndiaView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Mar 2026
- Published Online:
- 31 Oct 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JIOS-2501
- Pages:
- 3765–3776
Abstract
Ransomware, phishing, unauthorized access, insider misuse, and device attacks are all threats to the healthcare industry as they rely on electronic health records (EHRs), cloud services, telemedicine, and connected medical devices. Qualitative matrices can give subjective results, and more sophisticated quantitative methods may need a long time of historical data. In this study, discrete risk assessment models have been proposed to evaluate the healthcare cybersecurity in an transparent and consistent way. The framework is based on five-level discrete scales for threat likelihood, vulnerability severity, asset criticality, data sensitivity, operational impact and control effectiveness. These factors determine scores of risk and threats of inherent and residual risk, and rank the threats as negligible, low, moderate, high and critical. Ten healthcare scenarios were used for evaluation and ransomware and unpatched medical devices were the most significant threats. Once these measures of multifactor authentication, network segmentation, encryption, secure backups, patch management and access monitoring were implemented, risk was reduced by 59.7%. The proposed framework helps to provide better threat differentiation, threat interpretability, control evaluation and better prioritization of cybersecurity investments, and helps to provide patient safety as well as continuity of clinical services.
Keywords
Subject Classifications
References
[1] M. Adil, M. K. Khan, N. Kumar, M. Attique, A. Farouk, M. Guizani, and Z. Jin, “Healthcare Internet of Things: Security threats, challenges, and future research directions,” IEEE Internet Things J., vol. 11, no. 11, pp. 19046–19069 (2024), doi: 10.1109/JIOT.2024.3360289.
[2] I. Keshta and A. Odeh, “Security and privacy of electronic health records: Concerns and challenges,” Egypt. Inform. J., vol. 22, no. 2, pp. 177–183 (2021), doi: 10.1016/j.eij.2020.07.003.
[3] Y. A. Qadri, A. Nauman, Y. B. Zikria, A. V. Vasilakos, and S. W. Kim, “The future of healthcare Internet of Things: A survey of emerging technologies,” IEEE Commun. Surveys Tuts., vol. 22, no. 2, pp. 1121–1167 (2020), doi: 10.1109/COMST.2020.2973314.
[4] D. W. Kim, J. Y. Choi, and K. H. Han, “Medical device safety management using cybersecurity risk analysis,” IEEE Access, vol. 8, pp. 115370–115382 (2020), doi: 10.1109/ACCESS.2020.3003032.
[5] S. S. Hameed, W. H. Hassan, L. A. Latiff, and F. Ghabban, “A systematic review of security and privacy issues in the Internet of Medical Things: The role of machine learning approaches,” PeerJ Comput. Sci., vol. 7, Art. no. e414 (2021), doi: 10.7717/peerj-cs.414.
[6] E. Fosch-Villaronga and T. Mahler, “Cybersecurity, safety and robots: Strengthening the link between cybersecurity and safety in the context of care robots,” Comput. Law Secur. Rev., vol. 41, Art. no. 105528 (2021), doi: 10.1016/j.clsr.2021.105528.
[7] T. Diphofu and P. Kaelo, “An efficient modified Wei-Yao-Liu type hybrid conjugate gradient algorithm for solving unconstrained optimization problems with application in motion control,” J. Inf. Optim. Sci., vol. 47, no. 2, pp. 513–532 (2025), doi: 10.47974/JIOS-1573.
[8] S. Razdan and S. Sharma, “Internet of Medical Things (IoMT): Overview, emerging technologies, and case studies,” IETE Tech. Rev., vol. 39, no. 4, pp. 775–788 (2022), doi: 10.1080/02564602.2021.1927863.
[9] F. Wu, C. Qiu, T. Wu, and M. R. Yuce, “Edge-based hybrid system implementation for long-range safety and healthcare IoT applications,” IEEE Internet Things J., vol. 8, no. 12, pp. 9970–9980 (2021), doi: 10.1109/JIOT.2021.3050445.
[10] A. Almalawi, A. I. Khan, F. Alsolami, Y. B. Abushark, and A. S. Alfakeeh, “Managing security of healthcare data for a modern healthcare system,” Sensors, vol. 23, no. 7, Art. no. 3612 (2023), doi: 10.3390/s23073612.
[11] S. N. Ajani, J. Moulick, J. Mohur, R. H. J. Rani, A. D. Sonawane, and P. Shende, “Enhancing secure access in RF communications through advanced elliptic curve encryption,” J. Discrete Math. Sci. Cryptogr., vol. 29, no. 2-A, pp. 571–579 (2025), doi: 10.47974/JDMSC-2498.
[12] E. Rios, A. Rego, E. Iturbe, M. Higuero, and X. Larrucea, “Continuous quantitative risk management in smart grids using attack-defense trees,” Sensors, vol. 20, no. 16, Art. no. 4404 (2020), doi: 10.3390/s20164404.
