Threats to Healthcare Data: A Threat Tree for Risk Assessment

The American Recovery and Reinvestment Act of 2009 authorizes the payment of incentives to hospitals, clinics, and practices that adopt meaningful use of electronic health records by the year 2015.The promise of making health data readily available for manipulation any place, any time, and in multiple formats is reduced medical and medication errors, lower healthcare costs, and improved healthcare outcomes.However, control over availability is no small challenge.This paper represents a preliminary effort at cataloging threats to electronic healthcare data associated with unauthorized access, data loss, and data corruption as a threat tree.The purpose of the threat tree presented here is to facilitate risk assessments and inform health care policy and legislation.The paper concludes with a brief discussion of ways to vet and extend the proposed threat tree.