Identifying Information Security Risk Components in Military Hospitals in Iran

Background and Aim: Information systems are always at risk of information theft, information change, and interruptions in service delivery. Therefore, the present study was conducted to develop a model for identifying information security risk in military hospitals in Iran. Methods: This study was a qualitative content analysis conducted in military hospitals in Iran in 2019. The sample consisted of 8 experts in the field of health information. Data were collected through semi-structured interviews. Data were analyzed using framework analysis and MAXQDA 12 software. Results: Data analysis resulted in the extraction of 78 codes and 16 categories in 7 themes (management in information security, patient information security, information security in organizational resources, organize in information security, communication in information security, monitoring, and control, equipment security). Information security in organizational resources has the highest number of codes and the management in information security and communication in information security have the least number of codes. Conclusion: Health care organization's security programs, especially in military hospitals faced with many challenges, the first step of which is to identify potential risks and threats. Then develop policies, guidelines, and programs to eliminate or reduce these threats.