RSK80004: Due Diligence Review of HIS - Swinburne University

This report presents a due diligence review of a Hospital Information System (HIS), encompassing vulnerability assessments, threat identification, and precautionary analyses. The assessment examines critical success factors such as system and business process adjustments, organizational resistance, top management support, and member capabilities. Identified threats include network infrastructure failures, hardware issues, malware attacks, data theft, and system resource misuse. Critical vulnerabilities, such as outdated systems, inadequate physical security, budget constraints, and a lack of cybersecurity focus, are also discussed. The report then proposes precautionary measures, including network security protocols, device security software, behavioral analytics, data loss prevention, and hardware/software maintenance, to mitigate identified risks and ensure the smooth functioning of the HIS. The report concludes by emphasizing the importance of a proactive approach to address potential risks within the hospital information system.

Running head: DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
Due Diligence Review of Hospital Information System
Name of the student:
Name of the university:
Author Note:

1DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
Table of Contents
1. Introduction............................................................................................................................2
2. Vulnerability assessment for HIS...........................................................................................2
2.1 Critical Success Factors...................................................................................................3
2.2 Threats identified in the hospital information systems....................................................5
2.3 Critical vulnerabilities......................................................................................................6
3. Precautionary Analysis for HIS.............................................................................................8
4. Conclusion..............................................................................................................................9
5. References............................................................................................................................10

2DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
1. Introduction
This report assesses the due diligence review regarding the information systems
associated with the hospitals (Donahue and Rahman, 2015). The aim of this report is to
investigate as well as research, the various types of threats and vulnerabilities incorporated
with the information systems present within the hospitals in a healthcare industry. The
information systems incorporated in the environment of hospitals stores the information
regarding the health, safety as well as privacy of the patients associated with the hospitals.
The intense and extensive study of the hospital information system (HIS) are mainly affected
by emergency events as well as by deliberate potential threats. These threats may put a severe
damage regarding the data present within the environment of the HIS.
2. Vulnerability assessment for HIS
The vulnerability assessment is said to be the process that defines, classifies, identifies
as well as identifies the issue with respect to the computer systems, network infrastructures
and applications in a proper organized manner (Lohrke, Frownfelter-Lohrke and Ketchen,
2016). This assessment provides the necessary knowledge, risk; awareness capabilities for
understanding the threats related to the overall HIS. This assessment technique also quantifies
the potential threats as well as vulnerabilities present within the overall system
In this case, the vulnerability assessment is done in regards to the environment of the
hospital information systems (Howson, 2017). The various aspects in regards to the hospital
information system are critically assessed and the potential threats are identified that are
related along with this system.

3DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
2.1 Critical Success Factors
The critical success factors that are used for the continuous improvement of quality
are stated as the adjustment of information systems, adjustment for organizational flow,
resistance of organization, support of the top management and capability of the prime
members.
The adjustment regarding the information systems often struggle regarding the
decisions with the extent in the field of customization. As the hospitals do not have same
practices regarding the adaptability of the infrastructure, an integrated system of architecture
for the hospital information system is not applicable (Lambkin and Muzellec, 2017). There is
a necessity for the reconfiguration as well as customization of the enterprise systems if the fir
of the organizational strategies are observed to be weak and much more vulnerabilities occurs
within the hospital information systems.
The next critical success factor is viewed as the adjustment in the business process.
Many organizations that are implying the hospital information system cannot assimilate the
web technologies effectively in the e business initiatives. This is because the changes in the
technological sectors cannot simultaneously cope with the corresponding changes within the
existing processes of business (Nilashi et al., 2016). The business process changes
incorporates the structure of the organization, the system of reward within the provided
system, the corporate culture that is to be followed within the environment of the information
systems, the preferences of the customer as well as the implementation of the disruptive
technologies. As the implementation of the hospital information system comprises of a long
life cycle the requirements are constantly changing, thus to provide the correct responses to
the implementation of the hospital information systems the adjustments must be critically
analysed as well as effectively imposed within the organization.

4DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
Another important critical success factor that is depicted in regards to the hospital
information system may be stated as the organizational resistance that can decrease the
chance of the project success or tends to the failure of the cause systems. The main fact that is
observed in regards to the hospital information systems is said to be the fact of the political
instability of the country in which the organization is thriving to implement the modification
using technology (Ahmadi et al.,2017). This success factor possess moderating effects among
the relationship of the outcome of the project and the organizational fit.
Moreover, the support of the top management is also depicted as one of the critical
success factor regarding the technological aspect of the implied hospital information system.
As this system has a far-reaching effect on the business organization, the supply chain of the
hospital systems requires the total support from the top management (Park, Sharman and
Rao, 2015). If the top management department of the organization fails in providing the
needed support then the implementation of the information system may fail or can observe
many risks while the implementation is already under progress.
Lastly, the depicted critical success factor is identified as the capability of the
members that are involved with the implementation as well as the end users that will be
facilitated by the implied hospital management systems (Gordon, Fairhall and Landman,
2017). It is presumed that the leadership is one of the most significant quality that should be
present within the organization that are trying to impose the information system within their
hospitals. This is necessary as it can put focus on the factors such as communication, solving
the problems as well as decision-making capabilities within the implication of the software
projects of the hospitals.
Thus the below figure give a summary of the overall critical factors as well as the
success of the systems and their fit within the organization.

5DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
2.2 Threats identified in the hospital information systems
The potential threats that are identified in the due diligence review regarding the
implementation of the hospital information systems are stated as follows:
Failure in the Network Infrastructure: This is said to be the potential threat that emerges in
an organization, which is dealing with the hospital information system (Koppel, 2016). The
network that incorporates the overall functionality of the hospital information system is said
to be the most significant prerequisite for the smooth functioning of the system. In case the
network fails there, there might be a disruption in the overall functionality that will hamper
the smooth functionality of the whole information system of the hospital.
Failure of the Hardware Systems: The interface of the hospital information systems that
associates the hardware specifications is duly necessary for the enhanced approach of the
overall system (Wangerin, 2017). In case any hardware part seeks any disruption, the
functionality of the hospital information system may get disrupted.
Malware attacks: As the overall system of the hospital information works in accordance with
the network systems, it is exposed to the malware as well as virus attacks from the internet.

6DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
This attacks may put an adverse effect in the functional areas of the hospital information
systems specifically in the areas of the data or information as well as can lead to the
consumer and valuable information to be wiped out from the server of the information
systems (Ollivet, 2017).
Data theft issues: The issues regarding the theft of data present within the various sectors of
the information system can lead to a big threat for the organization (Cresswell et al., 2017).
The individuals involved with the theft of data can misuse the information in future that will
lead to the hamper and manipulation of the consumer or end user data present within the
information systems.
System resources misuse: This is the potential threat that may occur within the environment
of the hospital information systems. With this threat occurrence, the various trusted resources
are exposed to be theft thus hampering the functionality of the overall system.
2.3 Critical vulnerabilities
The critical vulnerabilities are defined as the state in which the protection is said to
get lacked from a harmful situation with regards to the hospital information systems (Guinet
et al., 2016). These situations can be specifically identified and are explained in brief.
The hospital information system might be vulnerable if the systems or the softwares that are
being used by the organization remains outdated (Sharma et al., 2016)
 . This can emerge due to the lack of budget as well as the operational concerns
regarding the hospital information systems.
 The implemented information systems may get exposed to the hackers if the physical
security factors as well as the clinical devices are not kept in a thorough check by the
IT department who is responsible for the control as well as maintenance of the overall
information system.

7DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
 The most vulnerable factor that is being identified regarding the hospital information
system can be depicted as the overall budget that is implemented for the development
of this information system (Handayani et al., 2016). If the overall budget is less, the
network security will be developed as flat networks, which can be an easy target for
the attackers who are seeking for creating a disruption in the environment of the
hospital information systems.
 Most of the hospital thrives to save lives of the patient associated with the
organization. Thus, the primary focus may be scrambled for the potential risks of the
cyber security measures associated with the hospital information systems.
 The last vulnerability that is identified that most of the time the enterprises of the
healthcare industry may start their operations as distinguished organization, which
will hamper the saving of the whole information into one server.
Moreover the overall vulnerability or the threat associated with any enterprises regarding
the due diligence review can be stated with the following flowchart:
(Image: Flowchart of overall vulnerability in an enterprise)
(Source: Vulnerability flowchart, 2019)

8DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
3. Precautionary Analysis for HIS
The above stated vulnerability assessment as well as the threat identification provides
a clear reflection of the possible risk areas that might emerge in an organization (Jensen and
Watts, 2016). Thus for the mitigation as well as emergence of such risks can be restricted by
simply following some precautionary measures, which are stated briefly.
Firstly, the most important aspect that needs attention is the security within the
network environment of the overall working platform of the hospital information system. The
network firewall must always be turned on for the protection of the network server as well as
the information that are being stored in regards to the hospital information system. Moreover,
the devices associated with the information system within the enterprise must be installed and
timely updated with the antivirus as well as the antimalware software that will protect the
devices form any malware or information attacks within the enterprise.
Secondly, the behavioural analytics of the overall systems involved in the enterprise
must be analysed with the help of a software so that the health of all the devices can be kept
in a constant check so that the devices does not incur any possible threat before it can hamper
the information present within the system of the enterprise.
Thirdly, the data loss prevention must be focused that are present within the server as
well as in the devices of the hospital information system. The data is said to be the most
important and significant asset present in the enterprise. Hence, the security of the data must
be adhered on a pre-emptive basis or else it can cause the overall system to crash down thus
putting an adverse effect in the functionality of the enterprise information system.
Lastly, the hardware as well as the softwares must be adhered with a prime focus as
these are stated as the most important assets that deals with the back end as well as frontend
of the enterprise information architecture. The devices associated with the overall execution

9DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
of the enterprise information system must be tracked down frequently for the identification of
any risk that can emerge within the overall network of the information systems.
4. Conclusion
Thus from the above report the overall analysis of the different segments that
incorporates the due diligence review are well stated. The due diligence review mainly
comprises of two factors that are stated as vulnerability assessment and the precautionary
analysis, which are depicted and stated in the report above regarding the hospital information
system. Moreover, any business, project as well as organization can overview this due
diligence review for carrying out a critical analysis of the risks, threats as well as it mitigation
precautionary measures. Thus it can be concluded that the due diligence review is stated as an
important aspect of a business for performing an overall analysis of the vulnerabilities present
as well as the risk mitigation procedures of the enterprise architecture system regarding any
type of innovation.

10DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
5. References
Ahmadi, H., Nilashi, M., Shahmoradi, L. and Ibrahim, O., 2017. Hospital Information System
adoption: Expert perspectives on an adoption framework for Malaysian public hospitals.
Computers in Human Behavior, 67, pp.161-189.
Cresswell, K.M., Mozaffar, H., Lee, L., Williams, R. and Sheikh, A., 2017. Safety risks
associated with the lack of integration and interfacing of hospital health information
technologies: a qualitative study of hospital electronic prescribing systems in England. BMJ
Qual Saf, 26(7), pp.530-541.
Donahue, K. and Rahman, S., 2015. Healthcare IT: Is your Information at Risk?. arXiv
preprint arXiv:1512.01731.
Gordon, W.J., Fairhall, A. and Landman, A., 2017. Threats to information security—public
health implications. N Engl J Med, 377(8), pp.707-709.
Guinet, A., Fondrevelle, J., Baranzini, D., Cook, S., Djalali, A. and Faccincani, R., 2016. A
vulnerability assessment approach for hospital protection against terrorism attacks (Doctoral
dissertation, INSA Lyon).
Handayani, P.W., Sandhyaduhita, P.I., Hidayanto, A.N., Pinem, A.A., Fajrina, H.R., Junus,
K.M., Budi, I. and Ayuningtyas, D., 2016. Integrated hospital information system architecture
design in Indonesia. In Maximizing Healthcare Delivery and Management through
Technology Integration (pp. 207-236). IGI Global.
Howson, P., 2017. Due diligence: The critical stage in mergers and acquisitions. Routledge.
Jensen, E.T. and Watts, S., 2016. A Cyber Duty of Due Diligence: Gentle Civilizer or Crude
Destabilizer. Tex. L. Rev., 95, p.1555.

11DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
Koppel, R., 2016. Great promises of Healthcare Information technology deliver less. In
Healthcare information management systems (pp. 101-125). Springer, Cham.
Lambkin, M. and Muzellec, L., 2017. Marketing: Its Valuable Role in the Due Diligence
Process. In Value in Due Diligence (pp. 63-80). Routledge.
Lohrke, F.T., Frownfelter-Lohrke, C. and Ketchen Jr, D.J., 2016. The role of information
technology systems in the performance of mergers and acquisitions. Business Horizons,
59(1), pp.7-12.
Nilashi, M., Ahmadi, H., Ahani, A., Ravangard, R. and bin Ibrahim, O., 2016. Determining
the importance of hospital information system adoption factors using fuzzy analytic network
process (ANP). Technological Forecasting and Social Change, 111, pp.244-264.
Ollivet, C., 2017. The vulnerability and rights of the users of our healthcare system.
Gérontologie et société, 39(3), pp.109-119.
Park, I., Sharman, R. and Rao, H.R., 2015. Disaster experience and hospital information
systems: An examination of perceived information assurance, risk, resilience, and his
usefulness. Journal of Consumer Research, 12(4), pp.382-405.
Sharma, L., Chandrasekaran, A., Boyer, K.K. and McDermott, C.M., 2016. The impact of
health information technology bundles on hospital performance: An econometric study.
Journal of Operations Management, 41, pp.25-41.
Vulnerability flowchart (2019). Threat / Vulnerability Assessments and Risk Analysis |
WBDG - Whole Building Design Guide. [online] Wbdg.org. Available at:
https://www.wbdg.org/resources/threat-vulnerability-assessments-and-risk-analysis
[Accessed 26 May 2019].

12DUE DILIGENCE REVIEW OF HOSPITAL INFORMATION SYSTEM
Wangerin, D., 2017. M&A due diligence, post-acquisition performance, and financial
reporting for business combinations.