Risk Assessment Mechanism for Personal Information Operations -- Case Study by Hospital

The literature collecting and studying in this paper are based on the Grounded Theory to identify the possible risk, and build up the prototype of risk assessment mechanism by the 64 risk factors framework which is generated from the 11 control areas of ISO 27001. Then, make sure the risk factors discussed are suitable through the mechanism modification by expert questionnaires distribution. Furthermore, through interviewing individual case by hospital to realize the impact to the implementation of the Personal Information Protection Act in the industry, and take further feasibility evaluation. Based on the results of this research, it is expected that an effective and quick method is developed to assist enterprises to identify possible risks and the importance of those risks in processing personal information, such that, the enterprises will not ignore those possible risks, on the same time, will not misjudge the importance of those risks either, therefore, reduce the chance of risk and possibility of illegal issues or personal information leakage generated by enterprise.