Risk Analysis of Electronic Medical Record Data Leakage Using the OCTAVE Allegro Method at Bhakti Mulia Hospital Jakarta

The transition from conventional medical records to Electronic Health Records (EHR), in accordance with Ministry of Health Regulation No. 24 of 2022, improves healthcare service efficiency but also introduces information security risks. This study aims to analyze EHR security risks and formulate mitigation strategies using the OCTAVE Allegro method at Bhakti Mulia Hospital. A descriptive qualitative case study was conducted at the Information Technology Unit and Medical Records Installation from February to April 2026. Data were collected through interviews, observations, OCTAVE Allegro worksheets, and reviews of standard operating procedures and policies. Five risk scenarios were identified: unencrypted data transmission without TLS (score 55; very high), weak passwords and account sharing (48; high), unattended login sessions (42; high), unencrypted and non-offsite backups (38; medium), and unsecured printed medical summaries (35; medium). Mitigation measures include encryption, access restrictions, two-factor authentication, encrypted backups, and information security education. Integrated controls are essential to protect patient confidentiality and support regulatory compliance