Assessing the information technology security risk in medical supply chains

Many medical organisations around the world have connected themselves in supply chains, and are exploring the strategic utilisation of information technology (IT) throughout their chains to improve their overall efficiency and effectiveness. Although these efforts may reduce health costs, both the current status of IT security risk and the potential consequences of interconnectedness are largely unknown. This research examines medical supply chain risk exposure. In particular, data from six pharmaceutical companies and eight healthcare organisations is combined with input from security experts to determine the current degree of IT security risk. In addition, we examine an optimal strategy to reduce overall risk and the amount of supply chain risk due to partnering. We find, for the surveyed organisations, a dramatic under-deployment of controls, resulting in huge risk exposure.