Managing Risk Related to Information Security in Health Care