MEHARI: French Risk Analysis Method for Healthcare
MEHARI (MEthode Harmonisée d'Analyse de RIsques) is a comprehensive information security risk analysis methodology developed by CLUSIF, the French information security association. While applicable across industries, MEHARI is particularly widely adopted in French healthcare organizations and francophone countries as the preferred approach to assessing and managing health information security risks.
What MEHARI Covers
MEHARI provides a structured approach to risk analysis through three complementary modules. The risk analysis module identifies risk scenarios based on business assets, threats, and vulnerabilities. The security service evaluation module assesses the quality and maturity of existing security controls across multiple domains. The risk assessment module combines these inputs to calculate risk levels and guide treatment decisions.
The methodology includes a comprehensive knowledge base of security services organized into domains including organizational security, physical security, network security, system security, application security, and business continuity. For healthcare applications, this extends to patient data protection, medical device security, and clinical system integrity.
Who Uses MEHARI
MEHARI is widely adopted in France, francophone Africa, and parts of the European Union. French hospitals, health data hosting providers (Hébergeurs de Données de Santé), and health tech companies use MEHARI to comply with French health data regulations and support ISO 27001 certification. The methodology is freely available and supported by CLUSIF with regular updates and training resources.
Implementation Approach
Begin with asset classification, identifying critical health information assets and their value. Define risk scenarios relevant to your healthcare context. Evaluate existing security services using MEHARI's maturity scale. Calculate risk levels by combining asset values, threat scenarios, and control effectiveness. Develop a risk treatment plan addressing unacceptable residual risks. MEHARI can be conducted using spreadsheet tools or dedicated GRC platforms that support the methodology.
Cost Considerations
MEHARI itself is free and open. Implementation costs range from $15,000 for a focused risk assessment using trained internal staff to $100,000 for comprehensive enterprise-wide analysis with external consultants. Many French healthcare organizations use MEHARI alongside EBIOS RM (the French government's risk assessment method) to satisfy both healthcare and government compliance requirements.