Assessing information security risk in healthcare organizations of different scale