Information security is crucial for organizations relying on technology. Current technology only addresses a small part of the problem. Evidence shows it doesn't effectively reduce information risk. A new model based on medical history is proposed to tackle this issue.