Text this: Methodology for determining actual threats to information security in medical information system