Exploring the Role of Contextual Integrity in Electronic Medical Record (EMR) System Workaround Decisions: An Information Security and Privacy Perspective

Abstract

Abstract:Many healthcare providers in the US are seeking increased efficiency and effectiveness by rapidly adopting information technology (IT) solutions such as electronic medical record (EMR) systems. Legislation such as the Health Information Technology for Economic and Clinical Health Act (HITECH), which codified the adoption and "meaningful use" of electronic records in the US, has further spurred the industry-wide adoption of EMR. However, despite what are often large investments in EMR, studies indicate that the healthcare industry maintains a culture of system workarounds. Though perhaps not uncommon, the creation of informal workflows among healthcare workers is problematic for assuring information security and patient privacy, particularly when involving decisions of information management (e.g., information storage, retrieval, and/or transmission). Drawing on the framework of contextual integrity, we assert that one can often explain workarounds involving information transmissions in terms of trade-offs informed by context-specific informational norms. We surveyed healthcare workers and analyzed their willingness to engage in a series of EMR workaround scenarios. Our results indicate that contextual integrity provides a useful framework for understanding information transmission and workaround decisions in the health sector. Armed with these findings, managers and system designers should be better able to anticipate healthcare workers' information transmission principles (e.g., privacy norms) and workaround patterns (e.g., usage norms). We present our findings and discuss their significance for research and practice.

An exploration of workarounds and their perceived impact on antibiotic stewardship in the adult medical wards of a referral hospital in Malawi: a qualitative study

“…In the present study, the researchers did not examine the participants’ understanding of internal factors driving workarounds, or the processes of the institutionalization of workarounds in their daily practice, or the managers’ awareness and perception of workarounds. Further research on the contextual attributes of workarounds [34] will illuminate whether they are avoidable or unavoidable, essential, temporary or reutilized, deliberate or unplanned [35].…”

Intentions to Comply Versus Intentions to Protect: A VIE Theory Approach to Understanding the Influence of Insiders’ Awareness of Organizational SETA Efforts

“…However, this also signifies a potential conflict between the intention to comply and the intention to protect, whereby situations can arise in which insiders perceive that compliance with organizational ISPs may not be protective. One can even conceive of a situation in which a well‐meaning employee might attempt to protect the organization from an information security threat at the expense of compliance with an outdated or overly burdensome policy by employing a workaround (Burns, Young, Roberts, Courtney, & Ellis, ). Thus, future researchers should seek to examine situations where insiders’ perceive conflicts between protection and compliance to shed light on how these conflicts influence intentions to comply and intentions to protect.…”

Workaround behaviour in information systems research

“…Another frequent utilization of workaround in IS was on the healthcare context. Studies such as (Hooff and Hafkamp, 2017; Savoli et al , 2016; Reiz and Gewald, 2016; Röder et al , 2015; Burns et al , 2015; Safadi and Faraj, 2010) approach the topic. The security excess in a healthcare environment was addressed, as could bring consequences such as evoking negative emotions on the users in relation to the system, increasing of dissatisfaction and occurrence of workaround practices that may result in the ineffective use of the system and, occasionally, could endanger the patients’ lives (Savoli et al , 2016).…”

“…Another frequent utilization of workaround in IS was on the healthcare context. Studies such as (Hooff and Hafkamp, 2017;Savoli et al, 2016;Reiz and Gewald, 2016;Röder et al, 2015;Burns et al, 2015;Safadi and Faraj, 2010) approach the topic. The security excess in a healthcare environment was addressed, as could bring The quality of information is important to assess end-user satisfaction and influence workaround behavior 2 Shadow IT, evolved as a type of workaround from nontransparent and unapproved end-user computing 3…”