Exploring user's compliance behavior towards Health Information System security policies based on extended Health Belief Model

Abstract

Information security awareness is important among users because it can influence user's behavior towards complying with organization information security policies. Therefore, the current study was conducted to examine information security awareness factors affecting user's compliance behavior towards Health Information System (HIS) security policies based on extended Health Belief Model. The questionnaires were distributed to the respondents at selected public hospitals in Malaysia (N = 454). Statistical results confirm that perceived work experience, perceived severity, perceived benefit, cues to action, self-efficacy and perceived barrier were significant predictors of health information system's security policies compliance behaviour while perceived susceptibility was insignificant. Our findings will prove to be beneficial to fellow researchers and policy makers, especially related to the medical sectors in improving user's behavior toward practicing information security.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

“…The third-greatest threat is user error in handling information (six studies). This threat can be triggered by the weakness of information security policy compliance [ 57 , 74 ], ignorance of the risk involved [ 11 ], poor security skills and security monitoring [ 1 ], low user education, and lack of awareness of information security [ 50 , 75 ].…”

Mapping the Psychosocialcultural Aspects of Healthcare Professionals’ Information Security Practices: Systematic Mapping Study

“…Some of the frameworks were developed to assess only perception variables [4,26,33,36,37,40]. Other frameworks adopted only social constructs [4,7,35,42,43] or cultural factors [33,48,49]. However, in a scenario where a study must be conducted with the aim of comprehensively understanding and addressing the information security challenges often faced by health care professionals, it is important to know which of the existing frameworks will be adequate.…”

“…The reviewed frameworks [8,[14][15][16]31,38,41,44,45,[49][50][51][52][53][54][55][56][57][58][59][60][61][62][63][64][65][66] were not fully comprehensive. Meanwhile, security issues are affected by all these aspects and not just psychological, social, cultural, or sociodemographic aspects alone [38].…”

“…Table 2 presents the theories identified in the literature review [4,7,11,14,49,53,59,62,65]. The theories that were most often used in analyzing the security practices of health care professionals included the health belief model (n=6), TPB (n=5), general deterrence theory (n=4), PMT (n=4), and technology acceptance theory (n=2), as shown in Table 2.…”

“…Based on the overview of existing literature [8,[14][15][16]31,38,41,44,45,[49][50][51][52][53][54][55][56][57][58][59][60][61][62][63][64][65][66], we concluded that existing frameworks lack a comprehensive and holistic perspective. Furthermore, not all frameworks provide strong empirical support for the inclusion of variables from the perspective of both security related-behaviors and professionals' characteristics [14,45,49,52,55,[57][58][59]. Therefore, this paper represents a step toward creating a comprehensive and practically useful framework that can aid information security practitioners in fulfilling their work requirements by incorporating relevant concepts and research results that serve as a foundation of the framework.…”