Information Security Awareness and Behaviors of Health Care Professionals at Public Health Care Facilities

Abstract

Objectives This study investigated information security behaviors of professionals working in the public health sector to guide policymakers toward focusing their investments in infrastructure and training on the most vulnerable segments. We sought to answer the following questions: (1) Are certain professional demographics more vulnerable to cybersecurity threats? (2) Do professionals in different institution types (i.e., hospitals vs. primary care clinics) exhibit different cybersecurity behaviors? (3) Can Internet usage behaviors by professionals be indicative of their cybersecurity awareness and the risk they introduce? Methods A cross-sectional, anonymous, paper-based survey was distributed among professionals working in public health care organizations in Kuwait. Data were collected about each professional's role, experience, work environment, cybersecurity practices, and understanding to calculate a cybersecurity score which indicates their level of compliance to good cybersecurity practices. We also asked about respondents' internet usage and used K-means cluster analysis to segment respondents into three groups based on their internet activities at work. Ordinary least squares regression assessed the association between the collected independent variables in question on the overall cybersecurity behavior. Results A total of 453/700 (64%) were responded to the survey. The results indicated that professionals with more work experience demonstrated higher compliance with good cybersecurity practices. Interestingly, nurses demonstrate higher cybersecurity aptitude relative to physicians. Professionals that were less inclined to use the internet for personal use during their work demonstrated higher cybersecurity aptitude. Conclusion Our findings provide some guidance regarding how to target health care professional training to mitigate cybersecurity risks. There is a need for ensuring that physicians receive adequate cybersecurity training, despite the opportunity costs and other issues competing for their attention. Additionally, classifying professionals based on their internet browsing patterns may identify individuals vulnerable to cybersecurity incidents better than more discrete indicators such as age or gender.

Work Experience as a Factor in Cyber-Security Risk Awareness: A Survey Study with University Students

“…Some universities already offer comprehensive ISA training programs, but they lack a strategy for persuading students to participate in these programs [16]. ISA training is such an important factor that even public institutions have to plan by job category in order to determine existing awareness gaps and risk levels in each job category [17]. In each institution, whether private or public, the success of the ISA-related training framework will depend on how much the actual program is tailored to the individual employee's or user's needs and perceptions.…”

Botnets in Healthcare: Threats, Vulnerabilities, and Mitigation Strategies

“…Information and Data Security in healthcare is paramount due to the sensitive nature of the data involved and the potential consequences of breaches (Alhuwail et al, 2021). The integrity of computer systems is the primary concern, as the effort is concentrated on maintaining the confidentiality and integrity of the data needed to assess, track, and treat patients.…”

“…While it is essential for IT and security staff to be aware of how to defend the organization from cyber threats, it is also essential that the entire staff, regardless of duty or function, receive security awareness training. Healthcare organizations can facilitate this to improve end user recognition and adoption of concepts from relevant training programs (Alhuwail et al, 2021;Polis, 2023). Alhuwail et al (2021) recommends "targeted bottom-up approach via personalized outreach, in-person contacts, and frequent announcements throughout the workflow" (Alhuwail et al, 2021).…”

“…Healthcare organizations can facilitate this to improve end user recognition and adoption of concepts from relevant training programs (Alhuwail et al, 2021;Polis, 2023). Alhuwail et al (2021) recommends "targeted bottom-up approach via personalized outreach, in-person contacts, and frequent announcements throughout the workflow" (Alhuwail et al, 2021). In conjunction with proper training, devices in the healthcare infrastructure's network should be assessed, updated and/or configured properly prior to being introduced to the overall network, especially over time with regards to software life cycles (Otieno et al, 2023;Phiri, 2023;Harkat et al, 2024;Dadkhah et al, 2024).…”