Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

Abstract

This study aims to review the literature on antecedent factors of information security related to the protection of health information systems (HISs) in the healthcare organization. We classify those factors into organizational and individual aspects. We followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework. Academic articles were sourced from five online databases (Scopus, PubMed, IEEE, ScienceDirect, and SAGE) using keywords related to information security, behavior, and healthcare facilities. The search yielded 35 studies, in which the three most frequent individual factors were self-efficacy, perceived severity, and attitudes, while the three most frequent organizational factors were management support, cues to action, and organizational culture. Individual factors for patients and medical students are still understudied, as are the organizational factors of academic healthcare facilities. More individual factors have been found to significantly influence security behavior. Previous studies have been dominated by the security compliance behavior of clinical and non-clinical hospital staff. These research gaps highlight the theoretical implications of this study. This study provides insight for managers of healthcare facilities and governments to consider individual factors in establishing information security policies and programs for improving security behavior.

Ensuring Corporate Security and Its Strategic Communication in Healthcare Institutions in Slovenia

“…There are numerous opportunities for data theft, so the need for a strong cybersecurity function in healthcare organizations is greater than ever [29]. The implementation of health information systems into the corporate system by healthcare providers has a positive value for managing health information but also has negative impacts, such as security and privacy risks, and therefore needs to be implemented as part of corporate security to ensure all levels of security [31].…”

How Information Security Management Systems Influence the Healthcare Professionals’ Security Behavior in a Public Hospital in Indonesia

“…Another theoretical underpinning, such as Regulatory Focus Theory (RFT), can be used to compare preventive and promotion motivation to influence desirable security behavior. RFT has never been employed in studies of information security behavior in healthcare organizations (Sari et al, 2022). Previous studies utilizing this theory in contexts other than healthcare have found that promotion-focused and prevention-focused approaches can directly influence information security behavior preferences (Shih et al, 2021) or indirectly (Burns, 2021;Hwang & Cha, 2018).…”

“…Other researchers have looked at a variety of factors that influence compliance behavior with organizational security policies (Foth et al, 2012;Pathania & Rasool, 2019;Sher et al, 2017), information security regulations (Brady, 2011;Foth, 2016;Johnston & Warkentin, 2008), and information security standards (Alexandrou & Chen, 2019;Fernández-Alemán et al, 2015). According to the outcomes of a systematic literature review (Sari et al, 2022), previous studies in information security behavior in the healthcare context typically employ theoretical foundations such as Protection Motivation Theory (PMT) and General Deterrence Theory (GDT) in conjunction with other theories such as Theory of Planned Behavior (TPB), Theory of Acceptance Model (TAM), Social Cognitive Theory (SCT), Rational Choice Theory (RCT), and many others. However, these theories have been used to investigate healthcare staff 's security behavior in developed countries.…”