Information security policies in the UK healthcare sector: a critical evaluation

Abstract

All organisations must take active steps to maintain the security and integrity of their information resources, and nowhere is this strategy more critical than in hospitals where issues of information accuracy and patient confidentiality are paramount. Of all the tools at the information security manager's disposal, none is more widely valued and used than the information security policy. Much research therefore concentrates on the way in which information security policies contribute to the protection of systems from internal and external threats. Such work is legitimate and important, but it often fails to explore alternative views of security and related policies. Against this backdrop, this paper seeks to provide novel insights into the role and purpose of information security policies by reviewing them through a critical theoretical lens. It presents the results of a critical discourse analysis which looked for evidence of ideology and hegemony within a sample of information security policies from the UK's National Health Service. The findings support the contention that an alternative description of information security policies from a critical perspective provides better insights into existing problems than most mainstream work. The paper concludes by discussing the implications of the findings and future research avenues.

Practice-Based Discourse Analysis of InfoSec Policies

“…Another research task is to investigate if any of these criteria are applicable in other business sectors, and if so to what extent. Our quality criteria have, to some extent, similarities with the criteria presented by Stahl et al [8]. If we are to highlight one similarity, both studies stress the importance of using a clear and congruent conceptual framework adapted to the current work practice.…”

“…However, unlike Stahl et al [8] our quality criteria also address the importance of the structure of policy documents. This difference is a result from Stahl et al's [8] choice to limit their study to high-level policies, whereas we studied both high-level and low-level policy documents and their relationships. The criteria presented are all derived from a practicebased perspective.…”

“…However, we found few empirical studies that address the communicative quality of information security policies. One exception is the study by Stahl et al [8] who present six advices on how to design an information security policy, based on a critical discourse analysis of twenty-five information security policies.…”

“…If few studies focus information security policy design, even fewer studies have been carried out on information security policies as communicative objects and what constitutes a useful information security policy from a communicative point of view. Stahl et al [8] is a notable exception, who based on a discourse analysis of information security policies provide six advices for the development of information security policies. Of course, this is a valuable contribution, but according to Baskerville's and Siponen's [4] taxonomy of information security policies, Stahl et al [8] mainly focus on high-level policies.…”

“…Stahl et al [8] is a notable exception, who based on a discourse analysis of information security policies provide six advices for the development of information security policies. Of course, this is a valuable contribution, but according to Baskerville's and Siponen's [4] taxonomy of information security policies, Stahl et al [8] mainly focus on high-level policies. With this focus they seem to leave out the problematic aspect that employees often are exposed to several documents that together constitute the information security policy.…”