Monitoring information security risks within health care

Deursen, Nicole van; Buchanan, William J.; Duff, Alistair S.

doi:10.1016/j.cose.2013.04.005

Cited by 41 publications

(27 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This database can provide some information about past incidents and be used to make decisions about the implementation of the security policy. Organizations with experience and a greater awareness and professionalism in information security report a higher number of incidents, as they appear to be better at identifying and reporting them [30].…”

Section: Reporting Security Incidentsmentioning

confidence: 98%

“…), are protected by authentication credentials, with a password being the method most frequently used at present. A number of empirical password information security studies have been conducted [29,30,34,44,45]. The number of passwords an individual needs has an impact on the security of an information system [29].…”

Section: Related Workmentioning

confidence: 99%

“…Socio-technical-material understandings of e-health implementations allow organizations to address socio-technical risks to the security of healthcare data identified in literature [29]: unattended assets or records going missing, password or access token sharing, the sending of e-mails containing patient data to the wrong addressee, theft on the premises, procedure not followed and wrong privileges set. Collaboration between organizations and experts is necessary to increase knowledge about potential risks [30]. Models on the behavior of individuals as regards practicing secure computing have been proposed in healthcare [31] and validated by surveys [32,33].…”

Section: Related Workmentioning

confidence: 99%

“…The growing use of e-mail communication between providers and patients [38] signifies that it is necessary to confront confidentiality concerns. Incidents which involve e-mails containing patients' personal data being sent to either the wrong recipients and/or to persons who are not authorized to receive that information is a frequent scenario within health care, as identified in a Delphi study [30]. This is not only a confidentiality concern, but is also a record retention/medical legal discovery issue [50].…”

Section: Secure Use Of E-mailmentioning

confidence: 99%

See 3 more Smart Citations

Analysis of health professional security behaviors in a real clinical setting: An empirical study

Fernández-Alemán

Sánchez-Henarejos

Toval

et al. 2015

International Journal of Medical Informatics

View full text Add to dashboard Cite

Section: Reporting Security Incidentsmentioning

confidence: 98%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Secure Use Of E-mailmentioning

confidence: 99%

See 2 more Smart Citations

Analysis of health professional security behaviors in a real clinical setting: An empirical study

Fernández-Alemán

Sánchez-Henarejos

Toval

et al. 2015

International Journal of Medical Informatics

View full text Add to dashboard Cite

“…A previous publication described how the method was developed by means of a survey and a three-round Delphi study (Van Deursen, Buchanan, & Duff, 2013). That development stage produced an information security risk forecast.…”

Section: Introductionmentioning

confidence: 99%

HI-risk: A method to analyse health information risk intelligence

Buchanan

Deursen

2016

2016 IEEE 18th International Conference on E-Health Networking, Applications and Services (Healthcom)

Self Cite

View full text Add to dashboard Cite

Abstract-Information security threat intelligence is a prevalent topic amongst researchers, long-established IT-vendors and start-ups. The possibilities of big-data analytics to security threat and vulnerability scanning offer a phenomenal development in the protection of infrastructures. At the same time, industry research reports continue to state that the main contributing factor in the events leading to a data breach is human error. The common response of information security professionals is to resort to technological solutions to prevent these human errors. However, some very important information security intelligence is not hidden within the network traffic: it's available from the people that work with sensitive information. This article describes the Health Information risk (HI-risk) method to identify non-technical information security risks in healthcare. The method includes risks related to skills, behaviour, processes, organisational culture, physical security, and external influences. HI-risk offers a solution to collect intelligence about non-technical information security incidents from across the healthcare sector to demonstrate past trends and to be ahead of future incidents. A test of a HI-risk forecast proved the feasibility of this approach in healthcare and beyond. It is suggested that HI-risk could become a valuable addition to existing technical threat and vulnerability monitoring tools.

show abstract

A Linguistic Approach to Information Security Awareness Education in a Healthcare Environment

Drevin

Kruger

Bell

et al. 2017

Information Security Education for a Global Digital Society

View full text Add to dashboard Cite

It is widely accepted that healthcare information security is extremely important and that security breaches will have serious consequences in many areas. Despite controls, such as legal frameworks, as well as ongoing research projects into healthcare information security and privacy, there is still an alarming number of healthcare information security breaches reported annually. In this paper, a linguistic approach, utilizing a vocabulary test, is proposed as a tool to determine security awareness levels of healthcare workers and to assist in educating them in security awareness aspects. A vocabulary-measuring instrument was developed and distributed to healthcare workers in a large South African hospital group. Results indicated that information security awareness levels are generally acceptable, but that potential problem areas exist between certain language groups, as well as between different business functions (departments). The study also shows that the proposed approach may offer significant advantages in information security awareness campaigns.

show abstract

Monitoring information security risks within health care

Cited by 41 publications

References 20 publications

Analysis of health professional security behaviors in a real clinical setting: An empirical study

Analysis of health professional security behaviors in a real clinical setting: An empirical study

HI-risk: A method to analyse health information risk intelligence

A Linguistic Approach to Information Security Awareness Education in a Healthcare Environment

Contact Info

Product

Resources

About