Theory-Based Model and Prediction Analysis of Information Security Compliance Behavior in the Saudi Healthcare Sector

A scoping review of the drivers and barriers influencing healthcare professionals' behavioral intentions to comply with electronic health record data privacy policy

Objective: Electronic Health Records (EHRs) are now an integral part of health systems in middle and high-income countries despite recognized deficits in the digital competencies of Healthcare Professionals (HCPs). Therefore, we undertook a scoping review of factors influencing compliance with EHR data privacy policies. Methods: Seven databases revealed 27 relevant studies, covering a range of countries, professional groups, and research methods. The diverse nature of these factors meant that 18 separate theoretical frameworks representing technology-acceptance to behavioral psychology were used to interpret these. Results: The predominant factors influencing compliance with EHR data privacy policies included confidence and competence to comply, perceived ease of use, facilitatory environmental factors, perceived usefulness, fear that non-compliance would be detected and/or punished and the expectations of others. Conclusion: Human factors such as attitudes, social pressure, confidence, and perceived usefulness are as important as technical factors and must be addressed to improve compliance.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

This study aims to review the literature on antecedent factors of information security related to the protection of health information systems (HISs) in the healthcare organization. We classify those factors into organizational and individual aspects. We followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework. Academic articles were sourced from five online databases (Scopus, PubMed, IEEE, ScienceDirect, and SAGE) using keywords related to information security, behavior, and healthcare facilities. The search yielded 35 studies, in which the three most frequent individual factors were self-efficacy, perceived severity, and attitudes, while the three most frequent organizational factors were management support, cues to action, and organizational culture. Individual factors for patients and medical students are still understudied, as are the organizational factors of academic healthcare facilities. More individual factors have been found to significantly influence security behavior. Previous studies have been dominated by the security compliance behavior of clinical and non-clinical hospital staff. These research gaps highlight the theoretical implications of this study. This study provides insight for managers of healthcare facilities and governments to consider individual factors in establishing information security policies and programs for improving security behavior.

Patient Confidentiality of Electronic Health Records: A Recent Review of the Saudi Literature

Background

Health systems harbor lucrative data that can be targeted for illegal access, thus posing a serious privacy breach. In addition, patients could lose their lives or suffer permanent and irreversible harm due to such unauthorized access to health care data used in treatment. To ensure patient safety, the health care sector must integrate cybersecurity into its operations. Additionally, the health care industry must collaborate to tackle cybercrime and prevent unauthorized access to patient data. With the rapid transition from paper-based health records to electronic health records (EHRs), it is important to study, identify, and address the challenges that confront EHRs to protect patient confidentiality.

Aim

The main goal of this research was to create a clear picture of the role of EHRs in the health care system of Saudi Arabia regarding patient confidentiality. This work focused on the privacy and confidentiality challenges encountered in adopting EHRs in the health care system, and the advantages of using EHRs in terms of protecting patient confidentiality.

Methods

This project utilized a systematic literature review approach, and the methodology involved a careful critique of 11 recent articles.

Results

The confidentiality and privacy of patient data and information must be ensured, because the health care sector in Saudi Arabia is flawed with several security risks that may corrupt the integrity of patient data. The health care system is facing many cybercrimes whereby hackers can gain access to confidential data and patient information. Internal factors such as inexperienced medical personnel have also necessitated EHRs in Saudi Arabia. Health care workers who lack the appropriate skills in handling EHRs may cause breaches of patient data, which in turn may compromise the health and safety of the patients.

Conclusion

Confidentiality and privacy are critical components of a reliable EHR system. EHR confidentiality has a significant impact on maintaining patient safety and security, thus enhancing patient care in Saudi Arabia. Additionally, challenges such as hackers and data breaches have slowed the adoption process among health care companies in Saudi Arabia.

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

A grave concern to an organization’s information security is employees’ behavior when they do not value information security policy compliance (ISPC). Most ISPC studies evaluate compliance and noncompliance behaviors separately. However, the literature lacks a comprehensive understanding of the factors that transform the employees’ behavior from noncompliance to compliance. Therefore, we conducted a systematic literature review (SLR), highlighting the studies done concerning information security behavior (ISB) towards ISPC in multiple settings: research frameworks, research designs, and research methodologies over the last decade. We found that ISPC research focused more on compliance behaviors than noncompliance behaviors. Value conflicts, security-related stress, and neutralization, among many other factors, provided significant evidence towards noncompliance. At the same time, internal/external and protection motivations proved positively significant towards compliance behaviors. Employees perceive internal and external motivations from their social circle, management behaviors, and organizational culture to adopt security-aware behaviors. Deterrence techniques, management behaviors, culture, and information security awareness play a vital role in transforming employees’ noncompliance into compliance behaviors. This SLR’s motivation is to synthesize the literature on ISPC and ISB, identifying the behavioral transformation process from noncompliance to compliance. This SLR contributes to information system security literature by providing a behavior transformation process model based on the existing ISPC literature.

The Effect of Organizational Information Security Climate on Information Security Policy Compliance: The Mediating Effect of Social Bonding towards Healthcare Nurses

The advancement of information communication technology in healthcare institutions has increased information security breaches. Scholars and industry practitioners have reported that most security breaches are due to negligence towards organizational information security policy compliance (ISPC) by healthcare employees such as nurses. There is, however, a lack of understanding of the factors that ensure ISPC among nurses, especially in developing countries such as Malaysia. This paper develops and examines a research framework that draws upon the factors of organizational climate of information security (OCIS) and social bond theory to enhance ISPC among nurses. A questionnaire was adopted in which responses were obtained from 241 nurses employed in 30 hospitals in Malaysia. The findings from the study demonstrated that the ISPC among nurses is enhanced through OCIS factors. The influence on ISPC was even more significant when examined by the mediating effect of the social bond. It implies that influential OCIS factors reinforce social bonds among nurses and eventually increase the ISPC. For information security practitioners, the study findings emphasize the prevalence of socio-active information security culture in healthcare organizations to enhance ISP compliance among nurses.