The health information system security threat lifecycle: an informatics theory

Area of Science:

• Health Informatics
• Information Security
• Clinical Practice

Background:

• Clinicians face challenges with health information system (HIS) privacy and security (P&S).
• Understanding the lifecycle of security threats in healthcare is crucial for effective P&S.
• Existing research lacks a comprehensive theory for HIS security threat lifecycles.

Purpose of the Study:

• To describe the health information system security threat lifecycle (HISSTL) theory.
• To analyze clinicians' experiences with HIS privacy and security in practice settings.

Main Methods:

• A qualitative study using the 'questerview' technique with 26 clinicians across 3 Australian teaching hospitals.
• Analysis involved iterative scrutiny of interview transcripts using Nvivo to identify emergent themes.

Main Results:

• Identified issues include inadequate training, ambiguous legal frameworks, productivity challenges, usability errors, and limitations of the natural hospital environment.
• The natural hospital environment is characterized by e-HIS permanence, shared workspaces, outdated infrastructure, and constant interruptions.
• P&S implementation's obtrusiveness, timeliness, and reliability influenced clinician attitudes and e-HIS use.

Conclusions:

• The HISSTL theory emerged, incorporating environmental factors (fiscal, regulatory, natural) that impede P&S.
• Clinician efforts to prioritize patient care over P&S can lead to security breaches, perpetuating threats.
• Addressing HIS security requires considering environmental factors and their impact on P&S implementations and patient care.