Securing ePHI--can clinicians and IT ever agree?

Area of Science:

• Health Informatics
• Information Security Management
• Organizational Behavior

Background:

• The Health Insurance Portability and Accountability Act (HIPAA) mandates robust security standards for Electronic Protected Health Information (EPHI).
• Effective HIPAA implementation necessitates cooperation and shared understanding among clinical staff, IT professionals, and providers.
• Existing research often overlooks the nuanced perceptions of security standards among different healthcare roles.

Purpose of the Study:

• To investigate the divergent perspectives on HIPAA security standards among healthcare professionals.
• To assess the ability of participants to predict their colleagues' views on EPHI security.
• To identify factors influencing successful adaptation to security-related workflow changes.

Main Methods:

• Employed two Q-sort sessions with distinct Conditions of Instruction (COI) involving healthcare professionals.
• COI 1: Participants evaluated security standards from a personal perspective on mitigating EPHI security issues.
• COI 2: Participants estimated their co-workers' perspectives on salient aspects of EPHI security problems.

Main Results:

• The initial Q-sort revealed four distinct factors, with 'administratively minded' and 'patient-centric' indicating significant opinion divergence.
• The second Q-sort demonstrated participants' difficulty in accurately forecasting their colleagues' perceptions of security concerns.
• A notable finding suggests that role-based situational descriptions can facilitate adaptation to new security application workflows.

Conclusions:

• Healthcare professionals hold varied viewpoints regarding HIPAA security effectiveness.
• Misaligned perceptions of security priorities exist among co-workers, potentially hindering collaborative security efforts.
• Tailoring communication of security changes to specific roles and workflows is essential for successful HIPAA compliance and adaptation.