Perceived security of BYOD devices in medical institutions

Like other computing devices mobile devices have inherent security risks. With today's wider use of mobile devices in medical institutions, particularly the practice of 'bring-your-own-device' (BYOD), the risk of medical data breaches is concerning.

To investigate security risk perception and safeguard adoption of mobile devices among medical practitioners and IT administrators. Furthermore, to comprehend the perceived costs that practitioners feel these safeguards impose on them.

We conducted both quantitative and qualitative studies investigating whether age, gender and occupation have an impact on the perceived security of patient information and the behavior intentions formed when adopting BYOD. In the quantitative component, a survey was completed by 264 healthcare practitioners from three hospitals and affiliated clinics in New York City. In the qualitative component, we interviewed 36 of 264 subjects from the first study, including twelve physicians, twelve nurses, and twelve IT administrators. All participants had direct experience with BYOD devices. The length of each interview averaged forty-five minutes to an hour.

We found that physicians have a significantly higher intent to comply with safeguards, compared to nurses. IT administrators prefer an encrypted network connection and Two Factor Authentication (2FA), or a biometric authentication method for accessing Electronic Medical records (EMR). All medical practitioners believe that the biggest threat to the security of medical information is theft or misplacement of the device. Physicians and IT administrators have a better understanding of malware and Wi-Fi threats than nurses.

This research provides valuable data regarding the healthcare practitioner's safeguard cost, attitudes and intended behaviors regarding the risks and use of mobile devices in healthcare. By understanding a user's perceptions, we can be better aware of how to educate healthcare practitioners, and how to develop policies that will reduce costs and achieve better productivity. We can also see how these processes may be improved by accessing patient information faster and by designing technology more effectively.