Cyber Hygiene Methodology for Raising Cybersecurity and Data Privacy Awareness in Health Care Organizations: Concept...

Area of Science:

• Cybersecurity
• Healthcare Management
• Information Science

Background:

• Healthcare organizations face increasing cyber threats, with human factors being the weakest link.
• Existing guidelines for human-centric cybersecurity lack specific, measurable interventions.
• A need exists for structured methodologies to select effective cybersecurity controls for healthcare workforces.

Purpose of the Study:

• To introduce a cyber hygiene (CH) methodology using a survey-based risk assessment.
• To raise cybersecurity and data privacy awareness among diverse employee groups in healthcare organizations (HOs).
• To identify optimal strategies and recommend tailored, human-centric controls for managing organization-specific risks.

Main Methods:

• A cross-sectional, exploratory survey study was conducted across 3 European HOs.
• Data were collected from 4 employee groups, covering 7 cybersecurity and data privacy risk categories.
• A risk-based matrix approach analyzed survey data to map risks to management strategies and controls.

Main Results:

• Human-centric controls were identified and mapped to specific risk categories and management strategies.
• The methodology enabled the computation and recommendation of control subsets for overall risk management.
• Results included risk assessments, management strategies, and recommended controls for HOs, employee groups, and risk categories.

Conclusions:

• The proposed CH methodology enhances cybersecurity and data privacy awareness and behavior in healthcare personnel.
• It provides actionable risk management strategies and a curated list of human-centric controls.
• The approach effectively addresses a wide spectrum of cybersecurity and data privacy risks pertinent to healthcare employees.