BYOD security behaviour and preferences among hospital clinicians - A qualitative study

Area of Science:

• Health Informatics
• Cybersecurity in Healthcare
• Human-Computer Interaction

Background:

• The adoption of Bring-your-own-device (BYOD) in hospitals enhances clinician productivity and mobility.
• However, BYOD poses significant challenges to patient data privacy and security due to increased risk of information leakage.
• Empirical research on clinicians' BYOD security behaviors remains limited.

Purpose of the Study:

• To qualitatively explore clinicians' attitudes and preferences regarding the protection of patient data on their personal devices used for work.
• To understand the socio-technical factors influencing clinicians' BYOD security practices in hospital settings.

Main Methods:

• Conducted 14 semi-structured interviews with Australian hospital-based clinicians.
• Employed a hybrid thematic analysis using the framework method to examine BYOD security behaviors.

Main Results:

• Clinicians demonstrated limited use of security tools (e.g., antivirus, passcodes) and inadequate data separation on BYOD devices.
• Concerns included malware risks, inadvertent data sharing, and remote access issues.
• Hospitals lacked effective BYOD policies, training, and a strong cybersecurity culture, leading to unsafe practices.

Conclusions:

• The study offers insights into clinician BYOD user behavior and the efficacy of security controls in complex healthcare environments.
• Findings can guide the development of future policies and processes to promote secure and productive BYOD implementation.
• Recommendations include improved communication and fostering a robust cybersecurity culture within hospitals.