Cyber-risk in healthcare: Exploring facilitators and barriers to secure behaviour

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Authors

Departments

External departments

  • Fondazione Policlinico Universitario Agostino Gemelli IRCCS
  • 7th HealthCare Region of Crete

Details

Original languageEnglish
Title of host publicationHCI for Cybersecurity, Privacy and Trust
Subtitle of host publicationSecond International Conference, HCI-CPT 2020, Held as Part of the 22nd HCI International Conference, HCII 2020, Copenhagen, Denmark, July 19–24, 2020, Proceedings
EditorsAbbas Moallem
Place of PublicationSwitzerland
PublisherSpringer
Pages105-122
Number of pages19
Volume12210
ISBN (Electronic)9783030503093
ISBN (Print)9783030503086
DOIs
Publication statusPublished - 2020
Event22nd International Conference on Human Computer Interaction - Denmark (now virtual), Denmark
Duration: 19 Jul 202024 Jul 2020
http://2020.hci.international/index.html

Publication series

NameInformation Systems and Applications, incl. Internet/Web, and HCI
PublisherSpringer International Publishing

Conference

Conference22nd International Conference on Human Computer Interaction
Abbreviated titleHCI International 2020
CountryDenmark
Period19/07/2024/07/20
Internet address
Publication type

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

There are increasing concerns relating to cybersecurity of healthcare data and medical devices. Cybersecurity in this sector is particularly important given the criticality of healthcare systems, the impacts of a breach or cyberattack (including in the worst instance, potential physical harm to patients) and the value of healthcare data to criminals. Technology design is important for cybersecurity, but it is also necessary to understand the insecure behaviours prevalent within healthcare. It is vital to identify the drivers behind these behaviours, i.e., why staff may engage in insecure behaviour including their goals and motivations and/or perceived barriers preventing secure behaviour. To achieve this, in-depth interviews with 50 staff were conducted at three healthcare sites, across three countries (Ireland, Italy and Greece). A range of seven insecure behaviours were reported: Poor computer and user account security; Unsafe e-mail use; Use of USBs and personal devices; Remote access and home working; Lack of encryption, backups and updates; Use of connected medical devices; and poor physical security. Thematic analysis revealed four key facilitators of insecure behaviour: Lack of awareness and experience, Shadow working processes, Behaviour prioritisation and Environmental appropriateness. The findings suggest three key barriers to security: i) Security perceived as a barrier to productivity and/or patient care; ii) Poor awareness of consequences of behaviour; and iii) a lack of policies and reinforcement of secure behaviour. Implications for future research are presented.

Download Title (Resource: downloads_chaqrt)

No data available