Exploring Information Security Compliant Behaviors in Healthcare Knowledge Process Outsourcing (KPOs)

doi:10.21203/rs.3.rs-3405972/v1

Download PDF

Research Article

Exploring Information Security Compliant Behaviors in Healthcare Knowledge Process Outsourcing (KPOs)

https://doi.org/10.21203/rs.3.rs-3405972/v1

This work is licensed under a CC BY 4.0 License

You are reading this latest preprint version

The healthcare industry increasingly relies on Knowledge Process Outsourcing (KPO) to handle vast amounts of sensitive patient data. This study investigates information security compliance in healthcare KPOs to protect patient privacy and data integrity. Employing a qualitative approach, it analyzes existing security policies, revealing the current state of information security in these organizations and factors influencing compliance.

Key themes include employee training, technology, regulatory adherence, and organizational culture. The study uncovers the intricate relationships between these factors and their role in mitigating security risks. Additionally, the research aims to identify best practices to enhance information security compliance in healthcare KPOs. The findings benefit KPO leaders, healthcare providers, and policymakers, enhancing patient data confidentiality while optimizing KPO benefits in healthcare.

By contributing insights into information security compliance in healthcare KPOs, this study also enriches discussions on safeguarding sensitive data amid evolving threats and regulations, bolstering trust in healthcare KPO operations.

Information Security

Healthcare KPO

Security Compliant

The healthcare industry, central to healthcare provision, increasingly relies on information technology, adopting electronic patient records and clinical information systems, alongside intranets for health information dissemination [1]. This integration of information and communication technologies (ICT) has given rise to Healthcare Information Systems (HIS), pivotal for enhancing healthcare quality and reducing costs [2]. Nevertheless, these systems face inherent risks, with significant impacts on healthcare information systems from various threat categories, both internal and external [3]. Addressing these challenges necessitates attention to information security issues, encompassing costs, management concerns, trust, security policies, and awareness [4], [5].

Healthcare management plays a crucial role in promoting security awareness, implementing security policies, fostering trust among stakeholders, ensuring consistent outcomes, and facilitating compliance with laws and regulations. The implementation of a robust security policy in healthcare is essential for transmitting sensitive data over the internet. Privacy in healthcare information sharing adheres to common principles, as identified by Suhaila et al. [6]. The evolving healthcare landscape underscores the need for a system of accountability to prevent information sharing misuse in general health scenarios [7].

In the Revenue Cycle Management (RCM) process, gathering data during registration, determining insurance coverage, and accurate claim coding are pivotal. Seamless integration with Electronic Health Records (EHR) and accounting systems is critical for streamlining billing and collection [8]. Healthcare Knowledge Process Outsourcing (KPO) organizations play a vital role in facilitating insurance reimbursement for providers, with their income tied to a percentage commission based on generated revenue [8]. Given their multi-provider responsibilities, understanding the factors influencing compliance culture in information security is imperative for these organizations.

This study pursues a dual objective. Firstly, it seeks to identify the determinants influencing the compliance culture within healthcare KPO organizations concerning information security. By comprehensively elucidating these factors, the research aims to shed light on the influences shaping security compliance behavior within healthcare KPOs. Secondly, the study also delves into the current information security challenges specific to healthcare KPOs.

This study aims to investigate the interrelationships among various factors pertaining to information security compliance in Sri Lankan healthcare Knowledge Process Outsourcing (KPO) organizations. The following hypotheses will be examined:

H1: Sri Lankan healthcare KPOs demonstrate a positive correlation with compliance under the Health Insurance Portability and Accountability Act (HIPAA) and other relevant compliance measures.

H2: The level of information security compliance in Sri Lankan healthcare KPOs is positively associated with the adoption of health information systems within these organizations.

H3: Compliance with information security requisites in healthcare KPOs in Sri Lanka shows a positive correlation with specific security measures, such as data encryption, access controls, and incident response protocols.

H4: Active engagement of management in healthcare KPOs in Sri Lanka is positively linked to information security compliance.

H5: The effectiveness of organizational systems within Sri Lankan healthcare KPOs exhibits a positive correlation with information security compliance.

H6: Compliance with information security guidelines in Sri Lanka's healthcare KPO sector is positively correlated with the level of information security awareness and training programs within these organizations.

Through these examinations, this study endeavors to offer valuable insights into the factors that affect information security compliance in the Sri Lankan healthcare KPO sector. The findings promise to enrich the understanding of how these organizations can effectively ensure compliance, elevate information security practices, and raise awareness among stakeholders involved in healthcare information management. This research holds significant import for healthcare organizations and practitioners, equipping them to gain a competitive edge by comprehending the pivotal factors that mold compliance culture in healthcare information security.

The findings will furnish valuable insights and recommendations for enhancing security compliance culture within healthcare KPOs. Additionally, this study fills a notable research gap, as no similar investigations on healthcare compliance behavior in Sri Lanka have been conducted, rendering it an indispensable reference for future scholars and researchers in the country. Ultimately, this research contributes to the advancement of knowledge in the realm of healthcare security compliance.

This literature review explores key facets of information security within healthcare Knowledge Process Outsourcing (KPOs) in Sri Lanka. It underscores the significance of adhering to healthcare standards, notably the HIPAA Act, as a foundational requirement for KPOs. Health Information Systems (HIS) are delineated as central to capturing, storing, managing, and transmitting health data. The review delves into essential security considerations, encompassing physical security, site maintenance, audits, and controls, as pivotal components of compliance. The engagement of management is emphasized for cultivating a culture of compliance and allocating resources to bolster security. The organizational framework emerges as a significant influencer shaping information security culture within KPOs. Finally, the review underscores the importance of promoting awareness regarding information security threats and breaches. This concise summary provides a comprehensive overview of the interconnected elements in the context of information security within healthcare KPOs in Sri Lanka.

A. Information Security Issues in Healthcare

According to Apar et al [4] a variety of challenges need to be resolved in order to enhance healthcare information security. Healthcare technology provides many benefits, but it also carries a significant risk to information confidentiality. It is true that health information systems come with many advantages and risks at the same time. According to SO/IEC 27002 (ISO 27799:2008), there were 22 threat categories identified in Malaysia that had a significant impact on healthcare information systems [3].

Healthcare information security issues include costs associated with implementing IT security, manager issues, trust, security policies, and awareness of IT security, according to Noor and Zuraini [5]. In addition to promoting information security awareness, management is responsible for ensuring it is implemented. Numerous studies have promoted security awareness [9], [10]. There is a crucial relationship between organizations based on trust. Consequently, trust between internal and external stakeholders increases, results are more consistent, and law and regulation compliance are easier. By implementing the Security Policy in Healthcare, it is ensured that the use of the Internet to transmit sensitive data meets the policy's requirements. As part of observing security policies in the healthcare environment, Suhaila et al. [11] identified seven principles common to maintaining information privacy. As healthcare evolves, information sharing can change the way services are provided. A system of accountability can help ensure that information sharing exchanges in general health scenarios are not misused, as suggested by Gajanayake et al. [12].

B. Healthcare standards

Protection of information during processing, particularly in healthcare contexts, is imperative [13], as evidenced by legislative mandates that rigorously safeguard client data. Various laws, such as the Family Education Rights and Privacy Act, the Fair Credit Reporting Act, and the Children's Online Privacy Protection Act, underscore the importance of privacy protection in the United States and beyond [14]. New Zealand's Health Information Privacy Code is a significant piece of legislation, guiding health information protection. International standards, such as ISO 17799 and AS/NZS ISO/IEC 17799, have influenced compliance standards in New Zealand and Australia [14]. Health Canada Privacy Act also provides compliance standard guidelines [15], while Europe and Asia adopt similar privacy laws to the United States.

In the context of healthcare Knowledge Process Outsourcing (KPOs), which are predominantly based in the USA, this research focuses on HIPAA compliance, a pivotal law [16]. The Healthcare Insurance Portability and Accountability Act (HIPAA) encompasses provisions for privacy and security, safeguarding medical patient confidentiality [15]. Achieving HIPAA compliance necessitates investments in information systems, organizational policies, and partnership agreements [17]. While it is estimated that HIPAA compliance will cost the healthcare industry $18 billion, it is expected to yield $30 billion in administrative savings [16]. Enacted in 1996, HIPAA introduced a tiered system of civil penalties through the American Recovery and Reinvestment Act of 2009 (ARRA) [97], enhancing consistency in handling HIPAA violations. Healthcare providers have embraced HIPAA compliance through computer security guidelines, patient consent forms, and training programs [17].

C. Healthcare Information Systems

Information technology and the internet have transformed access to a vast array of information sources, becoming a pivotal information hub [18] [19] [20]. This transformation extends to medical professionals, facilitated by the widespread use of mobile devices like smartphones, tablets, and iPads, which provide access to medical records. The internet's evolution into a data-centric environment [21] has driven a profound shift in healthcare services. This transformation encompasses remote health monitoring, online consultations, e-prescriptions, e-clinical trials, patient data accessibility, and asset tracking [22], delivering substantial benefits to all stakeholders.

Electronic Patient Records (EPR) systems offer instant access to patient demographics, medical histories, lab results, and images for healthcare providers and workers. However, EPR adoption remains limited, necessitating a distinction between EPRs within a single healthcare organization and Electronic Health Records (EHR) shared among multiple providers [23] [24]. While healthcare records exist in both paper and electronic formats (EMRs), EHRs integrate them to enhance care quality [25].

EHRs encompass various components, including appointment management, admissions, discharges, prescription records, dietary supplement tracking, picture archiving, and smart card authentication. Decision-making in healthcare relies on health information systems that generate, compile, analyze, synthesize, communicate, and utilize data. These systems typically consist of EHR systems or a collection of such systems, analyzing data from the health sector and other relevant fields to inform healthcare decisions [26] [27].

The healthcare ecosystem relies heavily on healthcare organizations and professionals. Healthcare Information Systems facilitate electronic communication among all stakeholders, standardize diagnostic data, and maintain context while enabling new interpretations [25]. Interoperability in healthcare information systems, achieved through Reference Information Models (RIMs) and agreed vocabularies, is supported by a generic component model developed in the mid-nineties [27]. Open EHRs and the Health Level Seven Version model (HL7) integrate into comprehensive models to manage existing structures, features, and terminology, aligning with European Committee for Normalization standards (CEN).

Recognizing the critical role of information system security [28] [29], healthcare information systems must prioritize addressing privacy and security concerns to gain societal acceptance. These systems confront a spectrum of threats, both internal and external, including viruses, worms, keyloggers, and insider attacks [30]. Intrusions into IT infrastructure, whether internal or external, pose risks, with denial-of-service attacks standing out as significant threats [31]. Cybersecurity incidents, exemplified by the 2014 HealthCare.gov breach, underscore the imperative of resilient systems [32]. Hardware and software failures further compound security vulnerabilities [33].

Numerous studies identify diverse health information system threats, emphasizing issues like power, network, system, and software failures [34]. Human factors contribute to high-risk threats. Research findings coalesce into five primary threat categories: power loss, human error, technological obsolescence, hardware failure, and software issues. Addressing these security challenges entails deploying technological solutions such as encryption, firewalls, and access management systems [35].

D. Management Contributions

There is no way to treat security as an add-on component. In their article [5], Noor and Zuraini emphasize the importance of security. Management must understand the importance of security in order to achieve organizational goals and objectives. An integral part of governance should be security awareness. Safety awareness has been advocated by many researchers [9], [10]. By supporting security enhancements through change management and authorizing actions aimed at strengthening security, organizations can enhance security and reliability in their working environments [5], as well as reduce the gap between the current security compliance level and the required level. It is stated in an article by Knapp, Marshall, Rainer et al. [36] that most organizations do not incorporate information security into their daily operations. A suitable security culture within the organization should be established based on the motivation of employees by management.

A greater amount of money was spent on implementing information security. Higher management has a problem providing sufficient budgets. Getting top management support for computer security functions may be difficult for Keefe [37]. Organizations are less likely to adopt security functions after experiencing a loss from security initiatives, according to Straub's [38] argument. Organizations consider security spending a cost, according to Shedden et al. [39]. According to Ong et al. [40], most companies do not believe that security threats are worth investing in or would negatively impact efficiency and productivity. Several healthcare organizations have paid enormous amounts of money to settle potential security violations under HIPAA and other security compliance standards (U.S. Department of Health and Human Services). It is clear from these examples that management needs to open its eyes.

Moreover, Fitzgerald [41] stated that organizations' views on information security can be categorized into three categories depending on their organizational culture: high, moderate, and low. As a result of these categories, it is evident that management has made a significant contribution to providing a more robust information security culture. The categories are briefly 1. The system of managing information security is regarded by the executive management as important as making sure the computer is running. 2. The creation of policies for information security may occur, but the enforcement of these policies is poor, and 3. IT budgets and IT support budgets usually include information security as part of their budgets. The management involvement between information security and organizational culture was further explained by Joo et al. [42].

E. Organisation System

In an organization, people are organized, structured, and managed in order to achieve collective goals. Every organized human activity, including the creation of a pot, the placement of a man on the moon, and every organized activity in between, is characterized by the existence of two fundamental and opposing elements: the division of labor into different tasks, and the coordination of those tasks to ensure the success of the task [43]. According to Schein [44], "organizational culture determines how employees perceive the organization. It has been found by a number of researchers that the ability to understand organizational systems and culture is crucial for the successful implementation of IT-based information systems [45], [46]. Security Culture can be defined as the integration of information protection into day-to-day operations, as determined by Bélanger and Robert et al. [46]. Despite the fact that research indicates that primary care medical practices do not take adequate security measures to protect the patient information, it is evident that they are concerned about the security of patient information despite the fact that research indicates that they are concerned about the security of patient information. [47]. There has long been researched that suggests that technologies play a part in some security challenges, but a greater impact is exerted by processes and people, commonly referred to as organizational factors, on security applications [48].

In medical practices, the trusty environment further complicates security practices by affecting the formation and implementation of the security policy [49]. Organizational culture can impact the security of information both negatively and positively. It is vital that the organization has a positive attitude toward information security, according to [63]. Zakaria, et al. [50] and Vroom et al. [51], studies yielded the same results. There is no doubt that information security culture should be embedded into organizational activities, according to Von Soloms [52].

Organizations sometimes face cultural obstacles when adopting an Information Security Culture. New technologies and systems could be affected significantly by a country's national culture. In their study, Sengun and Janell [53] concluded that cultural factors play a significant role in product acceptance. Hofstede's [54] national culture model can help us to better understand the culture of information security. The Hofstede framework [54] suggests that there are five dimensions to a national culture that can be considered. As the following table indicates, the first factor is power distance, the second factor is uncertainty avoidance, the third factor is individualism, the fourth factor is masculinity, and the fifth factor is a long- term focus. In accordance with Hofstede's [54] model of security culture, Alnatheer and Nelson, [55] proposed a framework for analyzing the implementation and adoption of security culture in accordance with this framework of security compliance.

There is a chance of creating new revenue opportunities. They believe that the use of blockchain can reduce around $100 million spent each year on clearing and settlement fees for the brokers as well as make millions of dollars in cost savings for ASX. The reason is because the system does not need market participants to reconcile their databases with those held by the exchange, various custodians and brokers. By analysing above findings and suggestions, it can be concluded that there are gaps in practical use of disruptive technologies in accounting in areas such as superannuation payment system, payroll compliance, budgeting, taxation and some of the auditing tasks to solve many re-occurring issues.

F. Information Security Awareness

Information security is undeniably a critical societal concern, as emphasized by Mensch and Wikie [56], corroborated by Okenyi and Owens [57], and discussed by Ku et al. [58] in the context of enabling businesses and nations to function effectively. Alarmingly, a survey of 450 IT directors and information security officers revealed that less than half of employees receive training on information security awareness [59], exposing a significant gap in preparedness.

Luo and Liao [60] aptly point out that cybercriminals are outpacing technological advancements, making it increasingly challenging to pinpoint the location of attackers [61]. Consequently, information security has transcended borders and become a global imperative, prompting many countries to enact national-level security policies. Examples include the UAE's recognition of the need for security awareness in higher education [62], Taiwan's national policy on information security [58], the United Kingdom's focus on phishing education [64], and South Africa's commitment to information security education [65].

Effective security education policies are deemed the solution to mitigate security breaches, as noted by Kieke [66], and the importance of consistently reminding users about security concerns cannot be overstated [67]. Doge et al. [68] emphasize that organizations must elevate user security awareness and provide education and training. Siponen [69] highlighted this need back in 2000, and subsequent studies have underscored the importance of security awareness training, encompassing policies, procedures, and tools [58], [70], [67]. The efficacy of a security policy hinges on users' understanding and acceptance of its requirements [71].

To combat information system misuse, researchers argue for security education, training, and awareness [71], [72], [73] with ongoing efforts proven effective in deterring misuse attempts through instruction on correct and incorrect information system usage [74]. Furnell et al. advocate diverse organizational training approaches, including information awareness programs, to enhance daily security within organizations.

Furthermore, a training and awareness program on information security empowers organizations to hold employees accountable for any information system misuse, ensuring appropriate consequences, as outlined by Whiteman and Mattord [71]. Research by Hovav and De'Arcy [10] and Kruger et al. [9] demonstrates a clear correlation between information security threat awareness and the development of an information security culture.

This study employs a quantitative research methodology. Data collection involves the use of an online survey questionnaire distributed to senior IT employees within the Sri Lankan healthcare sector. The research aims to assess the compliance of healthcare Knowledge Process Outsourcing (KPO) firms in Sri Lanka concerning information security. To achieve this, health practitioners working in Sri Lankan KPOs are asked to complete a Likert scale survey. The survey questionnaire incorporates both established instruments from the conceptual framework and adapted versions of existing tools.

The research survey results are analyzed using IBM SPSS statistical software. Given the ordinal nature of the survey data, the Spearman Correlation analysis method is applied to the dataset comprising 107 participants. It is worth noting that some surveys have been subjected to Pearson Correlation Analysis, ensuring the appropriate use of both methods, as documented in the table. The results of the analysis are presented, highlighting Spearman's correlation coefficient.

The primary units of analysis in this survey are healthcare KPOs involved in healthcare information systems and individuals in managerial positions with a comprehensive understanding of these systems. Additionally, healthcare IT professionals in managerial roles with substantial knowledge of these systems are considered key units of analysis.

Sri Lanka's healthcare KPO sector boasts a workforce of approximately 800 employees. To align with the research survey criteria, convenience sampling is employed to select 153 respondents from five healthcare KPOs out of the overall population of 150 individuals. According to Morgan's sampling table, 108 samples are recommended for a population of 150. The study conducted surveys among 136 selected employees, yielding somewhat mixed results.

IBM SPSS statistical software was used to analyze the research survey results. Based on the ordinal type of survey data, the Spearman Correlation analysis method is used to analyze the 107 participants in total. It is important to note that some surveys have been analyzed using Pearson Correlation Analysis. So, the proper use of both methods was done in the Table 1.

A. Correlation Analysis

Table 1

Analysis of Spearman/Pearson correlations
Variables	Spearman’s Correlation		Pearson Correlation
Variables	Significant level	Correlation	Significant level	Correlation
Healthcare Standards and Information Security Compliance in helathcare	.145	− .142	.093	− .163
Helathcare Information Systems and Information Security Compliances in helathcare	.001	.255*	.001	.253*
Security Requirments and Information Security Complinace in helathcare	.001	− .288	.055	− .244
Management Involvement and Information Security Complinace in helathcare	.005	− .233	.073	-1.74
Organisational System and Information Security Complinaces in helathcare	.444	.075	.394	.083
Information Security Awareness and Information Security Complinace in helathcare	.01	.445*	0.01	.401*

The correlation between Information Security Awareness and Information Security Compliance in healthcare is significant (.445) based on Spearman Correlation at a significance level of 0.01. A significant positive correlation between Healthcare Information Systems and Healthcare was found in this study at a Level of Significance of 0.01 in terms of level of significance. On the basis of the value, it is impossible to justify the results as a strong positive relationship.

Healthcare Standards and Information Security Compliance in healthcare have a negative correlation (-.142), indicating that the two variables are in direct opposition to each other. According to the analysis, security requirements and information security compliance in healthcare have a negative correlation of − .288 at a 0.000 significant level, which indicates that the relationship between security requirements and information security compliance in

healthcare is a negative one. The correlation between management involvement and organizational performance is negatively correlated (-.233) below a significance level of .005. The significant levels for the Healthcare Standards and Organizational Systems variables were different from the .005 significant level. Therefore, it was not possible to predict the relationship type between the variables.

B Standards and Information Security in Healthcare: Compliance with the Law and Standard

Table 2

Information Security Compliance and Healthcare Standards
Correlations
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.000	.076
		Sig.(2-tailed)	.	.670
		N	34	34
	Healthcare Standards	Correlation Coefficient	.076	1.000
		Sig.(2-tailed)	.670	.
		N	34	34
Source: Using SPSS software, analysis of survey data produced, 2015.

Considering the correlation Table 2 above, we can conclude that there is no direct relationship between healthcare standards and information security in the healthcare industry. The correlation Table 2 shows that there are no direct correlations between healthcare standards and information security. Since the correlation coefficient (r) value of the two variable has a value greater than 0.05, while the value of n (0.076) has a value greater than that of k (0.05), therefore, it is impossible to assume that there is a positive correlation between the two

variables. As a consequence, it is not possible to infer that there is a positive relationship between the two variables.

r = 0.076, p > 0.05

C Healthcare Information Systems and Information Security

Table 3

Information Security Compliance and Healthcare Information Systems
Correlation
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.000	.766**
		Sig.(2-tailed)	.	.000
		N	34	34
	Healthcare Standards	Correlation Coefficient	.766**	1.000
		Sig.(2-tailed)	.000	.
		N	34	34
**. Correlation is significant at the 0.01 level (2-tailed).
Source: Using SPSS software, analysis of survey data produced, 2015.

Considering the correlation Table 3 above, It is impossible to predict how healthcare standards related to the security of healthcare information systems. Healthcare information systems and compliance with information security in healthcare have a lower correlation coefficient (r) and a smaller p-value (0.01) than the correlation coefficient between the two (0.05).

r = 0.766**, p < 0.05

Healthcare information systems are made up of many components that play a vital role in ensuring information security compliance.

D Security Needs and Compliance of Information Security in Healthcare

Table 4

Correlation between security requirements and compliance with information security
Correlation
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.000	.254
		Sig.(2-tailed)	.	.148
		N	34	34
	Healthcare Standards	Correlation Coefficient	.254	1.000
		Sig.(2-tailed)	.148	.
		N	34	34
Source: Using SPSS software, analysis of survey data produced, 2015.

Considering the correlation Table 4 above, the correlation value (r) and p (0.148) are higher, therefore, it is impossible to predict the relationship between information security compliance in healthcare and information security requirements.

r = 0.254, p > 0.05

E Compliance with information security acts in healthcare and management involvement

Table 5

Information Security Compliance and Management Involvement
Correlation
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.000	− .036
		Sig.(2-tailed)	.	.842
		N	34	34
	Healthcare Standards	Correlation Coefficient	− .036	1.000
		Sig.(2-tailed)	.842	.
		N	34	34
Source: Data analysis output using SPSS software, 2015

The correlation coefficient (r) and basis value (0.842) of the above correlation Table 5 indicate that there is no correlation between security requirements and information security. compliance in healthcare, based on the correlation coefficient (r). As a result, 0.05 proved to be greater than 0.8422 as it was greater than 0.8422.

r = − .036, p > 0.05

F Healthcare Information Security and Organizational Compliance

Table 6

InfoSec Compliance and Organizational Systems
Correlation
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.000	.110
		Sig.(2-tailed)	.	.537
		N	34	34
	Healthcare Standards	Correlation Coefficient	.110	1.000
		Sig.(2-tailed)	.537	.
		N	34	34
Source: Data analysis output using SPSS software, 2015

Considering the correlation Table 6 above, It is difficult to predict whether there might be a positive correlation between organizational models and information security compliance in healthcare, even if there might be one. That is due to the fact that both correlation coefficient values (r) and correlation coefficient values (p) are higher than the level of significance (0.05).

G Awareness of information security in healthcare and compliance with information security

Table 7

The correlation between information security awareness and information security compliance
Correlation
			Infosec Compliance in healthcare	Healthcare standards
Spearman’s rho	Infosec compliance in healthcare	Correlation Coefficient	1.00	.953**
		Sig.(2-tailed)	.	.000
		N	34	34
	Healthcare Standards	Correlation Coefficient	.953**	1.000
		Sig.(2-tailed)	.000	.
		N	34	34
**. Correlation is significant at the 0.01 level (2-tailed).
Source: Using SPSS software, analysis of survey data produced, 2015.

Considering the correlation Table 7 above, it has been demonstrated that there is a strong correlation between awareness of information security in healthcare and compliance with the law, as shown by the correlation coefficient (r) and the value of p (0.953), as well as the value of p (.001).

It has been shown that healthcare information systems and information security awareness are positively correlated with compliance with information security policies in the healthcare sector. The remaining hypotheses (H1, H3, H4, and H5) were refuted by statistical correlations because they did not show a strong positive relationship with Healthcare Standards, Security Requirements, Management Involvement, or Organizational System variables.

Upon analysis, it was confirmed that information security awareness and Healthcare Information Systems have a significant positive correlation, validating hypotheses H2 and H6. In addition, none of the other hypotheses in the conceptual framework showed strong positive relationships, including H1, H3, H4, and H5. Due to this, we will consider these hypotheses disproven.

It has been found that research has been conducted along similar lines to help in the discovery of the relationship described in the hypothesis. Kruger et al. [9] demonstrated that security compliance can be positively affected by information security awareness. In their studies, [10] observed similar results. Linda L. Dawson [35] mentioned that healthcare data security increases an organization's overall security.

According to the results of this study, there are several factors that contribute to the compliance of healthcare organizations with respect to their information security. Thus, if an organization wishes to increase its level of compliance with information security standards, it must put an emphasis on securing information systems. In addition, it must raise security awareness among its employees. Increasing the level of security compliance behavior of an organization cannot be achieved solely based on one actor. It is extremely crucial to focus on these factors in order to enhance the culture of security.

In conclusion, this analysis emphasizes the crucial need for creating a strong culture of following information security rules in healthcare outsourcing. The suggested behaviors and strategies outlined in this study are carefully designed to act as a shield against potential threats. Their goal is to protect sensitive patient data, follow strict regulations, and ensure the overall honesty and privacy of healthcare information.

In an industry where the impacts of data security breaches can be serious and widespread, taking these precautions is not just a good idea—it's a must. The potential consequences go beyond the immediate breach, affecting the trust of patients and stakeholders and possibly resulting in legal and financial problems. Therefore, actively adopting a strong information security culture isn't just a precautionary step; it's a necessary move for healthcare outsourcing companies.

In essence, these strategies not only strengthen data security but also enhance the overall ability of healthcare outsourcing operations to withstand challenges. By giving priority to information security compliance, organizations can confidently navigate the complex world of managing healthcare information, ensuring the safety of patients, and protecting the reputation and viability of the institutions involved.

Ethics approval and consent to participate.

The authors confirm that all experiments were performed in accordance with relevant guidelines and regulations. The need for ethics approval and informed consent is deemed unnecessary according to national regulations: Sri Lanka National Policy on Health Information Section 4/ 2017, Section 4.1/ 2017 (Data/Information Security, Client Privacy, Confidentiality and Ethics) and Section 4.2/ 2017 (Data and information security for client data protection). Nevertheless, the study prioritized the issue of consent. all participants provided informed consent prior to their participation in the survey. The consent form explained the purpose of the survey, procedures involved, potential risks and benefits, confidentiality measures, and the right to withdraw from the survey at any time. Participants were also informed that their data would be kept confidential and used only for research purposes.

Consent for publication

Not applicable

Availability of data and materials

Not applicable

Competing interests

The authors declare no competing interests.

Author details

¹Insight Information Security L.L.C, Floor 03, Grand Mall, Muscat, Oman, ²Central Queensland University, School of Engineering and Technology, Brisbane 4000, Australia

Funding

Not applicable

Authors' contributions

Charitha Maheepala collected and analyzed data for the main manuscript, while Pethigamage Perera played a crucial role in coordinating and the writing process.

Acknowledgements

I would also like to extend my sincere gratitude to MediGain RCM Colombo(Pvt) Ltd, HealthRecon, along with my friends who are working in these organizations, for the support and assistance they provided.

Global EDGE. Michigan State University Your source for Global Business Knowledge. [ONLINE] Available at: http://globaledge.msu.edu/industries/healthcare [Accessed 01st August 2015].
Barley SR. Technology as an occasion for structuring: evidence from observation of CT Scanners and the social order of radiology departments. Adm Sci Q. 1986;31:78–108.
Ganthan N, Samy RA. Security threats categories in healthcare information systems. Health Inf J DOI: 10 1177/1460458210377468 2010. 2010;16(201):204–8.
Appari A, Johnson M, Eric. Information security and privacy in healthcare: current state of research. Int J Internet Enterp Manage. 2010;6:4.
Hassan NH, Ismail Z. (2012). A conceptual model for investigating factors influencing information security culture in healthcare environment, International Congress on Interdisciplinary Business and Social Science. (ICIBSoS), 2012.
Suhaila M, et al. Mixtures of oseltamivir-sensitive and-resistant pandemic influenza A/H1N1/2009 viruses in immunocompromised hospitalized children. Pediatr Infect Dis J. 2011;30(7):625–7.
Gajanayake R, Iannella R, Tony Sahama. Sharing with care: An information accountability perspective. IEEE Internet Comput. 2011;15(4):31–8.
Revenue Cycle Management | Healthcare]IT]News. 2015. Revenue Cycle Management] |]Healthcare]IT]News.]][ONLINE]]Available]at: http://www.healthcareitnews.com/resource-topics-financial-revenue-cycle- management. [Accessed 12 August 2015].
Kruger A, Flower Day HA, Drevin S L. and, Steyn T. T. (2011) An assessment of the role of cultural factors in information security awareness, ISSA 2011, Johannesburg, South Africa, August 15–17, 2011.
Hovav A, D’Arcy J. Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the U.S. and South Korea. Info Mngmnt. 2012;49(2):99–110.
Suhaila M, et al. Mixtures of oseltamivir-sensitive and-resistant pandemic influenza A/H1N1/2009 viruses in immunocompromised hospitalized children. Pediatr Infect Dis J. 2011;30(7):625–7. 6.
Gajanayake R, Iannella R, Tony Sahama. Sharing with care: An information accountability perspective. IEEE Internet Comput. 2011;15(4):31–8.
Gritzalis D, Lambrinoudakis C. A security architecture for interconnecting health information systems. Int J Med Informatics. 2009;73:305–9.
Mason A, Tipping L. 2001. Understanding and Implementing Security Standards into Your Business, Proceedings of the SECURE.NZ conference,Auckland, New Zealand, 2001.
Health Canada Privacy Act: Annual Report 2010–2011. 2015. Health Canada Privacy Act: Annual Report 2010–2011. [ONLINE] Available at: http://www.hc- sc.gc.ca/ahc-asc/pubs/_atip-aiprp/2011priv-prot/index-eng.php. [Accessed 24 August 2015].
Hellerstein D. HIPAA: Where Do Providers Stand? Health Manag Technol. 2001;22(1):14–7.
Fedorowicz J, Ray AW. Impact of HIPAA on the integrity of healthcare information. Int J Technol Manage. 2004;6(2):142–57.
Quazi A, Talukder M. Demographic determinants of adoption of technological innovation. J Comput Inform Syst. 2011;52(1):34–42.
Howell J, Wei J. Value increasing model in commercial e- banking. J Comput Inform Syst. 2010;51(1):72–81.
Dwivedi YK, Lal B. Socio-economic determinants of broadband adoption. Industrial Manage Data Syst. 2007;107(5):654–71. 10.1108/026355707107547.
Yee KY, Tiong AW, Tsai FS, Kanagasabai R. Onto Mobile: a generic ontology-centric service-oriented architecture for mobile learning, IEEE Tenth Int. Conf. on Mobile Data Management: Systems, Services and Middleware, Workshop on Mobile Media Retrieval, 631–636, 2009.
Kalorama Information. (2007) Wireless Opportunities in Healthcare, www.MarketResearch.com.
Weiss G. Welcome to the (almost) digital hospital. IEEE Spectr. 2002;39:44–9.
Blobel B. Architecture of secure portable and interoperable electronic health records, Proc. of Int. Conf. on Computational Science, 982–994, 2002.
Gunter TD, Terry NP. The emergence of national electronic health record architectures in the United States and Australia: models, costs, and questions,J. Med. Internet Res., 10.2196/jmir.7.1. e3, 2005.
Health Metrics Network. Framework and Standards for Country Health Information Systems. World Health Organization; January 2008.
Blobel B. Authorization and access control for electronic health record systems. Int J Med Inf. 2004;73:251–7.
Gordon LA, Loeb MP, Lucyshyn W, Richardson R. Ninth annual CSI/FBI computer crime and security survey. San Francisco, Ca: Computer Security Institute; 2004. p. 18.
Panko RR. 2004. Corporate Computer and Network Security. Prentice Hall, Upper Saddle River, NJ. Pawlowski, S.D., Kaganer, E.A., Cater, J.J., 2004. Mapping perceptions of burnout in the Information Technology profession: a study using social representations theory. Paper presented at the Twenty-fifth International Conference on Information Systems, Washington, DC.
Vaast E. (2007) Danger is in the eye of the beholders: Social representations of Information Systems security in healthcare. School of Business, Long Island University, Brooklyn Campus, 1, University Plaza, H700, Brooklyn, NY 11 201, USA.
Roland Brill and Wolfganga Leetz. (2005) Security implementations in the health care enterprise, Simens AG Medical Solutions. P O Box 3260, 91050 Erangen, Germany.
Obama Administration Admits Healthcare.gov Was Hacked in July. 2015. Obama Administration Admits Healthcare.gov Was Hacked in July. [ONLINE] Available at: http://time.com/3270936/obamacare-website-was-hacked-in-july/. [Accessed 30 August 2015].
Anderson RJ. Security in Clinical Information Systems, Computer Laboratory. University of Cambridge, Pembroke Street; 1996. Cambridge CB2 3QG.
Maglogiannis I, Zafiropoulos E. Modeling risk in distributed healthcare information systems. 28th Annual International Conference of the IEEE on Engineering in Medical and Biology Society (EMBS), 30 August 2006, New York.
Linda. Volonino SR, Robinson. and Charles P. Volonino. Principles and practice of information security: protecting computers from hackers and lawyers. Pearson/Prentice Hall; 2004.
Knapp KJ, Marshall TE, Rainer RK, Morrow DW. Top Ranked Information Security Issues. The2004 International Information Systems Security Certification Consortium (ISC) 2 Survey Results. Alabama: Auburn University; 2004.
Keefe P. Computer Crime Insurance Available-for a Price. Computerworld; 1983. pp. 20–1.
Straub D. Deterring Computer Abuse: The Effectiveness of Deterrent Countermeasures in the Computer Security Environment. Bloomington, IN: Indiana University School of Business; 1986.
Shedden P, Ahmad A, Ruighaver AB. (2006). Risk Management Standard-the Perception of Ease of Use. In Proceedings of the fifth annual security conference, Las Vegas, Nevada, USA.
Ong T, Hwee et al. SNMS-Shadow Network Management System. Recent advances in intrusion detection. 1999.
Fitzgerald T. Clarifying the roles of information security: 13 questions the CEO, CIO, and CISO must ask each other. Inform Syst Secur. 2007;16(5):257–63.
Lim JS et al. Exploring Relatsh between organizational Cult Inform Secur Cult (2009).
Mintzberg H. the Structuring of Organizations. Englewood Cliffs, NJ: Prentice-Hall; 1979.
Schein E, H. The Corporate Culture Survival Guide. San Francisco: Jossey-Bass; 1999.
Brooks L, Davis CJ, Lycett M. Organisations and Information Systems: Investigating Their Dynamic Complexities Using Repertory Grids and Cognitive Mapping. Int J Technol Human Interact. 2005;1(4):39–55.
Bélanger F. and Robert E. Crossler. Privacy in the digital age: a review of information privacy research in information systems. MIS Q (2011): 1017–41.
Schattner P, Pleteshner C. GPCG Computer Security Project: Final Report. Melbourne: Monash University, Department of General Practice; 2004.
Ma Q, Johnston AC, Pearson JM. (2008) 'Information Security Management Objectives and Practices: A Parsimonious Framework', Information Management and Computer Security, Vol. 16, No. 3, pp.251–270.
Chang S, Lin E, C. Exploring organizational culture for information security management. Industrial Manage Data Syst. 2007;107(3):438–58.
Zakaria O, Jarupunphol P, Gani A. (2003). Paradigm Mapping for Information Security Culture Approach. Paper presented at the 4th Australian Information Warfare and IT Security Conference Adelaide, Australia.
Vroom C, von Solms R. Towards Inform Secur Behav compliance Computers Secur. 2004;23:191–8.
Alnatheer MA. Information security culture critical success factors. 2015 12th International Conference on Information Technology-New Generations. IEEE, 2015.
Sengun Y, Janell D, T. Does culture explain acceptance of new products in a country? An empirical investigation. Int Mark Rev. 2003;20:377.
Hofstede G. Culture's Consequences: Comparing Values, Behaviors, Institutions, and Organizations Across Nations. Thousand Oaks, Calif: Sage; 2001.
Alnatheer M, Nelson K. (2009). Proposed Framework for Understanding Information Security Culture and Practices in the Saudi Context, 7th Australian Info Security Mngmt Conf., Perth, Dec. 1–3, 2009.
Mensch S, Wilkie L. Information security activities of college students: an exploratory study. Acad Inform Manage Sci J. 2011;14(2):91–116.
Okenyi PO, Owens TJ. On the anatomy of human hacking. Inform Syst Secur. 2007;16:302–14.
Ku CY, Chang YW, Yen DD. National Information Security Policy and its Implementation: A case study in Taiwan. Telecomm Policy. 2009;33(7):371.
Ernst and Young. Global Information Security Survey. London: Ernst and Young; 2002.
Luo X, Liao Q. Awareness Educations the key to Ransomware Prevention. Inform Secur J. 2007;16(4):195–202McQuade.
White G. (2010). The Evolution and Implementation of Global Assurance. Issues in Information Systems, 11(1), 35–40. (Also appears in PROCEEDINGS of the International Association for Computer Information Systems, Las Vegas, NV, October 6–9, 2010).
Rezgui Y, Marks A. Information security awareness in higher education: An exploratory study. Computers and security 27.7-8 (2008): 241–53.
Schlienger T, Teufel S. (2002). Information Security Culture: The Socio-Cultural Dimension in Information Security Management. Paper presented at the Security in the Information Society: Visions and Perspectives.
Lungu I, Tabusca A. Optimizing anti-phishing solutions based on user awareness, education and the use of the latest web security solutions. Infromatica Economica. 2010;14(2):27–36.
Futcher L, Schroder C, Rossouw S. Information security education in South Africa. Inform Manage Comput Secur. 2010;18(5):366–74.
Kieke RL. Survey shows high number of organizations suffered security breach in past year. J Health Care Compliance. 2006;8(5):49–50.
Peltier T. Implementing an information security awareness program. EDPACS. 2005;33(1):1–18.
Dodge RC, Carver C, Ferguson A. Phishing for user security awareness. Computers Secur. 2007;26(1):73.
Siponen M. A conceptual foundation for organizational information security awareness. Inform Manage andComputer Secur. 2000;8(1):31–41.
Rotvoid G, Landry R. (2007). Status of security awareness in business organizations and colleges of business: an analysis of training and education, policies, and social engineering testing. Dissertation, University North Dakota.
Whitman ME, Townsend AM, Alberts RJ. 2001. Information systems security and the need for policy.
Parker DB. Fighting Computer Crime. New York: Wiley; 1998.
Dhillon G. Managing and controlling computer misuse. Inf Manage Compute Secur. 1999;7(4):171–5.
Wybo MD, Straub DW. Protecting organizational information resources. Inf Resour Manage J. 1989;2(4):1–15.

No competing interests reported.

Download PDF

Editorial decision: Revision requested
15 Nov, 2024
Reviews received at journal
19 Jul, 2024
Reviewers agreed at journal
27 May, 2024
Reviewers invited by journal
25 Feb, 2024
Editor assigned by journal
08 Feb, 2024
Submission checks completed at journal
08 Feb, 2024
First submitted to journal
02 Oct, 2023

You are reading this latest preprint version

Exploring Information Security Compliant Behaviors in Healthcare Knowledge Process Outsourcing (KPOs)

Status:

Version 1

Abstract

I. INTRODUCTION

II. LITERATURE REVIEW

III. RESEARCH DESIGN

IV. FINDINGS

V. DISCUSSION

VII. CONCLUSION

Declarations

References

Additional Declarations

Status:

Version 1