PurposeQualitative methods are not suitable to process high volumes of policy texts for exploring policy evolution. Therefore, it is hard to use qualitative methods to systematically analyze the characteristics of complex policy networks. So the authors propose a bibliometric research study for exploring policy evolution from time–agency–theme perspectives to excavate the rules and existing problems of China's medical informatization policy and to provide suggestions for formulating and improving the future medical informatization policies.Design/methodology/approachInitially, 615 valid samples are obtained by retrieving related China's medical informatization policy documents, and the joint policy-making agency network and the co-occurrence network models of medical informatization policies are defined, and then the authors research China's medical informatization policies from single-dimension and multi-dimension view.FindingsThe analysis results reveal that China's medical informatization policy process can be divided into four stages; the policy-making agencies are divided into four subgroups by community detection analysis according to the fast unfolding algorithm; the core policy theme keywords are identified based on the eigenvector centrality of the nodes in those networks; the focuses of theme terms are varied in different stages and the correlations between agencies and themes are gradually decentralized.Practical implicationsThese findings provide experience and evidence on leveraging informatics in the medical and healthcare field of China. Also, they can help scholars and practitioners better understand the current status and future directions of medical and healthcare informatics development in China and provide a reference to formulate and improve China's future medical informatization policies.Originality/valueThis study proposes a quantitative bibliometric-based research framework to describe transitions and trends of China's medical informatization policy.

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

No abstract

Purpose This paper is to investigate how employees respond to information security policies (ISPs) when they view the policies as a challenge rather than a hindrance to work. Specifically, the authors examine the roles of challenge security demands (i.e. continuity and mandatory) and psychological resources (i.e. personal and job resources) in influencing employees’ ISP non-compliance. Design/methodology/approach Applying a hypothetical scenario-based survey method, the authors tested our proposed model in six typical ISPs violation scenarios. In sum, 347 responses were collected from a global company. The data were analyzed using partial least square-based structural equation model. Findings Findings indicated that continuity and mandatory demands increased employees’ level of perseverance of effort, which, in turn, decreased their ISPs non-compliance intention. In addition, job resources, such as the trust enhancement gained from co-workers and the opportunities for professional development, enhanced the perseverance of effort. Practical implications The findings offer implications to practice by suggesting that organizations should design training programs to persuade employees to understand the ISPs in a positive way. Meanwhile, organizations should encourage employees to invest more personal resources by creating a trusting atmosphere and providing them opportunities to learn security knowledge and skills. Originality/value This study is among the few to empirically explore how employees respond and behave when they view the security policies as challenge stressors. The paper also provides a novel understanding of how psychological resources contribute to buffering ISP non-compliance.