Assessing staff awareness and effectiveness of educational training on IT security and privacy in a large healthcare organization

Abstract

BackgroundThe increased use of health information systems and information technology (IT) in healthcare heightens the risk of security and privacy breaches. Necessary measures such as effective IT training and education are required to meet the challenges of protecting patient information.PurposeThe objective of the study was to determine the effectiveness of existing educational and awareness modules in delivering the key messages around IT security and privacy.MethodsThe study was conducted in a large healthcare organization in Western Canada from September 2016 to March 2017. Using proportionate stratified random sampling, an online survey was distributed to all professional groups including clinical and non-clinical staff. In total, 586 participants responded to questions pertaining to whether or not they were aware of the IT education material, common potential breaches, and knowledge in preventing IT security and privacy breaches. Data were analyzed in SPSS version 19.ResultsThe study found that most of the participants (80.9%) completed the online IT training. Staff perceived the online training as effective (57.5%). There was a significant positive correlation between staff perception about the effectiveness of IT security educational material and satisfaction with IT security in the organization (r=0.34, P<0.01). Those who completed the training were 4.2-times (CI=2.0–8.8) more likely to correctly report the action upon receiving spam emails than those who had not completed the training. The most common type of breach stated was not knowing how to encrypt emails when sending emails outside the organization. Only a small proportion of clinical (25.5%) and non-clinical staff (30.4%) reported knowing how to encrypt emails. Also, participants identified various strategies for improving the module content and compliance.ConclusionOnline training provides a basic understanding of IT security and privacy concepts to prevent potential breaches. The training should be an integral part of healthcare staff continuing education to protect patient information.

A Cybersecurity Culture Survey Targeting Healthcare Critical Infrastructures

“…Regarding the non-ICT personnel, comparing our findings ( Table 1 ) with a 2020 study in Poland [ 21 ], a 2019 study in a health region of western Finland [ 22 ], and a 2019 study in a health organization in western Canada [ 19 ], revealed the low level of cybersecurity awareness status. In Institutions A, B, and C, the 22.7% that felt sufficiently trained in security and the 23.3% that perceived the importance of the terminals’ content to hackers, appeared significantly lower next to the 51.31% of the 1200 Finnish professionals reporting bring sufficiently aware of the information and the cybersecurity matters pertaining to their job.…”

“…Cybersecurity culture denotes the combination of attitudes, behaviors, knowledge, and awareness the organization’s personnel display about common cyber risks and threats to protect the information assets [ 18 ]. Its evaluation involves the conduction of focused campaigns, which often results in the initiation of education programs, ICT infrastructure auditing, and the reassessment of current security policies to cultivate hospital personnel’s culture and sense of responsibility when processing sensitive information in daily business operations, thus preventing attacks or leakages [ 19 , 20 ]. Several endeavors towards assessing healthcare personnel’s cybersecurity culture were based on surveys.…”

Phishing simulation exercise in a large hospital: A case study

“… 28 It is well known that medical staff in healthcare settings do not have time to follow extracurricular activities and courses on security training within the timelines dictated by the Management. 10 In fact, the data available from the hospital's intranet site showed that over a third of the medical staff had not performed the recent Privacy and GDRP e-training requested by the Data Protection Officer within the expected timeframe. Therefore, a phishing simulation was introduced to provide an efficient and rapid assessment of the level of risk to the hospital posed by phishing and to bring the issue to the general attention of staff and hopefully nudge staff to be more vigilant.…”

“…Despite this, there is a noticeable lack of real-work studies of phishing in organizations, where the attack is customized for a particular organization. Among healthcare organizations, hospitals are particularly vulnerable to phishing attacks as it is difficult for management to enforce a strict cybersecurity policy 10 and staff may miss the signs of a phishing email as a result of fatigue, being more focused on patient care than administration tasks, 11 or simply because phishing emails are hard to detect. If they followed a recognizable pattern – security developers would be able to write software to filter them out and would not need to rely on human intervention.…”

Information Security Awareness and Behaviors of Health Care Professionals at Public Health Care Facilities

“…Stronger cybersecurity programs at health care facilities can raise awareness and make information security training available to professionals, both clinical and nonclinical. [34][35][36] To improve end-user adoption and buy-in of cybersecurity programs and technologies, it is important utilize a targeted bottom-up approach via personalized outreach, in-person contacts, and frequent announcements throughout the workflow (i.e., rounds). 37 As more patients go online, cybersecurity programs become especially important as clinicians consider discussing and potentially showcasing relevant and useful online resources (e.g., videos, social media channels, websites, etc.).…”