Awareness Training Transfer and Information Security Content Development for Healthcare Industry

Abstract

Abstract-Electronic Health Record (EHR) becomes increasingly pervasive and the need to safeguard EHR becomes more vital for healthcare organizations. Human error is known as the biggest threat to information security in Electronic Health Systems that can be minimized through awareness training programs. There are various techniques available for awareness of information security. However, research is scant regarding effective information security awareness delivery methods. It is essential that effective awareness training delivery method is selected, designed, and executed to ensure the appropriate protection of organizational assets. This study adapts Holton's transfer of training model to develop a framework for effective information security awareness training program. The framework provides guidelines for organizations to select an effective delivery method based on the organizations' needs and success factor, and to create information security content from a selected healthcare's internal information security policy and related international standards. Organizations should make continual efforts to ensure that content of policy is effectively communicated to the employees.

A Cybersecurity Culture Survey Targeting Healthcare Critical Infrastructures

“…Therefore, it is deduced that there is a high risk of security incidents triggered by non-ICT employees because the aforementioned threats and attacks and the associated impact of potential incidents have not been efficiently communicated to them by the ICT staff. All the above indicate that decreasing the end-point complexity as proposed in [ 32 ], along with training conduction, is essential in raising awareness amongst personnel and motivating them to pay attention to cyber-threats and policies to limit human errors [ 33 , 34 , 35 ]. The adoption of a risk-aware attitude and associated skills by the non-ICT staff through cybersecurity trainings and a robust organizational monitoring strategy could lead to a more GDPR-compliant status.…”

Evaluation of the Effects of Information Security Training on Employees: A Study From a Private Hospital

“…These kinds of errors can be corrected through training programs with an intention to promote behaviors of individuals toward organizational policy. Training programs in organizations can help to improve employees' awareness toward the security of E-health systems and help them to adhere to appropriate behaviors that do not compromise the security of the system (Ghazvini and Shukur, 2016). Based on these facts, the information security awareness programs have positive influences on the employees' knowledge, attitude, and behavior in real life.…”

“…Organizations should make continual efforts to ensure that the content of policy is effectively communicated to the employees (Ghazvini and Shukur, 2016). Therefore, the factors that play a significant role in shaping perceived security should be enhanced (Peikari et.al, 2018).…”

“…Since training programs are effective approaches to reduce the risks in electronic health systems (Olusegun and Ithnin, 2013), the organizations can develop several training modules that target employees who need to be aware of their requirements for compliance based on legislative policies and acts (Arain et.al, 2019;Tsohou et.al, 2008 (Ghazvini and Shukur, 2016). Finally, human error is considered as the biggest threat to information security effectiveness owing to lack of employees' attention (Ghazvini and Shukur, 2016). Therefore, many organizations establish the awareness programs to ensure that their employees are informed about security risks, thereby protecting themselves and their profitability (Gebrasilase and Ferede, 2011).…”

Office 365 SharePoint Online: Establishing Content Security Awareness with End-Users using Campaigns

“…Moreover, implementing user awareness campaigns, by educating and training end-users can help to improve the use of systems (Ghazvini & Shukur, 2016). However, as mentioned by Caldwell (2016), awareness without any other activity is not enough.…”