Examining the intended and unintended consequences of organisational privacy safeguards

Abstract

Research shows that despite organisational efforts to achieve privacy compliance, privacy breaches continue to rise. The extant studies on organisational privacy compliance concentrate on the extent to which privacy threats can be alleviated through a combination of technical and human controls and the positive (and often intended) influences of these controls. This focus inadvertently neglects unintended consequences such as impeded workflow in medical practices. To address this research conflict, this study uses an interpretive grounded theory research approach to investigate the consequences of privacy safeguard enactment in medical practices, including whether it influences their ability to meet privacy requirements and whether workflows are impeded. Our central contribution is a theoretical framework, the unintended consequences of privacy safeguard enactment (UCPSE) framework, which explicates the process by which privacy safeguards are evaluated and subsequently bypassed and the resulting influence on organisational compliance. The UCPSE highlights the importance of the imbalance challenge, which is the result of unintended consequences outweighing the intended consequences of privacy safeguard enactment. Failure to address the imbalance challenge leads to the adoption of workarounds that may ultimately harm the organisation's privacy compliance. Despite several research calls, the consequences and effectiveness of organisational privacy efforts are largely missing from both information systems and health informatics research. This study is one of the first attempts to both systematically identify the impacts of privacy safeguard enactment and to examine its implications for privacy compliance in the healthcare domain. The findings also have practical implications for healthcare executives on the UCPSE and how they could alleviate the imbalance challenge to thwart workarounds and the subsequent negative effects on privacy compliance.

The Zachman Framework for Enterprise Architecture: An Explanatory IS Theory

“…EA in strategic context is directed at the current and future purposes of the organization as well as to assist in reaching organisational goals and objectives, including ensuring that the business with its technologies and resources are aligned [10,22]. However, enterprises often experience challenges with the implementation of EA initiatives and capabilities [23], resulting in sentiments documented mostly in popular press, for instance stating that EA is dead [24,25]. EA initiatives are often costly and without the expected return on investment.…”

Conceptualizing Workarounds: Meanings and Manifestations in Information Systems Research

“…Workarounds refer to unexpected user behaviors that researchers have reported to create hazards, inefficiency, and even illegal actions (Alter, 2014;Murphy, Reddy, & Xu, 2014) and frequently cited in relation to serious patient safety issues (Halbesleben, Wakefield, & Wakefield, 2008;Patterson, Rogers, Chapman, & Render, 2006). However, researchers have also acknowledged workarounds as beneficial and, in fact, necessary in hospitals (Ash, Berg, & Coiera, 2004;Parks, Xu, Chu, & Lowry, 2017) and other settings (Button, Mason, & Sharrock, 2003;Ferneley & Sobreperez, 2006). Several studies have viewed workarounds as expressing resistance (Ferneley & Sobreperez, 2006;Choudrie & Zamani, 2016), whereas others question this view (Button et al, 2003;Azad & King, 2012).…”

Flamingos on a slackline: Companies' challenges of balancing the competing demands of handling customer information and privacy

“…In IS research, grounded theory is enjoying increasing popularity and has been applied in the contexts of IS outsourcing projects (Gregory, Beck, & Keil, ), enterprise systems (Strong & Volkoff, ), sustainable cities (Corbett & Mellouli, ), and many others. In the information privacy domain, a recent study used a grounded theory approach to explore intended and unintended consequences of privacy safeguards (Parks et al, ).…”

“…More than two decades ago, Jeff Smith () noted the lack of research concerned with an organizational perspective on companies' privacy‐related practices, and more than 10 years later, Mary Culnan made the same observation with more drastic wording: “Privacy is an organizational issue that is grossly under‐researched” (Chan et al, , p. 272). It is surprising that since then, still only a handful of studies have addressed this research need (eg, Greenaway, Chan, & Crossler, ; Lee et al, ; Parks, Xu, Chu, & Lowry, ; Wall et al, ). The few studies that do consider the organizational perspective on information privacy are summarized in Table .…”