Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

Abstract

Information security has come to the forefront as an organizational priority since information systems are considered as some of the most important assets for achieving competitive advantages. Despite huge capital expenditures devoted to information security, the occurrence of security breaches is still very much on the rise. More studies are thus required to inform organizations with a better insight on how to adequately promote information security. To address this issue, this study investigates important factors influencing hospital staff’s adherence to Information Security Policy (ISP). Deterrence theory is adopted as the theoretical underpinning, in which punishment severity and punishment certainty are recognized as the most significant predictors of ISP adherence. Further, this study attempts to identify the antecedents of punishment severity and punishment certainty by drawing from upper echelon theory and well-acknowledged international standards of IS security practices. A survey approach was used to collect 299 valid responses from a large Taiwanese healthcare system, and hypotheses were tested by applying partial least squares-based structural equation modeling. Our empirical results show that Security Education, Training, and Awareness (SETA) programs, combined with internal auditing effectiveness are significant predictors of punishment severity and punishment certainty, while top management support is not. Further, punishment severity and punishment certainty are significant predictors of hospital staff’s ISP adherence intention. Our study highlights the importance of SETA programs and internal auditing for reinforcing hospital staff’s perceptions on punishment concerning ISP violation, hospitals can thus propose better internal strategies to improve their staff’s ISP compliance intention accordingly.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

“…The following factors appeared in two studies: Perceived certainty is derived from GDT, which can examine different acts or processes, such as detection [ 80 ] and punishment [ 73 ]. Two selected studies evaluated the impacts of peer influence and superior influence on different types of security behavior: protection intention [ 70 ] and non-compliance intention [ 82 ].…”

Determinants of Information Security Awareness and Behaviour Strategies in Public Sector Organizations among Employees

“…The different perspectives of these theories and the facilitating conditions show the whole chain of the InfoSec behaviour adoption process. Thus, it helps organisations reduce information security breaches by changing employees' behaviour to match information security policies and rules [7,15,[17][18][19][20][21][22]. An assessment of theories utilised in related work revealed that the theories of TPB, PMT, and GDT are most often used [23]; [24].…”

“…GDT has been chiefly used in criminology to minimise deviant behaviour in people. In recent decades, it has been successfully and efficiently used for information technology as well as preventative information security [15], [19], [20], [27], [43]. In GDT, the deterrence model is built on three core constructs: certainty of sanctions, the severity of sanctions, and celerity of sanctions.…”

“…Such determinants impact people's attitudes toward preventing activities that are regarded as undesirable in society. The constructs' of GDT: perceived www.ijacsa.thesai.org certainty of sanctions and perceived severity of sanctions are included in the study model due to their positive influence in the relevant literature [20], [43]. Perceived certainty of sanctions refers to a person's belief that the authorities are likely to detect delinquent behaviour.…”

“…The study's findings reveal that SETA programs strongly affect public institution employees' ISA intentions towards InfoSec behaviour. According to prior studies, SETA programs motivate employees to follow information security policies and procedures [20], [21]. When public sector employees get appropriate SETA programs, they will gain an essential awareness of security knowledge and abilities.…”