“I do it because they do it”: Social-Neutralisation in Information Security Practices of Saudi Medical Interns

Abstract

Successful implementation of information security policies (ISP) and IT controls play an important role in safeguarding patient privacy in healthcare organizations. Our study investigates the factors that lead to healthcare practitioners' neutralisation of ISPs, leading to noncompliance. The study adopted a qualitative approach and conducted a series of semi-structured interviews with medical interns and hospital IT department managers and staff in an academic hospital in Saudi Arabia. The study's findings revealed that the MIs imitate their peers' actions and employ similar justifications when violating ISP dictates. Moreover, MI team superiors' (seniors) ISP non-compliance influence MIs tendency to invoke neutralisation techniques. We found that the trust between the medical team members is an essential social facilitator that motivates MIs to invoke neutralisation techniques to justify violating ISP policies and controls. These findings add new insights that help us to understand the relationship between the social context and neutralisation theory in triggering ISP non-compliance.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

“…The greatest security threat is the unauthorized use of the HIS (11 studies). This threat can lead to incident events because of vulnerabilities in the healthcare facilities—for example, lack of security awareness and policy compliance [ 11 , 50 , 58 , 70 , 81 , 82 ], use of multiple entry points to access electronic medical records [ 49 , 65 ] and forgetting to log out after using the HIS at an unattended workstation [ 85 ]. The second-greatest threat is masquerading by insiders, such as staff accessing the HIS without using their own account (seven studies).…”

“…The following factors appeared in two studies: Perceived certainty is derived from GDT, which can examine different acts or processes, such as detection [ 80 ] and punishment [ 73 ]. Two selected studies evaluated the impacts of peer influence and superior influence on different types of security behavior: protection intention [ 70 ] and non-compliance intention [ 82 ]. Both studies revealed that peer and superior influences significantly affect security behavior intentions through individual factors as mediating variables, such as subjective norms [ 70 ] and neutralization techniques [ 82 ].…”

“…This is consistent with the most frequently adopted foundational theories, the TPB and PMT, which focus on individual aspects of behavior. Although only two selected studies [ 50 , 82 ] explicitly segregated individual and organizational factors, many (16 studies) also examined both factors. Ten studies only used individual factors, while four studies only used organizational factors as significant antecedents to predict users’ security behavior.…”