Health-care security strategies for data protection and regulatory compliance

Research output: Journal Publications and ReviewsRGC 21 - Publication in refereed journalpeer-review

58 Scopus Citations
View graph of relations



Original languageEnglish
Pages (from-to)41-65
Journal / PublicationJournal of Management Information Systems
Issue number2
Publication statusPublished - 2013


This study identifies how security performance and compliance influence each other and how security resources contribute to two security outcomes: data protection and regulatory compliance. Using simultaneous equation models and data from 243 hospitals, we find that the effects of security resources vary for data breaches and perceived compliance and that security operational maturity plays an important role in the outcomes. In operationally mature organizations, breach occurrences hurt compliance, but, surprisingly, compliance does not affect actual security. In operationally immature organizations, breach occurrences do not affect compliance, whereas compliance significantly improves actual security. The results imply that operationally mature organizations are more likely to be motivated by actual security than compliance, whereas operationally immature organizations are more likely to be motivated by compliance than actual security. Our findings provide policy insights on effective security programs in complex health-care environments.

Research Area(s)

  • Compliance, Data breach, Health care, Organizational maturity, Security