Health-care security strategies for data protection and regulatory compliance

Research output: Journal Publications and Reviews (RGC: 21, 22, 62)21_Publication in refereed journal

25 Scopus Citations
View graph of relations

Author(s)

Detail(s)

Original languageEnglish
Pages (from-to)41-65
Journal / PublicationJournal of Management Information Systems
Volume30
Issue number2
Publication statusPublished - 2013

Abstract

This study identifies how security performance and compliance influence each other and how security resources contribute to two security outcomes: data protection and regulatory compliance. Using simultaneous equation models and data from 243 hospitals, we find that the effects of security resources vary for data breaches and perceived compliance and that security operational maturity plays an important role in the outcomes. In operationally mature organizations, breach occurrences hurt compliance, but, surprisingly, compliance does not affect actual security. In operationally immature organizations, breach occurrences do not affect compliance, whereas compliance significantly improves actual security. The results imply that operationally mature organizations are more likely to be motivated by actual security than compliance, whereas operationally immature organizations are more likely to be motivated by compliance than actual security. Our findings provide policy insights on effective security programs in complex health-care environments.

Research Area(s)

  • Compliance, Data breach, Health care, Organizational maturity, Security