Evaluating Information Security Effectiveness with Health Professionals

  • Robin Krens
  • Marco Spruit
  • Nathalie Urbanus
Part of the Communications in Computer and Information Science book series (CCIS, volume 273)


This paper outlines an alternative view on the information security discipline. We argue that information security is, in general, viewed from a technological and means-end oriented perspective. Our approach can be seen as an initial attempt to approach information security in a broader, more holistic, sense. For this purpose, we approach information security from a health professional’s perspective. An instrument, The Information Security Employee’s Evaluation (ISEE), is presented to evaluate and discuss information security with health professionals. The ISEE instrument consists of seven dimensions: priority, responsibility, incident handling, functionality, communication, supervision and training and education. The ISEE instrument can be used to better understand health professional’s perception, needs and problems when dealing with information security in practice. Following the design science approach, the ISEE instrument was validated within a focus group of security experts and pilot tested as workshops across five hospital departments in two medical centers. Although the ISEE instrument has by no means the comprehensiveness of existing security standards, we do argue that the instrument can provide valuable insights for both practitioners and research communities.


Information security Evaluation Human perspective 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Ashenden, D.: Information security management: A human challenge? Information Security Technical Report 13(4), 195–201 (2008)CrossRefGoogle Scholar
  2. 2.
    Barber, B.: Patient data and security: an overview. International Journal of Medical Informatics 49(1), 19–30 (1998)CrossRefGoogle Scholar
  3. 3.
    Dhillon, G., Backhouse, J.: Current directions in IS security research: towards socio-organizational perspectives. Information Systems Journal 11(2), 127–154 (2001)CrossRefGoogle Scholar
  4. 4.
    Fernando, J.I., Dawson, L.L.: The health information system security threat lifecycle: An informatics theory. International Journal of Medical Informatics 78(12), 815–826 (2009)CrossRefGoogle Scholar
  5. 5.
    Ferreira, A., Antunes, L., Chadwick, D., Correia, R.: Grounding information security in healthcare. International Journal of Medical Informatics 79(4), 268–283 (2010)CrossRefGoogle Scholar
  6. 6.
    Gollman, D.: Computer Security, 1st edn. John Wiley & Sons (1999)Google Scholar
  7. 7.
    Gaunt, N.: Practical approaches to creating a security culture. International Journal of Medical Informatics 60(2), 151–157 (2000)CrossRefGoogle Scholar
  8. 8.
    Hevner, A.R., March, S.T., Park, J., Ram, S.: Design science in information systems research. MIS Quarterly 28(1), 75–105 (2004)Google Scholar
  9. 9.
    International Organization for Standardization. Information technology – security techniques – code of practice for information security management. Technical Report ISO/IEC 27002:2005 (2005)Google Scholar
  10. 10.
    Kraemer, S., Carayon, P.: Computer and information security culture: Findings from two studies. In: Human factors and the Ergonomics Environment, pp. 1483–1487. Human Factors and the Ergonomics Society, Orlando (2005)Google Scholar
  11. 11.
    Nosworthy, J.D.: Implementing information security in the 21st century do you have the balancing factors? Computers & Security 19(4), 337–347 (2000)CrossRefGoogle Scholar
  12. 12.
    OECD: Guidelines for the security of information systems and networks: Towards a culture of security. Technical report, Organization for Economic Cooperation and Development, Paris (2002)Google Scholar
  13. 13.
    Parker, D., Hudson, P.T.: HSE: Understanding your culture. Shell International Exploration and Production EP 2001 - 5124 (2001)Google Scholar
  14. 14.
    Pope, C., Mays, N., Kitzinger, J. (eds.): Qualitative research in health care, chapter Focus Groups, 3rd edn., pp. 21–31. Blackwell Publishing, Oxford (2006)Google Scholar
  15. 15.
    Reason, J.: The identification of latent organizational failures in complex systems. In: Wise, J.A., Hopkin, V.D., Stager, P. (eds.) Verification and Identification of Complex Systems: Human Factor Issues, pp. 223–237. Springer, New York (1993)Google Scholar
  16. 16.
    Siponen, M.T.: An analysis of the traditional IS security approaches: implications for research and practice. European Journal of Information Systems 14(3), 305–315 (2005)CrossRefGoogle Scholar
  17. 17.
    Siponen, M.T.: Information security standards focus on the existence of process, not its content. Communications of the ACM 49(8), 97–100 (2006)CrossRefGoogle Scholar
  18. 18.
    Stamp, M.: Information security: principles and practice, 2nd edn. John Wiley & Sons, Hoboken (2006)Google Scholar
  19. 19.
    University of Manchester and National Patient Safety Agency: Manchester Patient Safety Framework MaPSaF,
  20. 20.
    Westrum, R.: Cultures with requisite imagination. In: Wise, J.A., Hopkin, V.D., Stager, P. (eds.) Verification and Validation in Complex Man-machine Systems, pp. 401–416. Springer, New York (1993)Google Scholar
  21. 21.
    Williams, P.A.H.: When trust defies common security sense. Health Informatics Journal 14(3), 211–221 (2008)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Robin Krens
    • 1
  • Marco Spruit
    • 2
  • Nathalie Urbanus
    • 1
  1. 1.University Medical Center UtrechtUtrechtThe Netherlands
  2. 2.Department of Information and Computing ScienceUtrecht UniversityUtrechtThe Netherlands

Personalised recommendations