Health-Care Security Strategies for Data Protection and Regulatory Compliance

• 成果类型: Article
• 署名作者: Kwon, Juhee; Johnson, M. Eric
• 署名单位: City University of Hong Kong; Vanderbilt University
• 刊物名称: JOURNAL OF MANAGEMENT INFORMATION SYSTEMS
• ISSN/ISSBN: 0742-1222
• DOI: 10.2753/MIS0742-1222300202
• 发表日期: 2013
• 页码: 41-65
• 关键词: RESOURCE-BASED VIEW; information-systems; EMPIRICAL-EXAMINATION; performance; TECHNOLOGY; management; complementarities; infrastructure; investments; governance

摘要

This study identifies how security performance and compliance influence each other and how security resources contribute to two security outcomes: data protection and regulatory compliance. Using simultaneous equation models and data from 243 hospitals, we find that the effects of security resources vary for data breaches and perceived compliance and that security operational maturity plays an important role in the outcomes. In operationally mature organizations, breach occurrences hurt compliance, but, surprisingly, compliance does not affect actual security. In operationally immature organizations, breach occurrences do not affect compliance, whereas compliance significantly improves actual security. The results imply that operationally mature organizations are more likely to be motivated by actual security than compliance, whereas operationally immature organizations are more likely to be motivated by compliance than actual security. Our findings provide policy insights on effective security programs in complex health-care environments.