Indirect effect of management support on users’ compliance behaviour towards information security policies

Abstract

Background:

Health information systems are innovative products designed to improve the delivery of effective healthcare, but they are also vulnerable to breaches of information security, including unauthorised access, use, disclosure, disruption, modification or destruction, and duplication of passwords. Greater openness and multi-connectedness between heterogeneous stakeholders within health networks increase the security risk.

Objective:

The focus of this research was on the indirect effects of management support (MS) on user compliance behaviour (UCB) towards information security policies (ISPs) among health professionals in selected Malaysian public hospitals. The aim was to identify significant factors and provide a clearer understanding of the nature of compliance behaviour in the health sector environment.

Method:

Using a survey design and stratified random sampling method, self-administered questionnaires were distributed to 454 healthcare professionals in three hospitals. Drawing on theories of planned behaviour, perceived behavioural control (self-efficacy (SE) and MS components) and the trust factor, an information system security policies compliance model was developed to test three related constructs (MS, SE and perceived trust (PT)) and their relationship to UCB towards ISPs.

Results:

Results showed a 52.8% variation in UCB through significant factors. Partial least squares structural equation modelling demonstrated that all factors were significant and that MS had an indirect effect on UCB through both PT and SE among respondents to this study.

Conclusion:

The research model based on the theory of planned behaviour in combination with other human and organisational factors has made a useful contribution towards explaining compliance behaviour in relation to organisational ISPs, with trust being the most significant factor. In adopting a multidimensional approach to management–user interactions via multidisciplinary concepts and theories to evaluate the association between the integrated management–user values and the nature of compliance towards ISPs among selected health professionals, this study has made a unique contribution to the literature.

Keywords

hospital information systems information management information security organisation and administration self-efficacy trust motivation organizational management health information management information protection data security

Get full access to this article

View all access options for this article.

References

Aaron

(2006) Transformational and transactional leadership: association with attitudes toward evidence-based practice. Psychiatric Services 57(8): 1162–1169.

Ahlan

Arshad

Lubis

(2011) Implication of human attitude factors toward information security awareness in Malaysia Public University. Paper presented at International Conference on Innovation and Management, 12–15 July 2011, Kuala Lumpur, Malaysia.

Ajzen

(1985) From intentions to actions: a theory of planned behavior. In: Kuhl

Beckman

(eds), Action-Control: From Cognition to Behavior. Heidelberg: Springer, pp. 11–39.

Akhunzada

Sookhak

Anuar

. (2015) Man-at-the-end attacks: analysis, taxonomy, human aspects, motivation and future directions. Journal of Network and Computer Applications 48: 44–57.

Al-Omari

El-Gayar

Deokar

(2012) Information security policy compliance: the role of information security awareness.

Al-Salihy

Ann

Sures

(2003) Effectiveness of information systems security in IT organizations in Malaysia. Communications, APCC 2003. In: The 9th Asia-Pacific Conference on, Vol. 2. IEEE, 2003.

Bahtiyar

Çağlayan

(2013) Trust assessment of security for e-health systems. Electronic Commerce Research and Applications 13(3): 164–177.

Beas

Salanova

(2006) Self-efficacy beliefs, computer training and psychological well-being among information and communication technology workers. Computers in Human Behavior 22: 1043–1058.

Brady

(2010) An investigation of factors that affect HIPAA security compliance in academic medical centers. Unpublished 3411810, Florida: Nova Southeastern University.

10.

Brady

(2011) Securing health care: assessing factors that affect hipaa security compliance in academic medical centers. Paper presented at the System Sciences (HICSS), 2011 44th Hawaii International Conference, Hawaii, 4–7 January 2011.

11.

Bulgurcu

Cavusoglu

Benbasat

(2010) Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Quarterly 34: 523–548.

12.

Celep

Yilmazturk

(2012) The relationship among organizational trust, multidimensional organizational commitment and perceived organizational support in educational organizations. Procedia – Social and Behavioral Sciences, 46: 5763–5776.

13.

Chan

Woon

Kankanhalli

(2005) Perceptions of information security in the workplace: linking information security climate to compliant behavior. Journal of Information Privacy and Security 1(3): 18–41.

14.

Chang

Liu

(2012) The effects of job satisfaction and organization commitment on information security policy adoption and compliance. Paper presented at the Management of Innovation and Technology (ICMIT), 2012 IEEE International Conference on., 11–13 June 2012.

15.

Christmas

(2005) Using partial least squares approach to predict factors that contribute to the impact of e-folios on pre-service teachers’ learning. PhD Dissertation. Louisiana: Louisiana State University.

16.

Chung

Kwon

(2009) Effect of trust level on mobile banking satisfaction: a multi-group analysis of information system success instruments. Behaviour & Information Technology 28(6): 549–562.

17.

Crosby

Evans

Cowles

(1990) Relationship quality in services selling: an interpersonal influence perspective. Journal of Marketing Theory and Practice 54(3): 68–82.

18.

Da Veiga

Eloff

JHP

(2010) A framework and assessment instrument for information security culture. Computers and Security 29: 196–207.

19.

Da Veiga

Martins

(2015) Improving the information security culture through monitoring and implementations actions illustrated through a case study. Computers & Security 49: 162–176.

20.

Guo

(2013) Security-related behavior in using information systems in the workplace: a review and synthesis. Computers & Security 32: 242–251.

21.

Hair

Black

Babin

. (2010) Multivariate Data Analysis: A Global Perspective. Upper Saddle River: Pearson Prentice Hall.

22.

Hair

Ringle

Sarstedt

(2013) Partial least squares structural equation modeling: rigorous applications, better results and higher acceptance. Long Range Planning 46: 1–12.

23.

Herath

Rao

(2009) Encouraging information security behaviors in organizations: role of penalties, pressures and perceived effectiveness. Decision Support Systems 47: 154–165.

24.

Hogler

Henle

Gross

(2013). Ethical behavior and regional environments: the effects of culture, values, and trust. Employee Responsibilities and Rights Journal 25: 109–121.

25.

Dinev

Hart

. (2012) Managing employee compliance with information security policies: the critical role of top management and organizational culture. Decision Sciences 43(4): 615–659.

26.

Huang

D-L

Rau

P-LP

Salvendy

. (2011) Factors affecting perception of information security and their impacts on IT adoption and security practices. International Journal of Human-Computer Studies 69: 870–883.

27.

Huang

Chuang

(2007) Extending the theory of planned behavior as a model to explain post-merger employee behavior of IS use. Computers in Human Behavior 23: 240–257.

28.

Ifinedo

(2012) Understanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory. Computers and Security 31: 83–95.

29.

Johnston

Warkentin

(2008) Information privacy compliance in the healthcare industry. Information Management and Computer Security 16: 5–19.

30.

Kankanhalli

Teo

H-H

Tan

BCY

. (2003) An integrative study of information systems security effectiveness. International Journal of Information Management 23: 139–154.

31.

Kim

Ferrin

Rao

(2008) A trust-based consumer decision-making model in electronic commerce: the role of trust, perceived risk, and their antecedents. Decision Support Systems 44: 544–564.

32.

Kim

Tao

Shin

. (2010) An empirical study of customers’ perceptions of security and trust in e-payment systems. Electronic Commerce Research and Applications 9: 84–95.

33.

Knapp

Franklin

Morris R

Jr Marshall

. (2009) Information security policy: an organizational-level process model. Computers & Security 28(7): 493–508.

34.

Koskosas

Kakulidis

Siomos

(2011) Examining the linkage between information security and end-user trust. International Journal of Computer Science and Information Security 9: 21–31.

35.

Krejcie

Morgan

(1970) Determining sample size for research activities. Educational and Psychological Measurement 30: 607–610.

36.

Leach

(2003) Improving user security behaviour. Computers and Security 22: 685–692.

37.

Liao

Chen

J-L

Yen

(2007) Theory of planning behavior (TPB) and customer satisfaction in the continued use of e-service: an integrated model. Computers in Human Behavior 23: 2804–2822.

38.

Lippert

Davis

(2006) A conceptual model integrating trust into planned change activities to enhance technology adoption behavior. Journal of Information Sciences 32: 434–448.

39.

Madhavan

Phillips

(2010) Effects of computer self-efficacy and system reliability on user interaction with decision support systems. Computers in Human Behavior 26: 199–204.

40.

Mcdermott

Conway

Rousseau

. (2013) Promoting effective psychological contracts through leadership: the missing link between HR strategy and performance. Human Resource Management 52: 289–310.

41.

Meillier

Lund

Kok

(1997) Cues to action in the process of changing lifestyle. Patient Education and Counseling 30: 37–51.

42.

Narayana Samy

Ahmad

Ismail

(2010) Security threats categories in healthcare information systems. Health Information Journal 16: 201–209.

43.

B-Y

Atreyi

Yunjie

(2009) Studying users’ computer security behavior: a health belief perspective. Decision Support Systems 46: 815–825.

44.

Padayachee

(2012) Taxonomy of compliant information security behavior. Computers and Security 31: 673–680.

45.

Pahnila

Siponen

Mahmood

(2007) Employees’ behavior towards IS security policy compliance. System sciences, HICSS 2007. In: 40th Annual Hawaii International Conference on. IEEE, 2007.

46.

Parsons

Mccormac

Butavicius

. (2014) Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q). Computers and Security 42: 165–176.

47.

Podsakoff

Organ

(1986) Self-reports in organizational research: problems and prospects. Journal of Management 12: 531–544.

48.

Preacher

Hayes

(2004) SPSS and SAS procedures for estimating indirect effects in simple mediation models. Behavior Research Methods, Instruments, & Computers 36(4): 717–731.

49.

Puhakainen

Ahonen

(2006) Design theory for information security awareness.

50.

Rhee

H-S

Kim

Ryu

(2009) Self-efficacy in information security: its influence on end users’ information security practice behavior. Computers and Security 28(8): 816–826.

51.

Rhee

(2010) Different effects of workers’ trust on work stress, perceived stress, stress reaction, and job satisfaction between Korean and Japanese workers. Safety and Health at Work 1: 87–97.

52.

Ringle

Wende

Will

(2005) SmartPLS 2.0 (M3) Beta [Online]. Available at: http://www.smartpls.de (accessed 20 December 2014).

53.

Safa

Von Solms

Furnell

(2016) Information security policy compliance behaviour model in organizations. Computers & Security 56: 70–82.

54.

Shahnawaz

Goswami

(2011) Effect of psychological contract violation on organizational commitment, trust and turnover intention in private and public sector Indian organizations. Vision (09722629) 15: 209–217.

55.

Singh

Fook

Sidhu

(2006) A comprehensive Guide to Writing a Research Proposal, Batu Caves, Selangor: Venton Publishing.

56.

Siponen

Mahmood

Pahnila

(2014) Employees’ adherence to information security policies: an exploratory field study. Information and Management 51: 217–224.

57.

Siponen

Pahnila

Mahmood

(2010) Compliance with information security policies: an empirical investigation. Computer 43: 64–71.

58.

Six

Sorge

(2008) Creating a high-trust organization: an exploration into organizational policies that stimulate interpersonal trust building. Journal of Management Studies 45: 857–884.

59.

Symantec (2013) Internet Security Threat Report 2013 (Vol. 18).

60.

Tan

Lim

AKH

(2009) Trust in coworkers and trust in organizations. Journal of Psychology 143: 45–66.

61.

Taylor

Todd

(1995) Decomposition and crossover effects in the theory of planned behavior: a study of consumer adoption intentions. International Journal of Research in Marketing 12: 137–155.

62.

Torkzadeh

Van Dyke

(2002) Effects of training on Internet self-efficacy and computer user attitudes. Computers in Human Behavior 18: 479–494.

63.

Uffen J Breitner

(2013) Management of technical security measures: an empirical examination of personality traits and behavioral intentions. System Sciences (HICSS), 2013 46th Hawaii International Conference on. IEEE, 2013.

64.

Utami

Bangun

Lantu

(2014) Understanding the role of emotional intelligence and trust to the relationship between organizational politics and organizational commitment. Procedia – Social and Behavioral Sciences 115: 378–386.

65.

Van Deursen

Buchanan

Duff

(2013) Monitoring information security risks within health care. Computers & Security 37: 31–45.

66.

Williams

PAH

(2008) In a ‘trusting’ environment, everyone is responsible for information security. Information Security Technical Report 13: 207–215.

67.

Williams

PAH

(2009) Capturing culture in medical information security research. Methodological Innovations Online 4: 15–26.

68.

Wood

Banks

Jr (1993) Human error: an overlooked but significant information security problem. Computers and Security 12(1): 51–60.

69.

Woodhouse

(2007) Information security: end user behavior and corporate culture. Computer and Information Technology. CIT 2007. In: 7th IEEE International Conference on. IEEE, 2007.

70.

Workman

Bommer

Straub

(2008) Security lapses and the omission of information security measures: a threat control model and empirical test. Computers in Human Behavior 24: 2799–2816.