Skip to main content

Advertisement

SpringerLink
Log in

A Deterrence Approach to Regulate Nurses’ Compliance with Electronic Medical Records Privacy Policy

  • Systems-Level Quality Improvement
  • Published:
Journal of Medical Systems Aims and scope Submit manuscript

Abstract

Hospitals have become increasingly aware that electronic medical records (EMR) may bring about tangible/intangible benefits to managing institutions, including reduced medical errors, improved quality-of-care, curtailed costs, and allowed access to patient information by healthcare professionals regardless of limitations. However, increased dependence on EMR has led to a corresponding increase in the influence of EMR breaches. Such incursions, which have been significantly facilitated by the introduction of mobile devices for accessing EMR, may induce tangible/intangible damage to both hospitals and concerned individuals. The purpose of this study was to explore factors which may tend to inhibit nurses’ intentions to violate privacy policy concerning EMR based upon the deterrence theory perspective. Utilizing survey methodology, 262 responses were analyzed via structural equation modeling. Results revealed that punishment certainty, detection certainty, and subjective norm would most certainly and significantly reduce nurses’ intentions to violate established EMR privacy policy. With these findings, recommendations for health administrators in planning and designing effective strategies which may potentially inhibit nurses from violating EMR privacy policy are discussed.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2

Similar content being viewed by others

References

  1. Li, T., and Slee, T., The effects of information privacy concerns on digitizing personal health records. J. Am. Med. Inform. Assn. 65:1541–1554, 2014. https://doi.org/10.1002/asi.23068.

    Google Scholar 

  2. Zhou, L., et al., The relationship between electronic health record use and quality of care over time. J. Am. Med. Inform. Assn. 16:457–464, 2009.

    Article  Google Scholar 

  3. Culnan, M.J., and Williams, C.C., How ethics can enhance organizational privacy: Lessons from the choicepoint and tjx data breaches. MIS Quart. 33:673–687, 2009.

    Article  Google Scholar 

  4. D’Arcy, J., and Devaraj, S., Employee misuse of information technology resources: Testing a contemporary deterrence model. Decis. Sci. 43:1091–1124, 2012. https://doi.org/10.1111/j.1540-5915.2012.00383.x.

    Article  Google Scholar 

  5. Hu, Q., Dinev, T., Hart, P., and Cooke, D., Managing employee compliance with information security policies: The critical role of top management and organizational culture. Decis. Sci. 43:615–660, 2012. https://doi.org/10.1111/j.1540-5915.2012.00361.x.

    Article  Google Scholar 

  6. Sher, M.L., Talley, P.C., Cheng, T.J., and Kuo, K.M., How can hospitals better protect the privacy of electronic medical records? Perspectives from staff members of health information management departments. Health Inf. Manag. J. 46:87–95, 2017. https://doi.org/10.1177/1833358316671264.

    Google Scholar 

  7. Ifinedo, P., Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory. Comput. & Secur. 31:83–95, 2012. https://doi.org/10.1016/j.cose.2011.10.007.

    Article  Google Scholar 

  8. Vroom, C., and von Solms, R., Towards information security behavioural compliance. Comput. & Secur. 23:191–198, 2004. https://doi.org/10.1016/j.cose.2004.01.012.

    Article  Google Scholar 

  9. Chen, Y., Ramamurthy, K., and Wen, K.W., Organizations' information security policy compliance: Stick or carrot approach? J. Manage. Inform. Syst. 29:157–188, 2012.

    Google Scholar 

  10. D’Arcy, J., Hovav, A., and Galletta, D., User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Inform. Syst. Res. 20:79–98, 2009.

    Article  Google Scholar 

  11. D’Arcy, J., and Hovav, A., Does one size fit all? Examining the differential effects of is security countermeasures. J. Bus. Ethics. 89:59–71, 2009. https://doi.org/10.1007/s10551-008-9909-7.

    Article  Google Scholar 

  12. Guo, K.H., and Yuan, Y., The effects of multilevel sanctions on information security violations: A mediating model. Inform. Manage. 49:320–326, 2012.

    Google Scholar 

  13. Herath, T., and Rao, H.R., Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decis. Supp. Syst. 47:154–165, 2009.

    Google Scholar 

  14. Herath, T., and Rao, H.R., Protection motivation and deterrence: A framework for security policy compliance in organisations. Eur. J. Inf. Syst. 18:106–125, 2009.

    Article  Google Scholar 

  15. Hovav, A., and D’Arcy, J., Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the U.S. and South Korea. Inform. Manage. 49:99–110, 2012. https://doi.org/10.1016/j.im.2011.12.005.

    Article  Google Scholar 

  16. Hu, Q., Xu, Z., Dinev, T., and Ling, H., Does deterrence work in reducing information security policy abuse by employees? Comm. ACM. 54:54–60, 2011.

    Article  Google Scholar 

  17. Li, H., Zhang, J., and Sarathy, R., Understanding compliance with internet use policy from the perspective of rational choice theory. Decis. Supp. Syst. 48:635–645, 2010. https://doi.org/10.1016/j.dss.2009.12.005.

    Article  Google Scholar 

  18. Pahnila, S., Siponen, M., and Mahmood, A., Employees' behavior towards is security policy compliance (2007) paper presented at 40 th annual Hawaii international conference onSystem sciences. Big Island, Hawaii, pp. 156b–156b, 2007.

    Google Scholar 

  19. Siponen, M., and Vance, A., Neutralization: New insights into the problem of employee systems security policy violations. MIS Quart. 34:487–502, 2010.

    Article  Google Scholar 

  20. Ma, C.C., Kuo, K.M., and Alexander, J.W., A survey-based study of factors that motivate nurses to protect the privacy of electronic medical records. BMC Med. Inform. Decis. Mak. 16:13, 2016. https://doi.org/10.1186/s12911-016-0254-y.

    Article  PubMed  PubMed Central  Google Scholar 

  21. Sher, M.L., Talley, P.C., Yang, C.W., and Kuo, K.M., Compliance with electronic medical records privacy policy: An empirical investigation of hospital information technology staff. Inquiry-J. Health. Car. 54:1–12, 2017. https://doi.org/10.1177/0046958017711759.

    Google Scholar 

  22. Foth, M., Factors influencing the intention to comply with data protection regulations in hospitals: Based on gender differences in behaviour and deterrence. Eur. J. Inf. Syst. 25:91–109, 2016. https://doi.org/10.1057/ejis.2015.9.

    Article  Google Scholar 

  23. Foth, M., Schusterschitz, C., and Flatscher-Thöni, M., Technology acceptance as an influencing factor of hospital employees’ compliance with data-protection standards in germany. J Public Health. 20:253–268, 2012. https://doi.org/10.1007/s10389-011-0456-9.

    Article  Google Scholar 

  24. Yang, C.G., and Lee, H.J., A study on the antecedents of healthcare information protection intention. Inform. Syst. Front. 18:253–263, 2016. https://doi.org/10.1007/s10796-015-9594-x.

    Article  Google Scholar 

  25. Li, H., Sarathy, R., Zhang, J., and Luo, X., Exploring the effects of organizational justice, personal ethics and sanction on internet use policy compliance. Inform. Syst. J. 24:479–502, 2014. https://doi.org/10.1111/isj.12037.

    Article  CAS  Google Scholar 

  26. Gibbs, J.P., Crime, punishment, and deterrence. Southwest. Soc. Sci. Q. 48:515–530, 1968.

    Google Scholar 

  27. Anderson, C.L., and Agarwal, R., The digitization of healthcare: Boundary risks, emotion, and consumer willingness to disclose personal health information. Inform. Syst. Res. 22:469–490, 2011.

    Article  Google Scholar 

  28. Top, M., and Gider, Ö., Nurses’ views on electronic medical records (emr) in turkey: An analysis according to use, quality and user satisfaction. J. Med. Syst. 36:1979–1988, 2012.

    Article  PubMed  Google Scholar 

  29. Erickson, J. I., and Millar, S., Caring for patients while respecting their privacy: Renewing our commitment. Online J. Issues Nurs. 10, 2005. doi: https://doi.org/10.3912/OJIN.Vol10No02Man01

  30. Rindfleisch, T.C., Privacy, information technology, and health care. Comm. ACM. 40:92–100, 1997.

    Article  Google Scholar 

  31. Tittle, C.R., Crime rates and legal sanctions. Soc. Probl. 16:409–423, 1969.

    Article  Google Scholar 

  32. D’Arcy, J., and Herath, T., A review and analysis of deterrence theory in the is security literature: Making sense of the disparate findings. Eur. J. Inf. Syst. 20:643–658, 2011.

    Article  Google Scholar 

  33. Pratt, T.C., Cullen, F.T., Blevins, K.R., Daigle, L.E., and Madensen, T.D., The empirical status of deterrence theory: A meta-analysis. In: Cullen, F.T., Wright, J.P., and Blevins, K.R. (Eds.), Taking stock: The status of criminological theory. Transaction Publisher, New Bronswick, NJ, pp. 367–396, 2006.

    Google Scholar 

  34. Gopal, R.D., and Sanders, G.L., Preventive and deterrent controls for software piracy. J. Manage. Inform. Syst. 13:29–48, 1997.

    Google Scholar 

  35. Onwudiwe, I., Odo, J., and Onyeozili, E., Deterrence theory. In: Bosworth, M. (Ed.), Encyclopedia of prisons & correctional facilities. Sage Publications, Inc, Thousand Oaks, CA, pp. 234–238, 2005.

    Google Scholar 

  36. Siponen, M., Mahmood, M.A., and Pahnila, S., Employees’ adherence to information security policies: An exploratory field study. Inform. Manage. 51:217–224, 2014. https://doi.org/10.1109/mc.2010.35.

    Google Scholar 

  37. Piquero, A., and Tibbetts, S., Specifying the direct and indirect effects of low self-control and situational factors in offenders' decision making: Toward a more complete model of rational offending. Justice. Q. 13:481–510, 1996. https://doi.org/10.1080/07418829600093061.

    Article  Google Scholar 

  38. Ministry of Health and Welfare (2009) Regulations governing the production and management of electronic medical records, Retrieved from http://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=L0020121 (Accessed 7th July, 2017).

  39. Theoharidou, M., Kokolakis, S., Karyda, M., and Kiountouzis, E., The insider threat to information systems and the effectiveness of iso17799. Comput. & Secur. 24:472–484, 2005. https://doi.org/10.1016/j.cose.2005.05.002.

    Article  Google Scholar 

  40. American Nurses Association (2014) Code of ethics for nurses with interpretive statements, Retrieved from http://nursingworld.org/MainMenuCategories/EthicsStandards/CodeofEthicsforNurses/Code-of-Ethics.pdf (Accessed 10th June 2017).

  41. Kock, N., Using warppls in e-collaboration studies: Mediating effects, control and second order variables, and algorithm choices. Int. J. e-Collab. (IJeC). 7:1–13, 2011.

    Google Scholar 

  42. Peace, A.G., Galletta, A.G., and Thong, J.Y.L., Software piracy in the workplace: A model and empirical test. J. Manage. Inform. Syst. 20:153–177, 2003.

    Google Scholar 

  43. Straub, D.W., Effective is security: An empirical study. Inform. Syst. Res. 1:255–276, 1990.

    Article  Google Scholar 

  44. Ifinedo, P., Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition. Inform. Manage-Amster. 51:69–79, 2014. https://doi.org/10.1016/j.im.2013.10.001.

    Article  Google Scholar 

  45. Siponen, M., Pahnila, S., and Mahmood, M.A., Compliance with information security policies: An empirical investigation. Comput. 43:64–71, 2010.

    Article  Google Scholar 

  46. Chan, M., Woon, I., and Kankanhalli, A., Perceptions of information security in the workplace: Linking information security climate to compliant behavior. J. Inform. Priv. Secur. 1:18–41, 2005.

    Article  Google Scholar 

  47. Ministry of Health and Welfare (2017) Bulletin of emrs adoption, Retrieved from http://emr.mohw.gov.tw/emrlist.aspx (Accessed 7th July, 2017).

  48. Fornell, C., and Larcker, D.F., Evaluating structural equation models with unobservable variables and measurement error. J. Marketing Res. 18:39–50, 1981.

    Article  Google Scholar 

  49. Hair, J.F., Hult, G.T.M., Ringle, C.M., and Sarstedt, M., A primer on partial least squares structural equation modeling (pls-sem). Sage, Thousand Oaks, California, 2014.

    Google Scholar 

  50. Wetzels, M., Odekerken-Schröder, G., and van Oppen, C., Using pls path modeling for assessing hierarchical construct models: Guidelines and empirical illustration. MIS Quart. 33:177–195, 2009.

    Article  Google Scholar 

  51. Askar, M.A., and Shen, K.N., Assessment of cybersecurity knowledge and behavior: An anti-phishing scenario, paper presented at the 22nd Americas Concerence on information systems. San Diego, CA. 2016:1–10, 2016.

Download references

Author information

Authors and Affiliations

  1. Department of Healthcare Administration, I-Shou University, Kaohsiung City, Taiwan

    Kuang-Ming Kuo & Yen-Liang Chen

  2. Department of Applied English, I-Shou University, Kaohsiung City, Taiwan

    Paul C. Talley

  3. Department of Information Management, Nanhua University, Chiayi County, Taiwan

    Ming-Chien Hung

Authors
  1. Kuang-Ming Kuo
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Paul C. Talley
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Ming-Chien Hung
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Yen-Liang Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ming-Chien Hung.

Ethics declarations

Conflict of Interest

The authors declare that they have no conflict of interest.

Ethical Approval

All procedures performed in studies involving human participants were in accordance with the ethical standards of the institutional and/or national research committee and with the 1964 Helsinki declaration and its later amendments or comparable ethical standards. This article does not contain any studies with animals performed by any of the authors.

Informed Consent

Informed consent was obtained from all individual participants included in the study.

Additional information

This article is part of the Topical Collection on Systems-Level Quality Improvement

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Kuo, KM., Talley, P.C., Hung, MC. et al. A Deterrence Approach to Regulate Nurses’ Compliance with Electronic Medical Records Privacy Policy. J Med Syst 41, 198 (2017). https://doi.org/10.1007/s10916-017-0833-1

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1007/s10916-017-0833-1

Keywords

Search

Navigation