Managing compliance with privacy regulations through translation guardrails: A health information exchange case study

2023 | Information and Organization | Citations: 0

Authors: Anderson, Chad; Baskerville, Richard; Kaul, Mala

Abstract: Information privacy is increasingly important in our digitally connected world, ... Expand

Abstract: Information privacy is increasingly important in our digitally connected world, particularly in healthcare, and privacy regulations are ramping up to promote appropriate privacy practices. As a digital platform that enables healthcare providers to exchange protected health information (PHI), a health information exchange (HIE) is governed by health information privacy regula­ tions. The challenge for HIEs is to operate in a way that will maximize information exchange while maintaining compliance with regulations that may constrain the sharing of PHI. Regula­ tions impose a measure of universality through compliance requirements, while being flexible to allow adaptation to the local context. However, our longitudinal case study into the privacy policies of an HIE, demonstrates that the journey of privacy ideas from their original formulation in regulations, to their ultimate enactment in an organizational setting, is accompanied by translations, such that the final implementation may vary extensively from its original form. Such variability often results in interpretations that differ from what the regulators intended. Conse­ quently, translation guardrails are necessary to protect against problematic translations of reg­ ulatory ideas which could lead to compliance issues and loss of platform participation. Our findings offer two contributions. First, we contribute to the compliance literature by explaining how guardrails can balance the use of permission and obligation schemas which are necessary to translate regulations into effective organizational policies for the success of HIEs and other in­ formation exchange platforms. Second, we contribute to extending translation theory by explaining how pragmatic reasoning schemas function as the mechanism through which trans­ lation of regulations occurs. Collapse

Topics: privacy information privacy law data security information exchange legal context

Methods: qualitative interview longitudinal research case study longitudinal case study literature study

Theories: organizational behavior theory

An Investigation of the Factors that Influence Job Performance During Extreme Events: The Role of Information Security Policies

2023 | Information Systems Frontiers | Citations: 0

Authors: Kisekka, Victoria; Goel, Sanjay

Abstract: Diligent compliance with Information security Policies (ISP) can effectively det ... Expand

Abstract: Diligent compliance with Information security Policies (ISP) can effectively deter threats but can also adversely impact organizational productivity, impeding organizational task completion during extreme events. This paper examines employees’ job performance during extreme events. We use the conservation of resources (COR) theory to examine how psychological resources (individual resilience, job meaningfulness, self-efficacy) and organizational resources (incident command leadership, information availability, and perceived effectiveness of security and privacy controls) influence ISP compliance decisions and job performance during extreme events. The results show that a one-size-fits-all approach to ISP is not ideal during extreme events; ISP can distract employees from critical job tasks. We also observed that under certain conditions, psychological resources, such as individual resilience, are reserved for job performance, while others, such as self-efficacy, are reserved for ISP compliance. A post hoc analysis of data from respondents who experienced strain during a real extreme event while at work was conducted. Our discussion provides recommendations on how security and privacy policies can be designed to reflect disaster conditions by relaxing some policy provisions. Collapse

Topics: task productivity self efficacy privacy data security productivity

Methods: survey post-hoc analysis statistical power analysis survey design theory development

Identifying the idiosyncrasies of behavioral information security discourse and proposing future research directions: A Foucauldian perspective

2023 | Journal of Information Technology | Citations: 0

Authors: Liang, Nan (Peter); Hirschheim, Rudy; Luo, Xin (Robert); Hollingsworth, Hayden

Abstract: Information security (InfoSec)–related behaviors have been defined in many diffe ... Expand

Abstract: Information security (InfoSec)–related behaviors have been defined in many different ways in the security literature. Indeed, the coexistence of varying terms describing IS security behaviors could be seen as a conceptual inconsistency. However, we believe that it could also be construed as the sign of a vivid and living field embracing dispersed objects of study without changing the disciplinary discourse itself. To test this belief, we conduct a two-part study. Study 1 analyzes the definitions of InfoSec-related behaviors in the existing security literature. The result of Study 1 uncovers the Foucauldian rules that make possible the discourse on behavioral information security, including the surface of emergence, authorities of delimitation, and the grids of specification. Study 1 also indicates that, although behavioral Information Systems Security (ISS) shares the three rules with other disciplines, it is the only field that studies the relations between them. We therefore propose a disciplinary question that reflects this idiosyncrasy. We then conduct Study 2, using Foucault’s view on preconceptual schemata as a theoretical lens, to identify understudied areas in the ISS literature. We found that the existing literature utilizes two variations of the actor and organization schemata to form or to adapt concepts, and utilize two different approaches to study these two variations, namely, an antecedents approach and a dialectics approach. It is noteworthy that the latter is important but understudied in the literature. We then draw an analogy from moral studies to develop three concepts for future ISS research, namely, Stages of Awareness Development, Security Agency, and Security Disengagement. Collapse

Topics: security policy organizational context decision making IT security bring your own device

Methods: theory development literature sample post-hoc analysis qualitative content analysis structured literature research

Theories: agency theory

Assessing the Impact of Virtual Health Communities and Environmental Characteristics of Chronic Pain Mobile Health Apps on Users’ Privacy Decisions: A Multilevel Perspective

2022 | Americas Conference on Information Systems | Citations: 0

Authors: Bantan, May; Alrefaei, Doaa; Alharbi, Raed

Abstract: Chronic pain has been identified as one of the most widespread health-related p ... Expand

Abstract: Chronic pain has been identified as one of the most widespread health-related problems. Potential chronic pain apps users seek health communities for current and previous reviews to assess the quality of the apps and make a decision regarding disclosing their information to these apps. In this study, we present a multilevel perspective on how virtual health communities and environmental characteristics of chronic pain mobile health apps impact users' privacy decisions. We used Exploratory Data Analysis and Machine Learning (ML) to operationalize the Theory of Multilevel Information Privacy. The results revealed that the most influential factors affecting users' cost-benefit analysis are Chronic Pain MHA's characteristics related to user's information privacy. The ML results indicate that the existence of information privacy policy can be predicted through the ways the apps use to Collect Data, App's Category, Country, and Store Type, which in turn affect users' decisions. Collapse

Topics: privacy mobile application mobile application market digital distribution shapley additive explanation

Methods: machine learning support vector machine exploratory data analysis natural language processing sentiment analysis

Theories: theory of multilevel information privacy privacy calculus theory

The interaction of dark traits with the perceptions of apprehension

2022 | HICSS | Citations: 0

Authors: Gaia, Joana; Murray, David; Sanders, George; Sanders, Sean; Upadhyaya, Shambhu; Wang, Xunyi; Yoo, Chul

Abstract: This paper integrates dark personality traits with the economics of crime and ra ... Expand

Abstract: This paper integrates dark personality traits with the economics of crime and rational choice theories to identify the role that the Dark Triad and thrill-seeking have on the perceptions of being caught engaging in violating privacy laws. Collapse

Topics: criminality Health Insurance Portability and Accountability Act personality information privacy law computer crime

Methods: survey partial least squares regression PLS tool

Theories: rational choice theory

A Social Science Approach Using Big Data for City Planning

2022 | International Conference on Information Systems | Citations: 0

Authors: Goh, Kim Huat; Boh, Waifong; Dommaraju, Premchand

Abstract: Cities bring about economic dynamism through positive economic externalities; h ... Expand

Abstract: Cities bring about economic dynamism through positive economic externalities; however, the concentration of people in dense locations has its costs -epidemics, social unrest, pollution, and congestion are some of the ills of cities. As cities evolve, they experience stress, and fault lines appear; the ability to pulse a city and provide early warning of these fault lines can prove advantageous for policymakers in managing and planning for cities. This paper outlines a research program that developed a city scanning tool to measure cities and detect aberrations as they surface. We aggregated data from various industry partners, governmental agencies, and public online sources to develop the measurement metric and applied social science theories to analyze and interpret the results. The results of this study contribute to information system (IS) research by showcasing the role IS research in city planning and for societal good. Collapse

Topics: social media healthcare data big data privacy Health Insurance Portability and Accountability Act

Methods: natural language processing archival research literature study latent dirichlet allocation survey

Theories: symbolic interaction theory social sciences theory theory of economic growth

Prosocial rule breaking on health information security at healthcare organisations in South Korea

2022 | Information Systems Journal | Citations: 4

Authors: Kim, Jongwoo; Park, Eun Hee; Park, Young Soon; Chun, Kyung Hee; Wiles, Lynn L.

Abstract: Regulations, such as the Health Insurance Portability and Accountability Act (HI ... Expand

Abstract: Regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), establish standards to protect patients' medical records from security breaches. Insiders' prosocial misbehaviour within healthcare organisations can cause significant damage to relevant stakeholders. Such behaviour without malicious intention needs to be better understood and carefully managed from the perspective of prosocial behaviour. For this study, a research model was developed that includes the factors influencing student nurses' intention to disclose patient health information. The model was empirically tested with nursing students in South Korea with a scenario-based experiment. We find that both altruistic (impact on others) and egoistic (impact on the self) motivations are significantly important in raising situational empathy. On the other hand, an egoistic motivation (impact on the self) significantly affects people's perception of their responsibility, which mediates the relationship between situational empathy and prosocial intention to disclose. The implications of our findings are discussed. Collapse

Topics: healthcare data IT security threat data security health information system decision making

Methods: experiment partial least squares regression survey theory development PLS tool

My Real Avatar has a Doctor Appointment in the Wepital: A System for Persistent, Efficient, and Ubiquitous Medical Care

2022 | Information & Management | Citations: 3

Authors: Zahedi, Fatemeh Mariam; Zhao, Huimin; Sanvanson, Patrick; Walia, Nitin; Jain, Hemant; Shaker, Reza

Abstract: COVID-19 created a great deal of personal, social, and economic anxiety in the U ... Expand

Abstract: COVID-19 created a great deal of personal, social, and economic anxiety in the USA and across the globe and exposed the inadequacy of traditional medical systems in handling large-scale emergencies. While telemedicine and virtual visits have become popular as a result, they end once a visit is over, hence lacking data persistence and continuity in caring for patients. Using the design science research approach with support from the theory of affordances, this paper proposes the design of a medical system (called wepital) in which patients receive care through their real avatars, enabling hospitals and other medical centers to provide immediate care that can continue for as long as a patient needs it. Real avatars are digital representations of patients that embody their real-time vital signs and health information. We have created a functional prototype to demonstrate how the proposed design can work. To assess the usability of the design, we have used the prototype in an experiment to provide medical advice to patient volunteers. Based on a theory-based conceptual model, we collected survey data after the experiment to identify factors contributing to the success of such a system, as measured by patient satisfaction. We report the factors that significantly contribute to the patients’ satisfaction. As part of the application and policy implications of our work, we propose a nationwide system that could supplement and expand the capacity of medical systems at the national or even global level. Collapse

Topics: user experience video conference healthcare data affordance information privacy concern

Methods: experiment design artifact wearables based research design requirement kernel theory

Theories: theory of affordance media synchronicity theory media naturalness theory media richness theory

The Travel of Privacy Standards and Regulations in Healthcare

2021 | HICSS | Citations: 0

Authors: Anderson, Chad; Baskerville, Richard; Kaul, Mala

Abstract: Increasing technology dependence by individuals and organizations has resulted i ... Expand

Abstract: Increasing technology dependence by individuals and organizations has resulted in a profusion of information privacy standards and regulations created to protect personal information. There are expectations of universality in the scope of standards and regulations but also, in most cases, some degree of flexibility that allows for adaptation and compliance with local requirements and influences. Our research into the privacy policy development at a health information exchange (HIE) finds that in practice, standards and regulations are subject to multiple translations that can result in policies and practices which inhibit the HIE’s goal of facilitating data exchange. Translation must therefore be appropriately managed by the HIE to ensure data exchange is not constrained. This has important theoretical and practical implications for health information privacy in an increasingly technology pervasive world, by contrasting the global view with the local view of information privacy, through an application of healthcare standards setting and execution. Collapse

Topics: privacy data security information exchange healthcare data Health Insurance Portability and Accountability Act

Methods: qualitative interview longitudinal research longitudinal case study personal interview case study

Disaggregating the Differential Impact of Healthcare IT in Complex Care Delivery: Insights from Field Research in Chronic Care

2021 | Journal of the Association for Information Systems | Citations: 2

Authors: Aron, Ravi; Pathak, Praveen

Abstract: This study focuses on the impact of digitizing medical information on the effic ... Expand

Abstract: This study focuses on the impact of digitizing medical information on the efficiency and perceived quality of chronic care delivery at the individual physician level. This study extends the theory of task technology fit to activity systems consisting of highly interdependent tasks. We find that the outcomes of efficiency and quality gains are driven by the structure of interdependencies between tasks that physicians perform. While structured information plays a key role in enabling both decision-making and task execution, we find that physician-created semistructured information is also an important predictor of both efficiency and quality gains. We show that the structure of activity systems (task interdependencies) has a strong moderating influence on the factors that drive efficiency and quality gains. We find that digitization enables physicians to preprocess patients' records prior to their visit which in turn drives gains in both the efficiency and the perceived quality of care delivered. Collapse

Topics: task characteristic healthcare data decision making productivity service quality

Methods: theory development longitudinal research Student's t-test parametric test survey design

Theories: theory of task technology fit graph theory organizational theory