Assessment of cybersecurity awareness among healthcare professionals. A cross sectional study

Abstract

Cybersecurity is a major concern in managing hospital data concerning patients, and its knowledge is requisite for all healthcare professionals. The aim of this study was to assess the awareness regarding cybersecurity amongst healthcare professionals in India. This cross-sectional survey study was conducted upon healthcare professionals. The questionnaire items were based on recommendations by the European Union Agency for Network and Information Security and the US Department of Health and Human Services. The survey forms were distributed through electronic mail. Institutional ethical committee clearance was obtained before beginning this study. Two hundred healthcare persons were randomly selected, and consent forms were taken. A total of 195 fully filled survey forms alongside consent forms were obtained. The inclusion criteria were a) healthcare professionals, b) those with access to computers for the acquisition/entry of data, and c) hospitals thatemployed software for the entry of data. The exclusion criteria of the study were a) anyone who was not in healthcare b) those with no accessibility to computers for the entry of data and c) those who did not consent for participating in the study. Statistical analysis: SPSS software tool was used for analyzing collected data. Results for independent questions were analyzed in form of percentage distribution for observational data. Low knowledge and awareness werefound among healthcare professionals with nursing and physiotherapy professionals have least awareness regarding cybersecurity requirement for storage and data protection in hospital set-ups.

Introduction

Cybersecurity is a major influence on health-care segment primarily because of sensitive nature of patient data and medical appliances, which if attacked may compromise lives, safety as well as patients’well-being. Most hospitals demonstrate failure in implementing adequate policies for protecting the data and for training programs for training for cybersecurity and creating awareness regarding cybersecurity.[1]

As per ISO/IEC 27032:2012, “cybersecurity” can be defined as “preserving the confidentiality, integrity as well as availability of data in cyberspace”.[2] Cyberspace is defined as “complex environment as a result of interactions amongst individuals, computer software’s, and available services over Internet by making use of technological devices as well as inter- connected networks”. A safe environment in cyberspace can be achieved using a combination of multi-disciplinary approaches that are aimed toward enhancing the knowledge, attitude, behavior as well as awareness regarding cyber risks and associated threats. This may involve educational updates, auditing of IT-based infrastructure along with reviewing security-based policies in order to raise awareness amongst hospital personnels regarding patient data processing in running day-to-day business-related operations that can prevent cyber-attacks and/or data leakage.[3]

Hence, technology is now playing a major role in improving health-care sector by facilitation of accessibility of real-time data, clinical trials and clinical diagnoses. However, use of technology is accompanied by fresh challenges with regards to privacy as well as safety concerns. Healthcare and hospital associated institutions faced 27% of total cyberattacks in Europeand Portugal in year, 2018.[3] In year 2021, Portuguese healthcare and education institutions along with public administration departments faced cyber-attack for upto 881 times/week, hence showing 81% increase than 2020.[4]

WannaCry, a ransomware cyber-attack on UK’s National Health System suffered an estimated loss of 105 million Euros in 2017. As a result of this over-ride, over nineteen thousand scheduled appointments got canceled that exerted a major impact over normal functioning of healthcare system. This phishing tool once downloaded infected the encrypted computer files and demanded a ransom amount for unlocking them. Hence, such attacks on stored data in computers can be prevented if such files and encrypted messages can be identified and are not downloaded by hospital personnels.[5] Phishing, ransom-ware, loss or theft of medical/hospital data, accidental and/or intentional loss of data constitute common methods used for compromising safety of data in hospitals. Human error has been linked with over 80% cyber- and mal-ware attacks.[6] Hence, proper computer training for healthcare workers is a requirement for increasing awareness about cyber-security and for mitigating the after-effects of similar attacks.[5]

The healthcare professionals undergo training to treat and provide health care to patients. The academic curriculum has no inclusion of cybersecurity and skills that are linked with information technology. In addition, each health-care professional has a unique background, has been trained under different program during post-graduation, as well as different tasks. Also, there are different types of requirement and levels in proficiency that are associated with use of technology. Healthcare sector professionals constitute a heterogeneous group of population wherein strategies which use “single-size fits all” do not work. Hence, effective training is required and fundamental to mitigate the low level of cybersecurity awareness shown by the health professionals. Hence, development of strategy which combines both time and resource management for effective acquisitionof cybersecurity knowledge as well as retention of this skill is required.

Hence, keeping this in view current study was designed with an aim to assess of cybersecurity awareness among healthcare professionals in India.

Materials and Methods

Study design and setting

This was a survey based cross-sectional study conducted on healthcare professionals based upon recommendations about cybersecurity by European Union Agency for Network and Information Security and US Department of Health and Human Services.[7,8] Questionnaire items were based upon the recommendations of these institutions.

Study participants and sampling

Institutional ethical committee clearance was taken before initiating the study (IEC/99M23-T).

Sample size was determined using the formula-

Where n’ = sample size with finite population correction, N = population size, Z = Z statistic for confidence level (Z value = 1.96), P = expected prevalence, d = precision (5%, d = 0.05).

Total 200 healthcare professionals who were randomly selected were send survey questionnaires via electronic mail. A consent form was also designed which the study participant had to agree with before commencement of marking the items. Total of 195 completely filled up questionnaires with consent forms were received.

This survey questionnaire contained 23 singles, as well as multiple choice questions. The questionnaire was divided in four segments: 1) Particulars of the study respondents i.e. information related, 2) use of electronic and computer systems at health-care hospital (Part I), 3) knowledge as well as skills concerned with cyber security (Part II) and 4) basic scenarios related to cyberattacks (Part III). Filled survey forms were collected anonymously via electronic mail [Figure 1].

Figure 1.

Showing theoretical framework study design

Data collection tools and techniques

The questionnaire items were rated on a two-point scale of 0 (no) or 1 (yes). Obtained results were categorized to measure level of awareness about cyber security amongst studied professionals. Inclusion criteria included: I) Only healthcare professionals; ii) those who accessed computers for data acquisition or entry and iii) those who worked in hospitals that used software’s for data entry. Exclusion criteria included: I) non-medico or Dental or healthcare professionals; ii) those did not have access to computers for data entry andiii) those did not give consent in study participation.

Statistical analysis

SPSS software tool was used for analyzing collected data. Results for independent questions were analyzed in form of percentage distribution for observational data.

Results

Demographic characteristics

195 healthcare professionals willingly participated in this survey after providing consent via electronic mail. After categorizing participants, 99 were medical doctors, 78 were dental professionals, 10 were of nursing profession while 08 were physiotherapists (P = 0.05). Participants were aged between 39 to 45 years (median age = 42 years). Gender distribution was found to be 60% (males) and 40% (females) which was statistically significant (P = 0.042). Most participants (68.4%) belonged to urban areas, 19.4% belong to semi-urban while 12.2% were practicing in rural areas. This was found to be statistically significant (P = 0.051).

Knowledge level

On enquiring upon training on cyber security, it was observed that 34% medical practitioners, 23% dentists, 12% nurses and 11% physiotherapists had received training on the same (P = 0.05, significant difference). 23% of medical doctors, 21% dental doctors, 17% nursing personnels and 09% physiotherapists felt that computerized or electronic mail circulation was adequately protected. However, this showed no statistical significance (P = 0.061). The use of smart phones or tablets for reading medical records was being performed by 90%, 89%, 79%, and 80% of medical practitioners, dental surgeons, nursing professionals and physiotherapy specialists (P = 0.07, no statistically significant difference). 78% of medical doctors, 45% dental and nursing professionals and 67% physiotherapists had the knowledge that copying any medical records on a non-secure portable device was not allowed (P = 0.053, statistically significant). 98% medical, 89% dental, 34% nursing and 56% physiotherapists had no accessibility to medical records. This was found to be statistically significant (P = 0.053). 98% medical, 89%, dental and nursing and 78% physiotherapy specialists had knowledge that incorrect entries were not allowed by the computer system (P = 0.076, non-significant)[Table 1, Figure 2].

Table 1.

Table demonstrating computer usage skills in studied participants

Questionnaire items		Medical practitioners		Dental professionals		Nurses		Physiotherapists		P
Have you received any training on cyber security?		34% (yes)		23% (yes)		12%		11%		0.05
Is the electronic/computerized circulation of medical documents at your setup have adequate protection?		23%		21%		17%		09%		0.061
Do you use smart phone or a tablet for reading electronic records?		90%		89%		79%		80%		0.07
Is copying of patient records onto any non-secure portable device storage allowed?		78% (No)		45% (No)		45% (No)		67% (No)		0.053
Does the computer program used for storing electronic records allow accessibility to all personnels?		98% (no)		89% (No)		34% (No)		56% (No)		0.053
On incorrectly making any entry in electronic records system, does the computer cautions or does not allow it?		98% (yes)		89% (yes)		89% (yes)		78%(yes)		0.076

Figure 2.

Showing computer skills in participants

On assessing knowledge about cybersecurity, it was noted that 89% medical practitioners, 82% dental surgeons, 87% nursing professionals and 87% physiotherapists possessed knowledge related with medico-legal aspects of public disclosure of patient data (P = 0.67, no significance). 49% medical professionals, 58% dental practitioners, 43% nursing staff and 45% physiotherapy professionals felt that it was secure to send medical records through electronic mail (P = 0.075, no significance). 51% medical doctors, 49% dentists, 43% nursing and 32% physiotherapy personnels had knowledge regarding on-line available tools that can impersonate email ids. However, this difference in percentages was found to have no significance (P = 0.073). 45% medical, 43% dental, 46% nursing and 39% physiotherapy professionals were having knowledge regarding electronic signatureswith no statistical significance (P = 0.062). 34% medical, 12% dental, 10% nursing and 0% physiotherapists had issued medical certificates by signing digitally. This was found to be significant (P = 0.043). 12% medical professionals, 10% dental practitioners, 04% nursing and 01% physiotherapy professionals were having knowledge regarding securing e-documents, which had no significant difference (P = 0.082). 89% medical practitioners, 88% dentists, 87% nursing and 85% physiotherapy personnels possessed knowledge that a pdf document containing scanned medical document has higher legal weightage when compared with a pdf document that has no digitalized signatures. However, no statistically significant difference was found (P = 0.072). 92%, 90%, 89% and 87% medical, dental, nursing and physiotherapy professionals had knowledge regarding regular updating of computer software. This was found to have no statistically significant difference (P = 0.078) [Table 2, Figure 3].

Table 2.

Awareness regarding cybersecurity

Questionnaire items		Medical practitioners		Dental surgeons		Nursing professionals		Physiotherapists		P
Do have the knowledge related to medico-legal consequences which can be related with public disclosure of patient medical data?		89%		82%		87%		87%		0.67
Is it secure to send patient medical records via e-mail?		49% (code 0, no)		58% (code 0, no)		43% (code 0, no)		45% (code 0, no)		0.082
Do you know that there are on-line tools which allow impersonation of e-mail addresses?		51%		49%		43%		32%		0.082
Is it possible to sign documents electronically?		45%		43%		46%		39%
Have you ever issued medical certificates using digital signatures?		34%		12%		10%		0%		0.03
Do you know how to secure e-documents?		12%		10%		04%		01%		0.04
Does any pdf file which contains scanned printed as well as signed medical document hold greater legal weightage over pdf document with no electronic signatures?		Yes (89%)		Yes (88%)		Yes (87%)		Yes (85%)		0.072
Does your computer software gets updated continuously?		92%		90%		89%		87%		0.078

Figure 3.

Showing awareness regarding cybersecurity

Discussion

Organizations associated with health care work with a commitment for providing quality care to patients. Risking of patient data safety towards cyber-attack is a scary scenario for any health-care person. However, there are rising costs of investments in medical equipment’s, materials, personnel training and man-power which are closely related with patient health care. Hence, it is difficult to invest in cybersecurity at the same time. According to data from IBM Security and Ponemon Institute, cost of breach of data in healthcare organizations has increased from $380 in 2017 to $408 in 2018.[9] It has been observed that amongst all the industries, health-care has highest cost of breach of data. Healthcare personnels are not experts in identifying and tackling cyberattacks.

Cybersecurity has expanded the scope of patient wellness to include protecting the technology, networks, and databases that enable uninterrupted and accurate patient care. This includes securing computer systems, protecting data and training personnel to be cyber-vigilant Cyber-attacks drastically affect health care capabilities by impeding confidentiality of patient medical data. Efficient cybersecurity is a joint responsibility, which involves individuals as well as technology that aids in protection of digitized data, as well as investments. Various health-care organizations continuously share health associated data via electronic means by mobile phones, cloud-based apps, medical hospital devices, as well as technology-based infrastructures. Currently, most common cybersecurity related threats against healthcare organizations are a) Electronic mail phishing; b) ransomware cyberattack; c) Loss and/or theft of data; d) accidental or intentional loss of data and e) Attacks against connected medical healthcare devices.

Present study assessed the knowledge and awareness regarding cybersecurity in hospital setups among healthcare professionals based in India. It was found that 89%, 82%, 87% and 87% medical practitioners, dental surgeons, physiotherapists and nursing professionals, respectively, had knowledge regarding medico-legal implications of medical data disclosure. S49% medical doctors, 58% dentists, 43% nurses and 45% physiotherapists were of the opinion that medical records can be safely shared using electronic mail. 51%, 49%, 43% and 32% doctors, dentists, nurses and physiotherapists possessed knowledge of on-line tools which can create impersonated email addresses. Less than 50% of studied health care professionals knew of digital signatures. Even smaller numbers of healthcare professionals had knowledge of secured e-documents. However, majority of studied professionals were having the knowledge regarding the authenticity and higher legality of pdf format scanned document in comparison with pdf file with no digital signatures. Most of the healthcare professionals were knowledgeable with regards to regular software updating.

In contrast to our findings, Alhuwail et al.[10] (2021) in their study found that healthcare professionals who had greater working experience demonstrated good compliance along with cybersecurity measures. Also, nurses demonstrated higher aptitude toward cybersecurity when compared with physicians.

Kevin Hore et al.[11] (2024) evaluated cybersecurity awarenessamong critical care staff and found that the critical care staff appear had a high-level cybersecurity awareness. However, in practice safe cybersecurity practices were not always followed.

Luiza Fabisiak et al.[12] (2020) measured the level of cyber security awareness of healthcare professionals in Poland and the results of their study indicated low levels of knowledge regarding information security. This might be caused by the fact that many aspects of cyber security are difficult to learn during a few days of training.

However, in accordance with our findings, Singh and Singh[13] (2022) on analyzing the cybersecurity awareness among nurses found that only 21.7% nurses had knowledge about ransomware and 45.7% of professionals had awareness about phishing. 62%of study participants had knowledge regarding breach of data. Hence, it was seen that there is a lack of knowledge regarding cyber security.

Rathod et al.[14] (2019) conducted a survey to analyze the awareness of medical student regarding cyber security and concluded that half of the students were aware of the cybercrimes being committed in the society and 8% were not even familiar with it. It was found that students were moderately aware of cybercrimes and had knowledge of law against cybercrimes.

P Nunes et al.[15] conducted a study to understand the relationship level established by healthcare professionals and cybersecurity awareness. The results showed a relationship between acquired behaviors and the attitudes of involvement with work and organizational commitment, establishing a bridge for the quantification in awareness.

Hence, it can be seen that cybersecurity is still not a primary concern for most healthcare professionals. Hence, there is a requirement for increasing the knowledge, as well as awareness regarding data safety related to patients, digitizing data, storage and transfer.

Limitation

Limitation as well as the weakness of the study is its small sample size. Hence, a higher sample size would be reflective of greater assessment of knowledge and awareness regarding cybersecurity. The strength of the present study remains its coverage of healthcare individuals belonging to different areas of practice.

Conclusion

Cybersecurity is a major concern in healthcare. Data breach can lead to loss of patient medical information that can bring down entire health system. Lower knowledge and awareness amongst healthcare personnels is a major concern which needs to be addressed by enhancing knowledge of computers, cyberattacks and measures required to deal with these. Health policy makers have not yet identified the threat to the patient’s data through cyberattacks although cybervigilance week has been advocated and seminars are being conducted at institutional level.

Conflicts of interest

There are no conflicts of interest.

Funding Statement

Nil.