Journal of Medical Internet Research - International Scientific Journal for Medical Research, Information and Communication on the Internet #Preprint #PeerReviewMe: Warning: This is a unreviewed preprint. Readers are warned that the document has not been peer-reviewed by expert/patient reviewers or an academic editor, may contain misleading claims, and is likely to undergo changes before final publication, if accepted, or may have been rejected/withdrawn. Readers with interest and expertise are encouraged to sign up as peer-reviewer, if the paper is within an open peer-review period. Please cite this preprint only for review purposes or for grant applications and CVs (if you are the author). Background: Cybersecurity incidents are a growing threat to the healthcare industry in general and hospitals in particular. The healthcare industry has lagged behind other industries in protecting its main stakeholder (i.e., patients), and now hospitals must invest considerable capital and effort in protecting their systems. However, this is easier said than done, because hospitals are extraordinarily technology-saturated, complex organizations with high endpoint complexity, internal politics, and regulatory pressures. Objective: The purpose of this study was to develop a systematic and organizational perspective for studying: 1) the dynamics of cybersecurity capability development at hospitals; and 2) how these internal organizational dynamics interact to form a system of hospital cybersecurity in the U.S. Methods: We conducted interviews with hospital CIOs, CISOs, and healthcare cybersecurity experts, analyzed the interview data, and developed a system dynamics model that unravels the mechanisms by which hospitals build cybersecurity capabilities. We then use simulation analysis to examine how changes to variables within the model affect the likelihood of cyber-attacks across both individual hospitals and a system of hospitals. Results: We discuss several key mechanisms that hospitals use to reduce the likelihood of cyber-criminal activity. The variable which most influences the risk of cyber-attack in a hospital is endpoint complexity, followed by internal stakeholder alignment. While resource availability is important in fueling efforts to close cybersecurity capability gaps, low levels of resources could be compensated for by setting a high target level of cybersecurity. Conclusions: In order to enhance cybersecurity capabilities at hospitals, the main focus of CIOs and CISOs should be on reducing endpoint complexity and improving internal stakeholder alignment. These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. On a macro-level, the cyber vulnerability of a country’s hospital infrastructure is affected by the vulnerabilities of all individual hospitals. In this large system, reducing variation in resource availability makes the whole system less vulnerable—a few hospitals with low resources for cybersecurity threaten the entire infrastructure of healthcare. In other words, hospitals need to move forward together in order to make the industry less attractive to cyber-criminals. Moreover, while compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies. As of today, policies mostly address data privacy, not data security. Thus, policymakers need to introduce policies that not only raise the target level of cybersecurity capabilities, but also reduce the variability in resource availability across the entire healthcare system.

The prevalence of opioid use and misuse has provoked a staggering number of deaths over the past two and a half decades. Much attention has focused on individual risks according to various characteristics and experiences. However, broader social and contextual domains are also essential contributors to the opioid crisis such as interpersonal relationships and the conditions of the community and society that people live in. Despite efforts to tackle the issue, the rates of opioid misuse and non-fatal and fatal overdose remain high. Many call for a broad public health approach, but articulation of what such a strategy could entail has not been fully realised. In order to improve the awareness surrounding opioid misuse, we developed a social-ecological framework that helps conceptualise the multivariable risk factors of opioid misuse and facilitates reviewing them in individual, interpersonal, communal and societal levels. Our framework illustrates the multi-layer complexity of the opioid crisis that more completely captures the crisis as a multidimensional issue requiring a broader and integrated approach to prevention and treatment.

Journal of Medical Internet Research - International Scientific Journal for Medical Research, Information and Communication on the Internet #Preprint #PeerReviewMe: Warning: This is a unreviewed preprint. Readers are warned that the document has not been peer-reviewed by expert/patient reviewers or an academic editor, may contain misleading claims, and is likely to undergo changes before final publication, if accepted, or may have been rejected/withdrawn. Readers with interest and expertise are encouraged to sign up as peer-reviewer, if the paper is within an open peer-review period. Please cite this preprint only for review purposes or for grant applications and CVs (if you are the author). Background: Over the past decade, clinical care has become globally dependent on information technology. The cybersecurity of healthcare information systems is now an essential component of safe, reliable, and effective healthcare delivery. Objective: The objective of this study is to provide an overview of the literature at the intersection of cybersecurity and healthcare delivery. Methods: A comprehensive search was conducted using PubMed and Web of Science (WoS) for English-language peer-reviewed articles. We carried out chronological analysis, domain clustering analysis, and text analysis of the included articles to generate a high-level concept map composed of specific words and the connections between them. Results: Our final sample included 472 English-language journal articles. Our review results revealed that the majority of articles are focused on technology: Technology-focused articles made up more than half of all the clusters, while only 32% were managerial. This focus on the technological aspects of cybersecurity suggests that non-technological variables (human-based and organizational aspects, strategy and management) may be understudied. Also, software development security, business continuity, and disaster recovery planning each accounted for 3% of the studied articles. Our results also show that physical security is lacking in research, with only 1% of the literature being categorized as such. Cyber vulnerabilities are not all digital. Many physical threats contribute to breaches, and these threats potentially affect the physical safety of patients. Conclusions: Our results revealed an overall increase in research in this area, and identified major gaps and opportunities for future work.

Background: Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients. Objective: This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data. Methods: We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees’ survey results with their actual clicking data from phishing campaigns. Results: Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees’ workload is positively associated with the likelihood of employees clicking on a phishing link. Conclusions: This is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees’ workload to increase information security. Our findings can help health care organizations augment employees’ compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links.

Significance: The opioid crisis remains one of the greatest public health challenges in the United States. The crisis is complex, with long delays and feedbacks between policy actions and their effects, which creates a risk of unintended consequences and complicates policy decision-making. We present SOURCE (Simulation of Opioid Use, Response, Consequences, and Effects), an operationally detailed national-level model of the opioid crisis, intended to enhance understanding of the crisis and guide policy decisions. Drawing on multiple data sources, SOURCE replicates how risks of opioid misuse initiation and overdose have evolved over time in response to behavioral and other changes and suggests how those risks may evolve in the future, providing a basis for projecting and analyzing potential policy impacts and solutions.