Background: Cybersecurity incidents are a growing threat to the health care industry in general and hospitals in particular. The health care industry has lagged behind other industries in protecting its main stakeholder (ie, patients), and now hospitals must invest considerable capital and effort in protecting their systems. However, this is easier said than done because hospitals are extraordinarily technology-saturated, complex organizations with high end point complexity, internal politics, and regulatory pressures. Objective: The purpose of this study was to develop a systematic and organizational perspective for studying (1) the dynamics of cybersecurity capability development at hospitals and (2) how these internal organizational dynamics interact to form a system of hospital cybersecurity in the United States. Methods: We conducted interviews with hospital chief information officers, chief information security officers, and health care cybersecurity experts; analyzed the interview data; and developed a system dynamics model that unravels the mechanisms by which hospitals build cybersecurity capabilities. We then use simulation analysis to examine how changes to variables within the model affect the likelihood of cyberattacks across both individual hospitals and a system of hospitals. Results: We discuss several key mechanisms that hospitals use to reduce the likelihood of cybercriminal activity. The variable that most influences the risk of cyberattack in a hospital is end point complexity, followed by internal stakeholder alignment. Although resource availability is important in fueling efforts to close cybersecurity capability gaps, low levels of resources could be compensated for by setting a high target level of cybersecurity. Conclusions: To enhance cybersecurity capabilities at hospitals, the main focus of chief information officers and chief information security officers should be on reducing end point complexity and improving internal stakeholder alignment. These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. On a macro level, the cyber vulnerability of a country’s hospital infrastructure is affected by the vulnerabilities of all individual hospitals. In this large system, reducing variation in resource availability makes the whole system less vulnerable—a few hospitals with low resources for cybersecurity threaten the entire infrastructure of health care. In other words, hospitals need to move forward together to make the industry less attractive to cybercriminals. Moreover, although compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies. As of today, policies mostly address data privacy, not data security. Thus, policy makers need to introduce policies that not only raise the target level of cybersecurity capabilities but also reduce the variability in resource availability across the entire health care system.

/pdf/cybersecurity-in-hospitals-a-systematic-organizational-25rjhcg3m4.pdf

Cybersecurity in Hospitals: A Systematic, Organizational Perspective

Dying to Win: Doping in Sport and the Development of Anti-Doping Policy

Cybersecurity threats are estimated to cost the world US $6 trillion a year by 2021, and the number of attacks has increased five-fold after COVID-19. Although there is substantial literature on the threats technological vulnerabilities have on the health care industry, less research exists on how pandemics like COVID-19 are opportunistic for cybercriminals. This paper outlines why cyberattacks have been particularly problematic during COVID-19 and ways that health care industries can better protect patient data. The Office for Civil Rights has loosened enforcement of the Health Insurance Portability and Accountability Act, which, although useful in using new platforms like Zoom, has also loosened physical and technical safeguards to cyberattacks. This is especially problematic given that 90% of health care providers had already encountered data breaches. Companies must implement well-defined software upgrade procedures, should use secure networks like virtual local area networks, and conduct regular penetration tests of their systems. By understanding factors that make individuals, health care organizations, and employers more susceptible to cyberattacks, we can better prepare for the next pandemic.

/pdf/cybersecurity-risks-in-a-pandemic-4iqsbvk4m7.pdf

Cybersecurity Risks in a Pandemic.

Telemedicine, Privacy, and Information Security in the Age of COVID-19

Blood doping practices in sports have been around for at least half a century and will likely remain for several years to come. The main reason for the various forms of blood doping to be common is that they are easy to perform, and the effects on exercise performance are gigantic. Yet another reason for blood doping to be a popular illicit practice is that detection is difficult. For autologous blood transfusions, for example, no direct test exists, and the direct testing of misuse with recombinant human erythropoietin (rhEpo) has proven very difficult despite a test exists. Future blood doping practice will likely include the stabilization of the transcription factor hypoxia‐inducible factor which leads to an increased endogenous erythropoietin synthesis. It seems unrealistic to develop specific test against such drugs (and the copies hereof originating from illegal laboratories). In an attempt to detect and limit blood doping, the World Anti‐Doping Agency (WADA) has launched the Athlete Biological Passport where indirect markers for all types of blood doping are evaluated on an individual level. The approach seemed promising, but a recent publication demonstrates the system to be incapable of detecting even a single subject as ‘suspicious’ while treated with rhEpo for 10–12 weeks. Sad to say, the hope that the 2012 London Olympics should be cleaner in regard to blood doping seems faint. We propose that WADA strengthens the quality and capacities of the National Anti‐Doping Agencies and that they work more efficiently with the international sports federations in an attempt to limit blood doping.

The evolving science of detection of 'blood doping'

Background: Contact tracing apps are an essential component of an effective COVID-19 testing strategy to counteract the spread of the pandemic and thereby avoid overburdening the health care system. As the adoption rates in several regions are undesirable, governments must increase the acceptance of COVID-19 tracing apps in these times of uncertainty.
Objective: Building on the Uncertainty Reduction Theory (URT), this study aims to investigate how uncertainty reduction measures foster the adoption of COVID-19 tracing apps and how their use affects the perception of different risks.
Methods: Representative survey data were gathered at two measurement points (before and after the app’s release) and analyzed by performing covariance-based structural equation modeling (n=1003).
Results: We found that uncertainty reduction measures in the form of the transparency dimensions disclosure and accuracy, as well as social influence and trust in government, foster the adoption process. The use of the COVID-19 tracing app in turn reduced the perceived privacy and performance risks but did not reduce social risks and health-related COVID-19 concerns.
Conclusions: This study contributes to the mass adoption of health care technology and URT research by integrating interactive communication measures and transparency as a multidimensional concept to reduce different types of uncertainty over time. Furthermore, our results help to derive communication strategies to promote the mass adoption of COVID-19 tracing apps, thus detecting infection chains and allowing intelligent COVID-19 testing.

/pdf/the-role-of-transparency-trust-and-social-influence-on-5cr3cn0mr9.pdf

The Role of Transparency, Trust, and Social Influence on Uncertainty Reduction in Times of Pandemics: Empirical Study on the Adoption of COVID-19 Tracing Apps.

Background: Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients.
Objective: This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data.
Methods: We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees’ survey results with their actual clicking data from phishing campaigns.
Results: Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees’ workload is positively associated with the likelihood of employees clicking on a phishing link.
Conclusions: This is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees’ workload to increase information security. Our findings can help health care organizations augment employees’ compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links.

Why Employees (Still) Click on Phishing Links: Investigation in Hospitals.

Due to the high risk of COVID-19 transmission, many sport events, including organised cycling competitions, have been cancelled. Nevertheless, staying active is important for individual well-being ...

https://www.tandfonline.com/doi/pdf/10.1080/0960085X.2020.1850186

The show must go on - virtualisation of sport events during the COVID-19 pandemic

In recent years anti-doping organizations have implemented various measures to deter elite athletes from using performance-enhancing drugs One of the main challenges in the fight against doping is that the effectiveness of these anti-doping measures is still unknown Since the effectiveness of the measures depends primarily on the athletes' perception, this study focuses on the following four objectives: (1) How effective do top-level athletes perceive individual anti-doping measures to be? (2) Are the results stable across different sports and (3) genders? (4) How can the anti-doping measures be structured into appropriate categories? To address these issues the perceived effectiveness of 14 anti-doping measures was surveyed among 146 top athletes from Germany (Cycling: N = 42; Athletics: N = 104) who are members of at least the National Testing Pool Results reveal significant differences in the perceived effectiveness of the anti-doping measures Improved diagnostics were considered to be the most effective remedy for doping, followed by increased bans and the implementation of an anti-doping law In contrast, fines and a leniency program were considered significantly less effective Second, with the exception of indirect detection methods and increased use of an Anti-Doping Administration and Management System, results were consistent across cyclists and track and field athletes Third, no significant gender difference was observed Finally, an exploratory factor analysis showed that all anti-doping measures can be classified into the three categories risk of detection (eg, control frequency and efficiency), punishment (eg, fines and bans) and communication (eg, education program) The results of this study provide a guideline for future research and for anti-doping and sport organizations when developing strategies against doping and allocating their anti-doping budget

/pdf/perception-of-the-current-anti-doping-regime-a-quantitative-hh76faxdmc.pdf

Daniel Westmattelmann

Papers

The Role of Transparency, Trust, and Social Influence on Uncertainty Reduction in Times of Pandemics: Empirical Study on the Adoption of COVID-19 Tracing Apps.

Why Employees (Still) Click on Phishing Links: Investigation in Hospitals.

The show must go on - virtualisation of sport events during the COVID-19 pandemic

Perception of the Current Anti-doping Regime - A Quantitative Study Among German Top-Level Cyclists and Track and Field Athletes.

Money matters: The impact of prize money on doping behaviour