JMIR Publications

ABSTRACT

Background:

Information security is a critical challenge in the digital age, especially for hospitals, which are prime targets for cyberattacks due to the monetary worth of sensitive medical data. Given the distinctive security risks faced by healthcare professionals, tailored Security Education, Training, and Awareness (SETA) programs are needed to increase both their ability and willingness to integrate security practices into their workflows.

Objective:

The present study investigates the effectiveness of a video-based security training which was customized for hospital settings and enriched with motivational framing strategies to build information security skills among healthcare professionals. The training stands out from conventional interventions in this context, particularly by incorporating a dual-motive model to differentiate between self- and other-oriented goals as stimuli for skill acquisition. The appeal to the professional values of responsible healthcare work, whether absent or present, facilitates a nuanced examination of differential framing effects on training outcomes.

Methods:

A randomized controlled trial was conducted with 130 healthcare professionals from three German university hospitals. Participants within two intervention groups received either a self-oriented framing (focused on personal data protection) or an other-oriented framing (focused on patient data protection) at the beginning of a security training video. A control group watched the same video without any framing. Skill assessments utilizing Situational Judgment Tests before and after the training served to evaluate skill growth in all three groups

Results:

The video-based training content resulted in a substantial enhancement of information security skills among all job profiles. Members of the other-oriented intervention group, who were motivated to protect patients, exhibited the highest increase in security skills (ΔM = 1.13, P = .0037), outperforming both the self-oriented intervention group (ΔM = 0.55, P = .0365) and the control group (ΔM = 0.40, P = .0037). Conversely, the self-oriented framing of the training content, which placed emphasis on personal privacy, did not yield significantly superior gains in security skills over the control group (ΔM = 0.15, P = 1.000).

Conclusions:

This study underscores the importance of aligning SETA programs with the professional values of target groups, in addition to adapting these programs to specific contexts of professional action. In the investigated hospital setting, a motivational framing that resonates with healthcare professionals' sense of responsibility for patient safety has proven to be particularly effective in promoting skill growth. Consequently, our findings highlight the potential of motivational incentives to enhance engagement with training content and, thus, to boost awareness and capabilities for appropriate action at the workplace.