A STUDY OF ORGANIZATIONAL RESPONSES TO INFORMATION PRIVACY THREATS IN THE HEALTHCARE CONTEXT

ABSTRACT

The proliferation of digitized healthcare holds great promise for sharing medical data, improving healthcare quality, saving patient lives, and reducing costs. However, these potential benefits also draw much attention to the issue of information privacy. In the presence of increasing penalties for non-compliance, reputational loss, and privacy operational issues, organizations must find ways to appropriately respond to privacy threats without impeding healthcare workflow and work practices. Thus, the broad research question examined in this study is:  How do healthcare organizations respond to information privacy threats and issues?

This dissertation reports the results of a grounded theory study investigating the organizational responses to information privacy threats. The empirical evidence has been derived from healthcare organizations within the United States of America. The key finding is the emergence of the Privacy Impact Assessment, a central element in the process of effective organizational response to information privacy threats. Assessing the influences and dynamics of different drivers, while simultaneously accounting for the intended (positive impacts) and unintended (negative impacts) consequences is critical to understanding the processes by which organizations respond to privacy threats. The findings are summarized within a theoretical framework of organizational responses to information privacy threats.

The theoretical framework developed from this work is stated below:

The Privacy Impact Assessment (PIA) within healthcare organizations is shaped by a dynamic interplay between privacy threats, organizational drivers, and the Imbalance

Challenge. Responding to privacy threats without accounting for the Imbalance Challenge causes potential negative operational impacts to outweigh positive impacts. Therefore, the Privacy Impact Assessment is characterized by the iteration between undertaking a risk assessment of privacy threats and existing drivers, management of privacy safeguards, and evaluation of their impacts. In order to manage this process, healthcare leaders are driven to act proactively and to apply appropriate strategies to accurately assess privacy threats while handling the impact of privacy safeguard enactments on healthcare workflow and work practices. 

This dissertation makes several contributions to the research literature in information systems, organizational behavior, and health informatics. First, this research provides new theoretical insights into understanding privacy management by targeting the organizational level of analysis through a grounded theory approach. Second, this study responds to a compelling call for research investigating the effectiveness and consequences of enacting privacy safeguards. Moreover, using a grounded theory, this study provides a rich lens to understand the consequences of privacy safeguards enactments and their implications on privacy compliance. Finally, this interdisciplinary study converges the research streams of information systems, organizational behavior, and Health informatics, and promotes synergy between academia and practice by offering practical implications for healthcare practitioners and insights for further theory

development.                                                  

TABLE OF CONTENTS

LIST OF FIGURES ………………………………………………………………………………………………….. ix

LIST OF TABLES ……………………………………………………………………………………………………. x

GLOSSARY ……………………………………………………………………………………………………………. xi

ACKNOWLEDGEMENTS ……………………………………………………………………………………….. xii

DEDICATION …………………………………………………………………………………………………………. xv

Chapter 1 Introduction ………………………………………………………………………………………………. 1

1.1 Problem Statement ……………………………………………………………………………………….. 1

1.2 Study Motivation ………………………………………………………………………………………….. 3

1.3 Research Objectives and Questions ………………………………………………………………… 5

1.4 Significance and Contributions of the Study…………………………………………………….. 8

1.5 Thesis Organization ……………………………………………………………………………………… 9

Chapter 2 Literature Review ………………………………………………………………………………………. 11

2.1 Interdisciplinary Literature…………………………………………………………………………….. 11

2.1.1 Literature Review Domains …………………………………………………………………. 12

2.1.2  Literature Review Sources ………………………………………………………………….. 12

2.1.3  Literature Review Search Strategy ……………………………………………………….. 13

2.2 Definition and Scope of Information Privacy and EHRs ……………………………………. 16

2.2.1 Information Privacy …………………………………………………………………………….. 16

2.2.2  Electronic Health Records (EHRs)……………………………………………………….. 18

2.3  Information Privacy Issues & Threats …………………………………………………………….. 20

2.3.1  Data Collection ………………………………………………………………………………….. 22

2.3.2  Unauthorized Access ………………………………………………………………………….. 22

2.3.3  Secondary Use …………………………………………………………………………………… 22

2.3.4  Data Use and Disclosure …………………………………………………………………….. 23

2.3.5  Errors ……………………………………………………………………………………………….. 23

2.4  Protecting and Managing Information Privacy ………………………………………………… 24

2.4.1  Technical Approach …………………………………………………………………………… 26

2.4.2  Human Approach ………………………………………………………………………………. 30

2.5 Factors Influencing Privacy Responses …………………………………………………………… 32

2.5.1 Institutional Pressures …………………………………………………………………………. 33

2.5.2 Resources and Competitive Advantage ………………………………………………….. 34

2.5.4 Ethical Responsibility …………………………………………………………………………. 35

2.6 Implications of Enacting Privacy Responses ……………………………………………………. 36

2.6.1 Unavailability of Information ……………………………………………………………….. 37

2.6.2 Workflow Disruptions …………………………………………………………………………. 38

2.6.3 Usability Issues ………………………………………………………………………………….. 38

2.6.4 Operational Feasibility Issues ………………………………………………………………. 39

2.7 Identifying the Gaps ……………………………………………………………………………………… 40

Chapter 3 Research Methodology ……………………………………………………………………………….. 43

3.1 Research Design …………………………………………………………………………………………… 43

3.1.1 Ontological and Epistemological Assumptions ………………………………………. 45

3.1.2 Choice of Grounded Theory …………………………………………………………………. 47

3.1.3 Straussian versus Glaserian Grounded Theory ……………………………………….. 49

3.2 Data Collection ……………………………………………………………………………………………. 50

3.3 Data Analysis ………………………………………………………………………………………………. 57

3.3.1 First Order Data Analysis …………………………………………………………………….. 58

3.3.2 Second Order Data Analysis ………………………………………………………………… 59

3.3.2 Emerging Theoretical Framework…………………………………………………………. 59

3.4 Evaluation Criteria ……………………………………………………………………………………….. 60

3.4.1 Ensuring Trustworthiness …………………………………………………………………….. 61

3.4.2 Ensuring the Adequacy of the Research Process and the Empirical

Grounding ………………………………………………………………………………………….. 62

Chapter 4 Emergent Key Concepts, Themes, and Dimensions ……………………………………….. 64

4.1 Perceived Privacy Threats ……………………………………………………………………………… 67

4.1.1 Unauthorized Access …………………………………………………………………………… 67

4.1.2 Unintended Data Disclosure and Secondary Use …………………………………….. 69

4.1.3 Lost and Stolen Hardware ……………………………………………………………………. 70

4.1.4 Misuse and Security Concerns of Ubiquitous Technologies ……………………… 70

4.2 Privacy Response Drivers ……………………………………………………………………………… 71

4.2.1 Regulatory Pressures …………………………………………………………………………… 72

4.2.2 Resources ………………………………………………………………………………………….. 74

4.2.3 Competitive Advantage ……………………………………………………………………….. 76

4.2.4 Ethical Integrity ………………………………………………………………………………….. 77

4.3 Privacy Safeguards ……………………………………………………………………………………….. 79

4.3.1 Technical Controls ……………………………………………………………………………… 80

4.3.2 Human Controls …………………………………………………………………………………. 82

4.3.3 Physical Controls………………………………………………………………………………… 84

4.3.4 Administrative Processes …………………………………………………………………….. 84

4.4 Imbalance Challenge …………………………………………………………………………………….. 86

4.4.1 Negative Impacts ………………………………………………………………………………… 87

4.4.2 Positive Impacts …………………………………………………………………………………. 93

4.4.3 Imbalance Challenge …………………………………………………………………………… 95

4.5 Leadership Commitment ……………………………………………………………………………….. 97

4.5.1. Hospital Size …………………………………………………………………………………….. 97

4.5.2 Organization’s Academic Status …………………………………………………………… 99

4.5.3 Professional Background of Privacy Officers …………………………………………. 100

4.5.4 Leadership Buy-Ins …………………………………………………………………………….. 101

4.6 Privacy Impact Assessment ……………………………………………………………………………. 101

Chapter 5 Discussion and Theoretical Framework ………………………………………………………… 105

5.1 Shaping the Theoretical Framework ……………………………………………………………….. 105

5.1.1 The First Emerging Theme: The PIA …………………………………………………….. 106 5.1.2

The Second Emerging Theme: Imbalance Challenge ………………………………. 109

5.1.3 The Entwined Relationship between the Themes ……………………………………. 112

5.2 Formulating the Theoretical Framework………………………………………………………….. 113

5.2.1 Discussion of the PIA ………………………………………………………………………….. 115

5.2.2 Implications of the Enactment of Privacy Safeguards ……………………………… 117

5.2.3 Effect of Positive and Negative Impacts on Imbalance Challenge …………….. 119

5.2.4 Effect of the Imbalance Challenge on Privacy Compliance ………………………. 120

5.2.6 Iterative Relationship between the PIA and the Imbalance Challenge ……….. 123

5.3 Relating to the Literature ………………………………………………………………………………. 126

5.3.1 Relating to the Literature on Risk Management………………………………………. 127

5.3.2 Relating to the Theory of Balance …………………………………………………………. 129

5.3.3 Relating to Privacy Calculus ………………………………………………………………… 130

5.3.4 Relating to Organizational Behavior Literature ………………………………………. 130

5.4 Evaluating the Study …………………………………………………………………………………….. 135

Chapter 6 Conclusion ………………………………………………………………………………………………… 142

6.1 Summary of the Study …………………………………………………………………………………… 142

6.2 Revisiting the Research Questions ………………………………………………………………….. 144

6.3 Contributions and Implications for Research ……………………………………………………. 147

6.4 Contributions and Implications for Practice …………………………………………………….. 150

6.5 Limitations ………………………………………………………………………………………………….. 152

6.6 Future Research ……………………………………………………………………………………………. 153

References ……………………………………………………………………………………………………………….. 156

Appendix A  Semi –Structured Interview Protocol for Information Privacy Experts …………. 181

Appendix B  Illustrative Supporting Data for Privacy Threats ………………………………………… 183

Appendix C  Illustrative Supporting Data for Drivers of Privacy Safeguards ……………………. 186

Appendix D  Illustrative Supporting Data for Privacy Safeguards …………………………………… 190

Appendix E  Illustrative Supporting Data for Imbalance Impacts ……………………………………. 194

Appendix F  Illustrative Supporting Data for Organizational Context ……………………………… 199

Appendix G  Illustrative Supporting Data for PIA ………………………………………………………… 201

Appendix H  List of State Breach Notification Laws …………………………………………………….. 203

Appendix I  Informed Consent …………………………………………………………………………………… 206

Appendix J  Example Solicitation Email ……………………………………………………………………… 208

Appendix K  Sample Documentation ………………………………………………………………………….. 209

LIST OF FIGURES

Figure 1-1 Dissertation Organization …………………………………………………………………………… 10

Figure 2-1 Classification of Information Privacy Research Issues …………………………………… 16

Figure 2-2 Mapping of Privacy Threats to Technical Countermeasures …………………………… 29

Figure 3-1 Data Analysis Procedures…………………………………………………………………………… 58

Figure 4-1 Emergent Dimensions: Threats, Drivers, and Safeguards ……………………………….. 65

Figure 4-2 Emergent Concepts, Themes, and Dimensions in Organizational Privacy Responses ………………………………………………………………………………………………… 66

Figure 4-3 Perceived Privacy Threats ………………………………………………………………………….. 67

Figure 4-4 Imbalance Challenge …………………………………………………………………………………. 97

Figure 5-1 Enabling and Inhibiting Drivers ………………………………………………………………….. 109

Figure 5-2 The Emerging Theoretical Framework ………………………………………………………… 114

 

 

LIST OF TABLES

Table 2-1 Interdisciplinary Literature Review ………………………………………………………………. 14

Table 2-2 Summary of Privacy Issues and Threats ………………………………………………………… 21

Table 2-3 Summary of Privacy Countermeasures …………………………………………………………. 26

Table 2-4 Mapping of Privacy Threats to Their Countermeasures …………………………………… 27

Table 2-5 Summary of Drivers Influencing Privacy Responses ………………………………………. 33

Table 3-1 The Research Process …………………………………………………………………………………. 44

Table 3-2 Comparison of Data Analysis Steps between Glaser and Strauss ……………………… 50

Table 3-3 Interview Data Sources ……………………………………………………………………………….. 53

Table 3-4 Workshops and Round Tables Data Sources ………………………………………………….. 54

Table 3-5 Trustworthiness Criteria ……………………………………………………………………………… 61

Table 3-6 Ensuring the Adequacy of the Empirical Grounding ………………………………………. 62

Table 3-7 Ensuring the Adequacy of the Research Process …………………………………………….. 63

Table 4-1 Institutional Pressures as a Driver ………………………………………………………………… 73

Table 4-2 Resources as a Driver …………………………………………………………………………………. 75

Table 4-3 Ethical Integrity as a Driver…………………………………………………………………………. 77

Table 4-4 Classification of Organizational Privacy Responses ……………………………………….. 80

Table 5-1 Strategies for Resistance and Accommodation to Institutional Pressures …………… 134

Table 5-2 Empirical Grounding of the Study ………………………………………………………………… 137

Table 5-3 Research Process Evaluation Criteria ……………………………………………………………. 139

 

 

GLOSSARY

CEO	Chief Executive Officer
CIO	Chief Information Officer
CMIO	Chief Medical Information Officer
CPO	Chief Privacy Officer
HIMSS	Healthcare Information and Management Systems Society
HIPAA	The Health Insurance Portability and Accountability Act
HITECH	The Health Information Technology for Economic and Clinical Health
CIHDS	Center for Integrated Healthcare Delivery Systems
EHRs	Electronic Health Records
EMR	Electronic Medical Records
PHI	Protected Health Information
CHIME	The College of Healthcare Information Management Executives. http://www.cio-chime.org/
PIA	Privacy Impact Assessment
WHITE	Workshop on Health Information and Economics

 

Chapter 1  

 

Introduction

1.1 Problem Statement

The healthcare sector exerts a significant impact on an individual’s quality of life.

It is also known as an information intensive industry where patients’ information is stored, processed, and transferred to several entities, such as doctors’ offices, hospitals and laboratories. The ability to accurately access patients’ medical data in a timely manner can facilitate diagnosis and reduce medical errors. The integration of Information Technology (IT) and healthcare allowed the development of computer applications that have laid the path to exponential growth in the electronic acquisition, storage, manipulation, and communication of health-related data – health informatics (Kluge, 2011).

Digitized healthcare, or health informatics, emerged within the last four decades

(Hersh, 2004; Smith et al., 1999) with  recent major governmental initiatives (Bush, 2004; Obama, 2009) supporting the implementation of electronic health records (EHRs) in the United States (Angst et al., 2009). Technologies such as EHRs have the potential to transform healthcare processes by increasing the availability of patients’ information and fostering communication and cooperation among clinicians, administration, and other health entities across systems and geographic locations.

In spite of potential benefits of healthcare IT, major issues and barriers have been associated with the use of EHRs, such as cost, technical issues, standardization, and privacy concerns (Hersh, 2004). While extensive research has focused on implementation costs and technical solutions (Aberdeen et al., 2010; Agarwal et al., 2007; Blobel et al., 2006; Boyd et al., 2007; Chen et al., 2010; Chiang et al., 2003; Claerhout et al., 2005;

Haas et al., 2011; Kluge, 2007; Lovis et al., 2007; Mohan et al., 2004; Neubauer et al.,

2011; Ohno-Machado et al., 2004; Quantin et al., 2000; Ravera et al., 2004; Reni et al., 2004; Sujansky et al., 2010), privacy concerns remain a thorny subject for both practitioners and researchers. Thus, this study will focus on the privacy issues with regard to healthcare IT.

Information privacy issues and threats have drawn considerable attention from researchers and practitioners. Media publicity around recent privacy breaches—such as stolen portable computers with patient information, unauthorized access, or disclosure— brings attention to potential individual harms and organizations’ responses and behaviors

(Hodgkinson et al., 2010). At the individual level, harmful situations such as inappropriate disclosures of a mental disorder diagnosis or a sexually transmitted disease can severely impact employment or insurance coverage (Cushman et al., 2010). At the organizational level, privacy breaches may have direct consequences for the organization’s reputation, increased monetary fines, along with potential civil and criminal liabilities (Culnan & Williams, 2009). As a result, organizations now carefully focus on developing privacy programs and safeguards to mitigate privacy threats and protect sensitive information. However, the evidence indicates that these initiatives are failing because “breaches continue to occur, suggesting that existing compliance programs are not effective” (Culnan & Williams, 2009, p.678).

1.2 Study Motivation

According to Smith et al. (2011), prior research into privacy issues and threats can be grouped by level of analysis (individual, group, organizational, and societal) and by industry sector (e.g., e-commerce, finance, government, and healthcare). Many previous studies on information privacy have been at the individual level of analysis (Angst et al., 2009; Chen et al., 2009; Son et al., 2008; Xu et al., 2008a) instead of the organizational level, because “most rigorous studies of organizational privacy policies and practices would likely include a set of exhaustive interviews with an organization’s members and stakeholders, and some amount of deep process tracing would also likely be involved” (Smith et al., 2011, p. 36-37). Despite the consensus in multidisciplinary research reviews, studies on privacy breaches and responses at the organizational level remains under-researched (Appari & Johnson, 2010; Culnan & Williams, 2009; Greenaway & Chan., 2005; Smith et al., 2011). Moreover, there are limited theoretical guidelines on how organizations develop their responses to information privacy threats (Greenaway & Chan, 2005) and which factors impact their choices.

Beyond the level of analysis, privacy studies also varied in their contexts; for example, studies have examined e-commerce (Cranor et al., 2007; Van Slyke et al., 2006) and online social networks (Bulgurcu et al., 2010b; Chen et al., 2009). Examining privacy threats in the healthcare context is difficult because of its complexity, changeability, strict regulations, and policies (Garfinkel et al., 2002; Thatcher et al., 2000). The U.S. Congress’s realization that advances in e-health could erode privacy and confidentiality of health information led to the adoption of privacy standards for protecting individually identifiable health information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) lay out a broad set of specifications for privacy at the federal level and define the regulatory requirements for protected health information (PHI).  Federal regulatory requirements can be overridden by state laws, which lead to variability in how privacy is implemented in each state (Appari et al., 2009). Such variability at the state level is considered a major impediment to healthcare organizational compliance with regulations (Hodge Jr. 1999; Langenderfer and Cook 2004).

Developing robust privacy programs is a difficult and costly process (Culnan & Williams, 2009), but it is even more challenging in the healthcare sector. Healthcare organizations are expected to have safeguards in place against privacy threats (Liginlal et al., 2009) and therefore, the healthcare industry has an emerging need for a business model (Appari & Johnson, 2010, p. 281). One possible explanation for this lack of research is organizations’ unwillingness to share information and statistics about their practices (Kotulic et al., 2004; Sinclaire 2003) and the complexity of organizational data collection (Smith  et al., 2011).

In the presence of increasing healthcare penalties for non-compliance (Fernando et al., 2009; Mohan et al., 2004) and privacy operational challenges (Croll 2011), organizations are facing challenges in how to appropriately respond to privacy threats while not impeding healthcare workflows. To date, no comprehensive model has been developed to empirically explore the different theoretical explanations while identifying the intended and unintended consequences of privacy safeguards implementation. This study provides a unique perspective on information privacy in the context of healthcare.

1.3 Research Objectives and Questions

This study aims to address the lack of theories and research that focus on responding to information privacy threats at the organizational level. This study also aims to promote synergy between academia and practice, especially because investigating privacy responses within healthcare organizations is a top priority for both practitioners and researchers. From a practical point of view, understanding the ways organizations respond to information privacy threats and how these responses impact work practices is very important. Also of relevance is securing the privacy of patients’ health information without impeding the flow of information or workflow processes.

The key research issue examined in this dissertation is: How do healthcare organizations respond to information privacy threats? This research issue is further subdivided into three main research questions that kept evolving^[1] throughout the study (Strauss et al., 1998; Strauss et al., 2008). Healthcare organizations face significant challenges in designing and implementing the appropriate safeguards to mitigate information privacy threats. Moreover, mitigating privacy threats must take into

consideration several drivers that influence actions and responses. Therefore, the first research question (RQ1) is pertinent to the reasons behind organizational responses, and it is further broken into two sub-questions (RQ1a and RQ1b).

Research Question 1:  Why do healthcare organizations respond to information privacy threats?

RQ1a: What are the different types of threats faced by healthcare

organizations?

RQ1b: What are the different types of drivers healthcare organizations have to consider?

To understand organizational responses to privacy threats, it is important to distinguish between different types of responses while identifying mechanisms of applying the appropriate safeguards, which lead to the second research question (RQ2).

Research Question 2: What are the safeguards and mechanisms used by healthcare organizations to mitigate information privacy threats?

            RQ2a: What are the different types of safeguards implemented? RQ2b: What are the mechanisms undertaken to apply the appropriate safeguards?

There is little research theoretically explaining the outcomes of enacting privacy safeguards and the subsequent effects on privacy compliance. As Belanger and Crossler

(2011, p. 1022) pointed out, “there are many behavioral questions to be explored with respect to not only use of potential privacy protection tools but also effectiveness and consequences of use.” Similarly, this void in extant privacy literature has also been identified by an interdisciplinary literature review (Smith et al., 2011) that highlights the need for more privacy research to consider actual outcomes. Following these calls for research on examining  impacts and outcomes of privacy safeguards, we aim to investigate the conditions under which the negative impacts^[2] of privacy safeguard enactments outweigh the positive ones (i.e., the Imbalance Challenge occurs) and to identify the implications for privacy compliance. Specifically, we aim to address the following two research questions in this work

Research Question 3: How does the enactment of privacy safeguards impact healthcare workflow and processes?

RQ3a: What are the intended consequences (positive impacts) of privacy safeguards?

RQ3b: What are the unintended consequences (negative impacts) of privacy safeguards?

RQ3c: What are the implications of these opposing impacts on privacy compliance (Imbalance Challenge) and what are the outcomes of the Imbalance Challenge?

Grounded theory-building methodology has been used to address the aforementioned research questions. As a result, a theoretical framework of organizational responses to information privacy threats is expressed by the means of propositions.

1.4 Significance and Contributions of the Study

This study contributes to existing privacy research in several ways. First, Smith et al. (2011) have shown a lack of organizational level privacy research in extant literature partially because these studies “are necessarily more complex and less conducive to

‘quick’ data collection techniques such as written and online surveys” (p. 1006). This research provides new theoretical insights into understanding privacy management by targeting to this under-researched level of analysis through a grounded theory approach that uncovers the construct of the Privacy Impact Assessment. Second, following the call by Belanger and Crossler (2011), we have studied the outcome of enacting privacy safeguards and the subsequent effects on privacy compliance specifically; the construct of the Imbalance Challenge emerged as an analytical construct to capture unintended consequences caused by the situation where the negative impacts of privacy safeguards outweigh the positive ones. Third, this study was designed to gain an in-depth understanding of organizational responses to privacy threats and the actual outcomes and implications of the privacy practices in healthcare organizations. Therefore, using a grounded theory methodology provided a rich lens to understand the mechanisms of privacy responses and the consequences of privacy safeguards enactments on privacy compliance. Fourth, this study contributes to the recent need for interdisciplinary research by converging the research streams of IS, organizational behavior, and health informatics.

 

The findings of this study have useful practical implications for healthcare organizations in general and hospitals in particular. These implications promote a synergy between academia and practice. The emergence of the Privacy Impact Assessment reinforces the importance of a proactive risk assessment approach of different drivers when responding to information privacy threats, while the emergence of  the Imbalance Challenge provides a clearer understanding of the unintended consequences of privacy safeguard enactments and their implications on the organization’s overall privacy compliance. More detailed discussions on contributions of this research are presented in Chapter 6.

1.5 Thesis Organization

This dissertation consists of six chapters. Each chapter is briefly discussed below.

Figure 1-1 provides a graphical representation of the structure of this dissertation. Chapter 1 introduces the research problem, the research motivation, and the significance of the study. Chapter 2 presents a literature review on information privacy, institutional theory, resource-based view, and ethical considerations. In addition, it integrates all discussed approaches and identifies a research gap. Chapter 3 describes the research paradigm with the epistemology and ontology adopted. It describes the grounded theory methodology and the reason for its selection. This chapter also describes the data collection and analytical procedures and concludes with by outlining the applied evaluation criteria. Chapter 4 presents the findings, including different categories and themes. This chapter reports the results of the first two main steps of data analysis, first order codes and second order themes, which result in an overarching structure. This chapter also provides a contextual background for analysis and discussion in the subsequent chapter. Chapter 5 discusses the emerging theoretical framework, relates it to the literature, and uses criteria from Chapter 3 to evaluate it. Finally, Chapter 6 summarizes the study by presenting an analysis of contributions and implications for both researchers and practitioners. It also discusses the limitations of this study and outlines further research possibilities in the domain of healthcare information privacy.

 

Figure 1-1 Dissertation Organization

[1] This is consistent with the qualitative research claims that research questions should mature and develop during the data analysis phase (Creswell 2009).

[2] In this study, the term “impact” is used to describe the challenges organizational leaders identified from their operational processes and work practices after the enactment of privacy safeguards.

A STUDY OF ORGANIZATIONAL RESPONSES TO INFORMATION PRIVACY THREATS IN THE HEALTHCARE CONTEXT

Sharing is caring!