Improving the exchange of lessons learned in security incident reports: case studies in the privacy of electronic patient records

He, Y., Johnson, C. and Lu, Y. (2015) Improving the exchange of lessons learned in security incident reports: case studies in the privacy of electronic patient records. Journal of Trust Management, 2, 1. (doi:10.1186/s40493-015-0016-2)

s40493-015-0016-2.pdf - Published Version
Available under License Creative Commons Attribution.



The increasing use of Electronic Health Records has been mirrored by a similar rise in the number of security incidents where confidential information has inadvertently been disclosed to third parties. These problems have been compounded by an apparent inability to learn from previous violations; similar security incidents have been observed across Europe, North America and Asia. This has resulted in the loss of confidence and trust of the public towards the organisations’ ability to protect the patients’ private information. The Generic Security Template (G.S.T.) has been proposed to communicate security lessons learned from previous security incidents. This paper conducts a series of empirical studies to evaluate the usability of the G.S.T. The first study compares the G.S.T. with the conventional text-based security incident reports. The two methods were compared in term of the users’ ability to identify a number of lessons learned from investigations into previous incidents involving the disclosure of healthcare records. The study showed that the graphical approach resulted in higher accuracy in terms of number of correct answers generated by participants. However, subjective feedback raised further questions about the usability of the G.S.T. as the readers of security incident reports try to interpret the lessons that can increase the security of patient data. The second study further evaluates the usability of the G.S.T. using the Cognitive Dimensions and identifies some aspects that need to be improved.

Item Type:Articles
Glasgow Author(s) Enlighten ID:Johnson, Professor Chris and He, Miss Ying and Lu, Mr Yu
Authors: He, Y., Johnson, C., and Lu, Y.
Subjects:Q Science > QA Mathematics > QA75 Electronic computers. Computer science
College/School:College of Science and Engineering > School of Computing Science
Journal Name:Journal of Trust Management
ISSN (Online):2196-064X
Copyright Holders:Copyright © 2015 The Authors
First Published:First published in Journal of Trust Management 2:4
Publisher Policy:Reproduced under a Creative Commons License

University Staff: Request a correction | Enlighten Editors: Update this record