Improving the exchange of lessons learned in security incident reports: case studies in the privacy of electronic patient records

He, Y., Johnson, C. , Lu, Y. and Ahmad, A. (2014) Improving the exchange of lessons learned in security incident reports: case studies in the privacy of electronic patient records. IFIP Advances in Information and Communication Technology, 430, pp. 109-124. (doi:10.1007/978-3-662-43813-8_8)

Full text not currently available from Enlighten.


The increasing use of Electronic Health Records has been mirrored by a similar rise in the number of security incidents where confidential information has inadvertently been disclosed to third parties. These problems have been compounded by an apparent inability to learn from previous violations; similar security incidents have been observed across Europe, North America and Asia. This paper presents the results of an empirical study that evaluates the utility and usability of conventional text-based security incident reports with a graphical formalism based on the Goal Structuring Notation. The two methods were compared in term of the users’ ability to identify a number of lessons learned from investigations into previous incidents involving the disclosure of healthcare records. These lessons included both the causes of the incident but also the participants’ ability to understand the reasons why particular recommendations were proposed as ways of avoiding future violations. Even using a relatively small sample, we were able to obtain statistically significant differences between the two approaches. The study showed that the graphical approach resulted in higher accuracy in terms of number of correct answers generated by participants. However, subjective feedback raised further questions about the usability of both approaches as the readers of security incident reports try to interpret the lessons that can increase the security of patient data.

Item Type:Articles
Keywords:Lessons Learned, Security Incident, Electronic Patient Record, Generic Security Template, Empirical Study
Glasgow Author(s) Enlighten ID:Johnson, Professor Chris and He, Miss Ying and Lu, Mr Yu
Authors: He, Y., Johnson, C., Lu, Y., and Ahmad, A.
Subjects:Q Science > QA Mathematics > QA75 Electronic computers. Computer science
College/School:College of Science and Engineering > School of Computing Science
Journal Name:IFIP Advances in Information and Communication Technology
Publisher:Springer Berlin Heidelberg
ISSN (Online):1868-4238

University Staff: Request a correction | Enlighten Editors: Update this record