Why Employees (Still) Click on Phishing Links: Investigation in Hospitals

• Published in: Journal of medical Internet research Vol. 22; no. 1; p. e16775
• Main Authors: Jalali, Mohammad S, Bruckes, Maike, Westmattelmann, Daniel, Schewe, Gerhard
• Format: Journal Article
• Language: English
• Published: Canada Gunther Eysenbach MD MPH, Associate Professor 23-01-2020; JMIR Publications
• Subjects: Attitudes; Behavior; Clinical decision making; Compliance; Computer security; Cybercrime; Cybersecurity; Electronic mail systems; Email; Employees; Health care; Hospitals; Influence; Information systems; Information technology; Investigations; Noncompliance; Norms; Original Paper; Perceived control; Perceptions; Polls & surveys; Quality of care; Security management; Software; Theory of planned behavior; Workloads; theory of planned behavior; trust; phishing emails; information security management; compliance
• ISSN: 1438-8871; 1439-4456; 1438-8871
• DOI: 10.2196/16775

Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients.
This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data.
We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees' survey results with their actual clicking data from phishing campaigns.
Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees' workload is positively associated with the likelihood of employees clicking on a phishing link.
This is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees' workload to increase information security. Our findings can help health care organizations augment employees' compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links.