Information Security Content Development for Awareness Training Programs in Healthcare

Abstract

Human error is recognized as the major cause of data breaches across the healthcare industry. Training and education are effective approaches to help employees adhere to appropriate behaviors that do not compromise information assets. However, not all awareness training programs are effective. One of the main failures in implementing successful awareness programs is the training content. In many cases, the training content is reported to be too informative or too advance. The aim of this paper is to propose a guideline to develop information security content for awareness training programs. Developing a rich and attractive training content is the key to an effective awareness program. It is necessary to ensure that important information security issues are effectively communicated with employees during awareness training programs, and employees are not over-trained or under-trained. The paper demonstrates the process of information security policy augmentation for a selected healthcare organization, and develops information security content from the augmented policy document. The focus of the training content is to enforce the organization’s internal information security policies.