title: Improving the redistribution of the security lessons in healthcare: An evaluation of the Generic Security Template.
abstract: BACKGROUND
  The recurrence of past security breaches in healthcare showed that lessons had not been effectively learned across different healthcare organisations. Recent studies have identified the need to improve learning from incidents and to share security knowledge to prevent future attacks. Generic Security Templates (GSTs) have been proposed to facilitate this knowledge transfer. The objective of this paper is to evaluate whether potential users in healthcare organisations can exploit the GST technique to share lessons learned from security incidents.
  
  
  METHODS
  We conducted a series of case studies to evaluate GSTs. In particular, we used a GST for a security incident in the US Veterans' Affairs Administration to explore whether security lessons could be applied in a very different Chinese healthcare organisation.
  
  
  RESULTS
  The results showed that Chinese security professional accepted the use of GSTs and that cyber security lessons could be transferred to a Chinese healthcare organisation using this approach. The users also identified the weaknesses and strengths of GSTs, providing suggestions for future improvements.
  
  
  CONCLUSIONS
  Generic Security Templates can be used to redistribute lessons learned from security incidents. Sharing cyber security lessons helps organisations consider their own practices and assess whether applicable security standards address concerns raised in previous breaches in other countries. The experience gained from this study provides the basis for future work in conducting similar studies in other healthcare organisations.
authors.affiliation: School of Computer Science and Informatics, De Montfort University, UK. Electronic address: ying.he@dmu.ac.uk.
authors.forename: Ying
authors.initials: Y
authors.lastname: He
authors.affiliation: School of Computing Science, University of Glasgow, UK.
authors.forename: Chris
authors.initials: C
authors.lastname: Johnson
mesh_terms: D001291:Attitude of Health Personnel; D002681:China; D016494:Computer Security / Q000592:standards*; D003659:Decision Making, Organizational; D004059:Diffusion of Innovation; D005260:Female; D006761:Hospitals; D006801:Humans; D033181:Information Dissemination / Q000379:methods*; D007407:Interviews as Topic; D008297:Male; D008490:Medical Informatics / Q000592:standards*; D019982:Organizational Case Studies; D012308:Risk Management / Q000379:methods* / Q000458:organization & administration; D018581:Technology Transfer; D014481:United States; D014493:United States Department of Veterans Affairs
keywords: Generic Security Template; Healthcare; Knowledge redistribution; Lessons learned; Security incident