title: Developing a Security Metrics Scorecard for Healthcare Organizations.
abstract: In healthcare, information security is a key aspect of protecting a patient's privacy and ensuring systems availability to support patient care. Security managers need to measure the performance of security systems and this can be achieved by using evidence-based metrics. In this paper, we describe the development of an evidence-based security metrics scorecard specific to healthcare organizations. Study participants were asked to comment on the usability and usefulness of a prototype of a security metrics scorecard that was developed based on current research in the area of general security metrics. Study findings revealed that scorecards need to be customized for the healthcare setting in order for the security information to be useful and usable in healthcare organizations. The study findings resulted in the development of a security metrics scorecard that matches the healthcare security experts' information requirements.
authors.affiliation: University of Victoria alumna, has a BSc in computer engineering, MSc in engineering and MSc in Health information science. Her main areas of interest are information security and privacy, human-computer interaction and usability studies in healthcare.
authors.forename: Heba
authors.initials: H
authors.lastname: Elrefaey
authors.affiliation: Associate Professor in the School of Health Information Science and an Adjunct Associate Professor in the School of Nursing at the University of Victoria. Dr. Borycki conducts research in the areas of health technology safety, clinical informatics, human factors and organizational behaviour and change management involving technology.
authors.forename: Elizabeth
authors.initials: E
authors.lastname: Borycki
authors.affiliation: Professor and Director of the School of Health Information Science at the University of Victoria. Dr. Kushniruk conducts research in a number of areas including evaluation of the effects of technology, human-computer interaction in healthcare and other domains as well as cognitive science. His work is known internationally and he has published widely in the area of health informatics.
authors.forename: Andrea
authors.initials: A
authors.lastname: Kushniruk
mesh_terms: D016494:Computer Security / Q000706:statistics & numerical data; D055317:Evidence-Based Practice; D006268:Health Facilities; D006801:Humans; D012637:Security Measures / Q000458:organization & administration