Hospital Bring-Your-Own-Device Security Challenges and Solutions: Systematic Review of Gray Literature

BYOD security behaviour and preferences among hospital clinicians - A qualitative study

BACKGROUND/OBJECTIVE

The use of personal devices for work purposes (Bring-your-own-device) has increased in hospitals, as it facilitates productivity and mobility for clinicians. However, owing to increased risk of leaking patient information, and heavy reliance of patient data privacy on user actions, BYOD is a major challenge for hospitals. There has been a dearth of empirical research studying clinicians' BYOD security behaviour. Therefore, the study's aim was to attain subjective understanding of clinicians' attitudes and preferences towards protecting patient data on their devices through a qualitative study.

METHODS

14 semi-structured interviews were conducted among Australian hospital-based clinicians. A hybrid thematic analysis was conducted using the framework method to explore socio-technical themes pertaining to the clinicians' BYOD security behavioural practices.

RESULTS

Limited use of secure tools like antivirus and passcodes, and inadequate separation of patient and personal data on BYOD devices was found. Key technology concerns included malware introduction into hospital network, inadvertent patient data sharing, and slow remote access. Hospitals lacked dedicated BYOD policies and training, resulting in unsafe practices. Participants also cited misalignment of BYOD policies with workflow needs, privacy maintenance challenges and fears of personal data breaches, while calling for improved communication between technical and clinical staff and a strong cybersecurity culture.

CONCLUSION

This study provides a comprehensive understanding of BYOD related user behaviour and the usefulness of security controls used in time-sensitive and complex hospital environments. It can inform future policies or processes by advocating for secure and productive BYOD use.

Use of Facebook in a quality improvement campaign to increase adherence to guidelines in intensive care: A qualitative study of nurses' and physicians' experiences

OBJECTIVES

This study aimed to explore intensive care unit nurses' and physicians' experiences with professional content provided through closed Facebook groups, as part of a quality improvement campaign to improve guideline adherence.

RESEARCH METHODOLOGY

This study used an exploratory qualitative design. In June 2018, data were collected through focus groups of intensive care nurses and physicians who also were members of closed Facebook groups. Data were analysed using reflexive thematic analysis, and the study was reported according to the consolidated criteria for reporting qualitative research.

SETTING

The study's setting was four intensive care units at Oslo University Hospital, Norway. Professional content on Facebook comprised audit and feedback on quality indicators on intensive care topics with related pictures, videos, and weblinks.

FINDINGS

Two focus groups of 12 participants were included in this study. Two main themes were identified: 'One size does not fit all ' described that quality improvement and implementation are influenced by several factors related to current recommendations and personal preferences. Various strategies are required to serve different purposes and meet individual needs. 'Matter out of place' described conflicting experiences of being offered or exposed to professional content on Facebook.

CONCLUSION

Although the audit and feedback on quality indicators presented on Facebook motivated improvements, professional content on Facebook was perceived as inappropriate. Hospital platforms with applicable features of social media, such as reach, availability, convenience, ease, and possibility for commenting, were suggested to secure professional communication about recommended practices in intensive care units.

IMPLICATIONS FOR CLINICAL PRACTICE

Social media platforms may be useful for professional communication among ICU personnel, but appropriate hospital applications with available and applicable social media features are recommended and needed. The use of several platforms may still be needed to reach all.

Cyber Hygiene Methodology for Raising Cybersecurity and Data Privacy Awareness in Health Care Organizations: Concept Study

BACKGROUND

Cyber threats are increasing across all business sectors, with health care being a prominent domain. In response to the ever-increasing threats, health care organizations (HOs) are enhancing the technical measures with the use of cybersecurity controls and other advanced solutions for further protection. Despite the need for technical controls, humans are evidently the weakest link in the cybersecurity posture of HOs. This suggests that addressing the human aspects of cybersecurity is a key step toward managing cyber-physical risks. In practice, HOs are required to apply general cybersecurity and data privacy guidelines that focus on human factors. However, there is limited literature on the methodologies and procedures that can assist in successfully mapping these guidelines to specific controls (interventions), including awareness activities and training programs, with a measurable impact on personnel. To this end, tools and structured methodologies for assisting higher management in selecting the minimum number of required controls that will be most effective on the health care workforce are highly desirable.

OBJECTIVE

This study aimed to introduce a cyber hygiene (CH) methodology that uses a unique survey-based risk assessment approach for raising the cybersecurity and data privacy awareness of different employee groups in HOs. The main objective was to identify the most effective strategy for managing cybersecurity and data privacy risks and recommend targeted human-centric controls that are tailored to organization-specific needs.

METHODS

The CH methodology relied on a cross-sectional, exploratory survey study followed by a proposed risk-based survey data analysis approach. First, survey data were collected from 4 different employee groups across 3 European HOs, covering 7 categories of cybersecurity and data privacy risks. Next, survey data were transcribed and fitted into a proposed risk-based approach matrix that translated risk levels to strategies for managing the risks.

RESULTS

A list of human-centric controls and implementation levels was created. These controls were associated with risk categories, mapped to risk strategies for managing the risks related to all employee groups. Our mapping empowered the computation and subsequent recommendation of subsets of human-centric controls to implement the identified strategy for managing the overall risk of the HOs. An indicative example demonstrated the application of the CH methodology in a simple scenario. Finally, by applying the CH methodology in the health care sector, we obtained results in the form of risk markings; identified strategies to manage the risks; and recommended controls for each of the 3 HOs, each employee group, and each risk category.

CONCLUSIONS

The proposed CH methodology improves the CH perception and behavior of personnel in the health care sector and provides risk strategies together with a list of recommended human-centric controls for managing a wide range of cybersecurity and data privacy risks related to health care employees.

Vernon T. Design and Integration of a Texting Tool to Keep Patients’ Family Members Updated During Hospitalization: Family Members’ Perspectives

While there is an evolving literature on the benefits of texting and patient-centered technologies, texting initiatives have not focused on family members. We sought to identify patients’ family members’ perspectives on facilitators and barriers to using 1 digital texting innovation to promote family-centered care during patients’ hospitalizations. This qualitative study was conducted at a tertiary care center in Houston, consisting of 7 hospitals (1 academic hospital and 6 community hospitals), involving analyzation of 3137 comments from family members who used the digital texting technology. Thematic analysis methods were used. The data analysis for loved ones’ feedback resulted in 4 themes as facilitators: (1) inpatient text messaging keeps loved ones updated and connected (n = 611); (2) inpatient text messaging allows for stronger continuity of communication (n = 69); (3) messaging promotes a sense of staff compassion and service (n = 245); and (4) messaging reduces phone calls (n = 65). The data analysis resulted in 4 themes as barriers to text messaging helpfulness: (1) messages could feel generic (n = 31); (2) inpatient texting was not needed if all loved ones were regularly at bedside (n = 6); (3) messages could have a perceived delay (n = 37); and (4) security features could impact convenience (n = 29). Our findings indicate that family members and loved ones value inpatient text messages, not only for the information the messages provide, but also because the act of writing text messages and preparing loved ones shows inclusiveness, compassion, and family-centered care.

Creating a secure clinical 'Bring Your Own Device' BYOD photography service to document and monitor suspicious lesions in the lid oncology clinic

BACKGROUND

Ophthalmic examinations are mostly documented using sketches and written descriptions. Improvements in app security and IT infrastructure mean that high-quality anterior segment photographs can be routinely collected with smartphones alone. The lid oncology team relied on pre-operative formal slit-lamp imaging in the one-stop biopsy clinic, a lengthy process with capacity limitations, that risked delays to care.

METHODS

A Bring Your Own Device (BYOD) photography service was developed through a series of iterations and collaborations. Healthcare Assistants took photographs on iPhone SE with Quikvue lens attachments in Pando app. Lesions requiring a slit lamp were photographed by the doctor. Images were uploaded to the patient record twice weekly. The service was evaluated using time-motion studies, imaging quality and utility grading, and patient feedback.

RESULTS

BYOD photography saved lid oncology patients 41 min (one-third of total appointment time) and reduced delays to treatment to zero. A patient survey reflected the acceptability of the service, with 100% feeling photography was important at every visit. In terms of utility, 97.5% of smartphone images were suitable for monitoring lesions and making management decisions. The management plan based on the smartphone photographs was consistent with the management plan formulated face-to-face in clinic in 92.5% images.

CONCLUSION

BYOD photography has replaced formal slit-lamp imaging in the lid oncology service. This sustainable, cost-effective BYOD solution requires little training and can be adapted, reproduced, and scaled globally. BYOD photography can offer detailed records to monitor progress, contribute to remote care models, improve patient experience, and reducing medical error.

Reverse Engineering of Digital Measures: Inviting Patients to the Conversation

Background

Digital measures offer an unparalleled opportunity to create a more holistic picture of how people who are patients behave in their real-world environments, thereby establishing a better connection between patients, caregivers, and the clinical evidence used to drive drug development and disease management. Reaching this vision will require achieving a new level of co-creation between the stakeholders who design, develop, use, and make decisions using evidence from digital measures.

Summary

In September 2022, the second in a series of meetings hosted by the Swiss Federal Institute of Technology in Zürich, the Foundation for the National Institutes of Health Biomarkers Consortium, and sponsored by Wellcome Trust, entitled "Reverse Engineering of Digital Measures," was held in Zurich, Switzerland, with a broad range of stakeholders sharing their experience across four case studies to examine how patient centricity is essential in shaping development and validation of digital evidence generation tools.

Key Messages

In this paper, we discuss progress and the remaining barriers to widespread use of digital measures for evidence generation in clinical development and care delivery. We also present key discussion points and takeaways in order to continue discourse and provide a basis for dissemination and outreach to the wider community and other stakeholders. The work presented here shows us a blueprint for how and why the patient voice can be thoughtfully integrated into digital measure development and that continued multistakeholder engagement is critical for further progress.

Smartphone Use and Security Challenges in Hospitals: A Survey among Resident Physicians in Germany

Although mobile devices support physicians in a variety of ways in everyday clinical practice, the use of (personal) mobile devices poses potential risks for information security, data protection, and patient safety in hospitals. We used a cross-sectional survey-based study design to assess the current state of smartphone use among resident physicians in hospitals and to investigate the relationships between working conditions, current smartphone usage patterns, and security-related behavior. In total, data from 343 participating physicians could be analyzed. A large majority (98.3%) used their smartphones during clinical practice. Of the respondents who used a smartphone during clinical practice, only 4.5% were provided with a smartphone by their employer. Approximately three-quarters of the respondents who used their smartphones for professional communication never/almost never used dedicated GDPR-compliant messenger services. Using a hierarchical regression model, we found a significant effect of the organizational resources Social Support (Supervisor) and Information Security-related Communication on security-related behavior during the selection of medical apps (App Selection). Smartphones are an important part of digital support for physicians in everyday clinical practice. To minimize the risks of use, technical and organizational measures should be taken by the hospital management, resulting, for example, in a Bring-Your-Own-Device (BYOD) initiative.

Traumatology: Adoption of the Sm@rtEven Application for the Remote Evaluation of Patients and Possible Medico-Legal Implications

Telemedicine is the combination of technologies and activities that offer new remote ways of medical care. The Sm@rtEven application project is a remote assistance service that follows patients affected by lower limb fractures surgically treated at Galeazzi Orthopedic Institute (Milan, Italy). The Sm@rtEven application aims to evaluate the clinical conditions of patients treated for lower limb fracture after discharge from hospital using remote follow-up (FU). The project is not a substitute for traditional clinical consultations but an additional tool for a more complete and prolonged view over time. The Sm@rtEven application is installed on patients’ smartphones and is used daily to communicate with healthcare personnel. In the first protocol, patients had to complete different tasks for 30 days, such as monitoring the load progression on the affected limb, the number of steps during the day, and body temperature and completing a questionnaire. A simplified protocol was proposed due to the pandemic and logistical issues. The revised protocol enrolled patients after more than 30 days of their operation, prioritized the rehabilitation phase, and required patients to use the app for fewer days. After an initial phase of correct use, a reduction in patient compliance was gradually reported in the first protocol. However, patient compliance in the second protocol remained high (96.25%) in the recording of all the required parameters. The Sm@rtEven application has proven to be a valuable tool for following patients remotely, especially during the pandemic. Telemedicine has the same value as traditional clinical evaluations, and it enables patients to be followed over long distances and over time, minimizing any discomfort.

Identifying and ranking the attributes of hospitals readiness to apply bring your own device: An explanatory sequential mixed study

Objective

The Bring Your Own Device (BYOD) approach has promoted the usage of personal mobile devices for organizational and carrier purposes. Applying a BYOD approach might provide various challenges for healthcare organizations. This study endeavored to identify the attributes of hospitals readiness in applying BYOD and to rank these attributes in order to develop appropriate policies for dealing with challenges.

Materials and methods

This study is an explanatory sequential mixed method design that was carried out in two qualitative and quantitative phases for identifying the BYOD attributes and ranking them, respectively. Semi-structured interviews with 15 experts in the BYOD field were performed through in the qualitative phase. Purposive and snowball sampling approaches were used to choose experts. Thematic analysis was used to analyze qualitative data. The identified attributes were ranked in a quantitative phase by asking 10 experts using fuzzy hierarchical analysis.

Results

Six main themes and 23 subthemes were identified. The findings of hierarchical analysis showed that ethical considerations, management principles, human resources, legislation considerations, cost, and technical infrastructure as the six main themes, respectively, have priority in hospitals readiness for BYOD.

Conclusion

Addressing the highlighted priorities, from ethical considerations to technical infrastructure, in the formulation and implementation of formal programs and policies by health managers and authorities will prepare hospitals for the use of BYOD while decreasing the challenges associated with it.

Bacterial contamination of the smartphones of healthcare workers in a German tertiary-care hospital before and during the COVID-19 pandemic

Background

Assuming that hygiene measures have improved significantly due to COVID-19, we aimed to investigate bacterial colonization on smartphones (SPs) owned by healthcare workers (HCWs) before and during the pandemic.

Methods

Employing a before-and-after study design, randomly selected HCWs were included. Devices underwent sampling under real-life conditions, without prior manipulation. Swabs were collected in 2012 (pre-pandemic) and 2021 to determine microbial colonization. Isolates were identified by MALDI-TOF mass spectrometry and underwent microbiological susceptibility testing.

Results

The final analysis included 295 HCWs (67% female, mean age 34 years) from 26 wards. Bacterial contamination was present on 293 of 295 SP screens (99.3%). The proportion of clinically relevant bacterial pathogens (eg Staphylococcus aureus, enterococci, Enterobacterales, non-fermenting bacteria) ranged from 21.2% in 2012 to 39.8% in 2021. Resistance profiles revealed a proportion of multidrug-resistant bacteria such as MRSA and VRE of less than 2%. The comparison of before-and-after sampling showed a significant increase in smartphone use during work from 2012 to 2021 with a simultaneous increase in cleaning intensity, probably as a result of the COVID-19 pandemic.

Conclusions

Bacterial contamination of SPs within the hospital is of concern and can serve as a source of cross-contamination. Hence, in addition to excellent hand hygiene, SPs must be carefully disinfected after handling in healthcare. Behavioral changes related to the COVID-19 pandemic could have a significant impact if implemented sustainably in everyday clinical practice.

System-Level Factors Associated With Telephone and Video Visit Use: Survey of Safety-Net Clinicians During the Early Phase of the COVID-19 Pandemic

BACKGROUND

The COVID-19 pandemic prompted safety-net health care systems to rapidly implement telemedicine services with little prior experience, causing disparities in access to virtual visits. While much attention has been given to patient barriers, less is known regarding system-level factors influencing telephone versus video-visit adoption. As telemedicine remains a preferred service for patients and providers, and reimbursement parity will not continue for audio visits, health systems must evaluate how to support higher-quality video visit access.

OBJECTIVE

This study aimed to assess health system-level factors and their impact on telephone and video visit adoption to inform sustainability of telemedicine for ambulatory safety-net sites.

METHODS

We conducted a cross-sectional survey among ambulatory care clinicians at a hospital-linked ambulatory clinic network serving a diverse, publicly insured patient population between May 28 and July 14, 2020. We conducted bivariate analyses assessing health care system-level factors associated with (1) high telephone adoption (4 or more visits on average per session); and (2) video visit adoption (at least 1 video visit on average per session).

RESULTS

We collected 311 responses from 643 eligible clinicians, yielding a response rate of 48.4%. Clinician respondents (N=311) included 34.7% (n=108) primary or urgent care, 35.1% (n=109) medical, and 7.4% (n=23) surgical specialties. Our sample included 178 (57.2%) high telephone adopters and 81 (26.05%) video adopters. Among high telephone adopters, 72.2% utilized personal devices for telemedicine (vs 59.0% of low telephone adopters, P=.04). Video nonadopters requested more training in technical aspects than adopters (49.6% vs 27.2%, P<.001). Primary or urgent care had the highest proportion of high telephone adoption (84.3%, compared to 50.4% of medical and 37.5% of surgical specialties, P<.001). Medical specialties had the highest proportion of video adoption (39.1%, compared to 14.8% of primary care and 12.5% of surgical specialties, P<.001).

CONCLUSIONS

Personal device access and department specialty were major factors associated with high telephone and video visit adoption among safety-net clinicians. Desire for training was associated with lower video visit use. Secure device access, clinician technical trainings, and department-wide assessments are priorities for safety-net systems implementing telemedicine.

Understanding the role of the bring-your-own-device policy in medical education and healthcare delivery at the University of Botswana’s Faculty of Medicine

Purpose

Seeking to leverage on benefits of personal mobile device use, medical schools and healthcare facilities are increasingly embracing the use of personal mobile devices for medical education and healthcare delivery through bring-your-own-device (BYOD) policies. However, empirical research findings that could guide the development of BYOD policies are scarce. Available research is dominated by studies that were guided by technocentric approaches, hence seemingly overlooking the complexities of the interactions of actors in mobile device technologies implementation. The purpose of this study was to use the actor–network theory to explore the potential role of a BYOD policy at the University of Botswana’s Faculty of Medicine.

Design/methodology/approach

Purposive sampling was used to select the participants and interviews, focus group discussions, observations and document analysis were used to collect data. Data were collected from 27 participants and analysed using grounded theory techniques. Emerging themes were continually compared and contrasted with incoming data to create broad themes and sub-themes and to establish relationships or patterns from the data.

Findings

The results suggest that the potential roles for BYOD policy include promoting appropriate mobile device use, promoting equitable access to mobile devices and content, and integrating mobile devices into medical education, healthcare delivery and other institutional processes.

Research limitations/implications

BYOD policy could be conceptualized and researched as a “script” that binds actors/actants into a “network” of constituents (with shared interests) such as medical schools and healthcare facilities, mobile devices, internet/WiFi, computers, software, computer systems, medical students, clinical teachers or doctors, nurses, information technology technicians, patients, curriculum, information sources or content, classrooms, computer labs and infections.

Practical implications

BYOD is a policy that seeks to represent the interests (presents as a solution to their problems) of the key stakeholders such as medical schools, healthcare facilities and mobile device users. BYOD is introduced in medical schools and healthcare facilities to promote equitable access to mobile devices and content, appropriate mobile device use and ensure distribution of liability between the mobile device users and the institution and address the implication of mobile device use in teaching and learning.

Originality/value

The BYOD policy is a comprehensive solution that transcends other institutional policies and regulations to fully integrate mobile devices in medical education and healthcare delivery.

Towards an effective framework for integrating patient-reported outcomes in electronic health records

Background

In the past decade, electronic modalities are increasingly deployed to integrate patient-reported outcomes into electronic health records. Most popularly, patient portals are used for remote questionnaires, and tablets are provided to patients in-office in case they need help. They are both useful. But some barriers are still in the way, which place burdens on patients and clinicians in the process of routine data collection.

Objective

This study aims to describe a portable and scalable framework which can simplify the patient-reported outcome integration by mitigating the related burdens.

Methods

A framework was proposed to use a modular approach to replace the tethered approach. The framework was open-sourced on GitHub. After development and testing, it was evaluated on an instrument with 24 questions in a real clinical setting. Patients were randomly selected in every modality-based group. For objective analysis, completion time and response rate were collected. No-show data was collected and analyzed. For subjective analysis, the NASA Task Load Index was used to measure workload, and the Net Promoter Score was used to assess user satisfaction.

Results

The model could contain 46,656 questions. A quick response code could store 1120 encoded items. For remote visits, the response rate was improved compared to the portal group (76.6% vs. 61.1%). The completion time was reduced by 37.5% when compared to the tablet group and was reduced by 43.4% when compared to the portal group. The workload for clinicians and patients was both reduced significantly (p < 0.001). A higher Net Promoter Score was rated by both clinicians (89.3%) and patients (86.5%). Compared to the portal group, the no-show rate was reduced (11.7% vs. 8.6%).

Conclusions

Collecting patient-reported outcomes over a quick response code appears to be an alternative modality to enable a simplified integration. This study provides new insights to collect patient-reported outcomes with interoperability and substitutability in mind.

Early clinical management of severe burn patients using telemedicine: a pilot study protocol

Background

Emergency physicians are responsible for assessing the severity of a patient's burns, which determines whether the patient needs to be transferred to a burn center. Such a proper assessment represents a daunting task because severe burn injuries are rare. Inaccurate estimates often result in unjustified and costly transfers and unneeded fluid resuscitation and assisted ventilation procedures. Telemedicine offers a solution to these challenges. The present pilot study aims to investigate the feasibility, acceptability, and potential value of a large telemedicine initiative at the University of Montreal Health Center's burn center and its network of referring hospitals.

Methods

A three-stage study protocol is proposed to achieve this objective. First, a proof of concept phase will assess the technical feasibility of telemedicine at one referring hospital with a high volume of patient transfers. Second, the organizational and human feasibility of the project will be evaluated in four referring medical centers. All teleconsultation sessions will be analyzed using the WHO's telemedicine implementation model. The third phase will consist of evaluating the potential impacts of telemedicine in a subset of 10 referring hospitals. The quality of communications between referring physicians and specialists will be assessed using semi-structured interviews. A pre-test/post-test with a comparison group design will be used to assess the effects of telemedicine on patient transfers, ventilation procedures, patient complications, mortality, length of ICU stay, and additional surgical procedures. The economic viability of telemedicine will be assessed using a cost-minimization approach.

Discussion

The telemedicine initiative is expected to yield positive and significant outcomes that are relevant to a wide range of medical centers that already use or are considering using a similar technology. The contribution of this pilot study lies in its ability to reveal technological, organizational, and human barriers and provide a preliminary assessment of the clinical and economic value of a large-scale telemedicine initiative in the context of burn medicine.