‘The Way to Be Safe Is Never to Be Secure': Security of ePHI in South African Hospitals

Data security is used to protect sensitive and confidential patient health information. The healthcare sector is affected by the myriad of cybersecurity threats and attacks. Safeguarding Electronic Personal Health Information (ePHI) against cybersecurity threats and attacks is important. This study sought to explore the security of ePHI in South African hospitals with a view to proposing a framework. A qualitative study was carried out in public hospitals using semi-structured interviews with purposively selected participants of IT managers, technicians, and network controllers. The findings revealed that South African hospitals suffer from a range of cybersecurity threats, including Trojan viruses, cryptographic attacks, distributed denial of service attacks, phishing emails, password attacks, and malware attacks. The lack of security policies and poor compliance with data protection laws have been recognised as major challenges facing hospitals. The study proposes a security framework that could assist hospitals in securing ePHI by providing a set of guidelines and safeguards.