Security Investment Decisions for Healthcare Information Security Against Strategic Attacks

With the widespread adoption of digital technology, healthcare organizations face heightened risks of strategic hacker attacks due to the sensitive and valuable nature of the information they handle. Consequently, these organizations must implement security investment and insurance measures to mitigate information security risks and ensure successful digital adoption. This paper evaluates the security investment equilibrium between healthcare organizations and strategic hackers via the expected utility approach and investigates how cyber insurance, risk preferences, government penalties, and facilitation measures influence the investment decisions of healthcare organizations. The results reveal that insured healthcare organizations are expected to have greater utility than uninsured organizations. In risk-neutral scenarios, cyber insurance invariably decreases security investment due to the risk transfer effect. Organizations then shift focus from prevention to risk compensation. However, in risk-averse scenarios, where hacker efforts are significantly greater than in uninsured scenarios, insured healthcare organizations may increase their security investment to counter the heightened perceived risk and the increased possibility of successful attacks. Similarly, when insurance coverage falls short of government penalties, the decentralized decision-making healthcare organizations also increase their security investments, indirectly highlighting the incentive effect of insurance. Furthermore, inherent vulnerability moderates the influence of risk preferences on security investments. The low inherent vulnerability promotes risk-averse healthcare organizations to invest more in security than risk-neutral healthcare organizations do. In contrast, when vulnerability is high, risk-averse organizations invest less than risk-neutral organizations do. Additionally, intensifying government penalties and facilitating measures can enhance expected utility and social welfare but decrease security investments, indicating a policy dependence effect that requires balanced implementation. These findings have critical implications for healthcare organizations and governments in managing information security risks. In particular, they offer actionable insights for organizations with diverse risk preferences, enabling informed decisions on security investments and cyber insurance procurement while pursuing digital innovation.