Linking Cyber Security Improvement Actions in Healthcare Systems to Their Strategic Improvement Needs

Abstract The healthcare industry lags behind other industries in protecting its data from cyber-attacks. As health data contain sensitive personal and financial information, cyber security incidents are a growing threat. To change this trend, it is important to develop systematic procedures for identifying suitable approaches for responding to these needs. The main objective of the research described in this article is to build a structured framework of an eventual empirical research for linking cyber security improvement actions in healthcare systems to their strategic improvement needs. The structured framework is based on Quality Function Deployment (QFD), initially a product oriented quality technique. The essence of the QFD method is to extract the customer needs or desires and then to translate them into measurable product quality characteristics and further processing. As by its structure this is a generic multi-purpose planning framework, its usage has been enhanced to include many other topics. Our conceptual model has a top-down structure with QFD sequential matrices. To propagate the improvement needs from the strategic level to the action level, two QFD oriented matrices are developed. The first matrix translates the strategic improvement needs of a healthcare system into prioritized information/cyber improvement needs. The second matrix prioritizes the actions for improving the information/cyber procedures.