Proactive vs. Reactive Security Investments in the Healthcare Sector Proactive vs. Reactive Security Investments in the Healthcare Sector

Building on organizational learning theory, we seek to identify the performance effects of security investments that arise from previous failures or external regulatory pressure. This study focuses on the healthcare sector where legislation mandates breach disclosure and detailed data on security investments are available. Using a Cox proportional hazard model, we demonstrate that proactive security investments are associated with lower security failure rates than reactive investments. Further, the results show that external pressure improves the security performance of healthcare organizations. However, external pressure decreases the positive effect of proactive investments on security performance. This implies that proactive investments, voluntarily made, have the greatest impact on security performance. Our findings suggest that security managers and policy makers should pay attention to the strategic and regulatory factors influencing security investment decisions. The implications for proactive and reactive learning with external regulatory pressure can likely be generalized to other industries.