Towards a model for understanding failures in health data protection: a mixed-methods study

In digital health ecosystems, protecting health data is crucial for organisational survival, competitiveness, and effective care delivery. As healthcare organisations increasingly adopt digital health, failures in data protection pose significant risks. This mixed-method study identifies and explains key failure factors in health data protection. We conducted a literature review and a three-round Delphi study with data security practitioners and researchers, identifying and ranking 30 failure factors. The study led to the identification and ranking of 30 failure factors. Next, to develop a contextualised understanding of the failure factors, we conducted a qualitative study and applied the People-Process-Technology (PPT) framework to develop a research model. The top seven failure factors mapped to failures related to people (‘non-compliant behaviour’, and ‘lack of cybersecurity awareness’), process (‘inadequate risk management’, ‘inadequate data integrity monitoring and protection’, and ‘lack of data breach response and recovery plan’) and technology (‘unsecure third-party applications’, and ‘lack of data protection by design’). In the qualitative inquiry, we explained how these factors could lead to data breaches. Understanding the failure factors in health data protection helps healthcare organisations in successful data protection and devising mitigation policies to minimise the risk of data breaches.