Assessing Healthcare Professionals' Compliance with Information Security Policies in Public and Private Hospitals in Mogadishu, Somalia: An Extended Protection Motivation Theory Approach

ABSTRACT Background: The progressive digitalization of healthcare systems in post-conflict Sub-Saharan Africa has catalyzed the adoption of Electronic Health Records (EHR) and integrated Hospital Information Systems (HIS). However, this rapid technological transition has introduced critical cybersecurity vulnerabilities. In Mogadishu, Somalia, patient health information is routinely exposed to data breaches, unauthorized credential sharing, and unsanctioned mobile transmissions over consumer messaging platforms (e.g., WhatsApp). While technical countermeasures are essential, organizational cybersecurity hinges primarily upon human compliance with Information Security Policies (ISP). Objectives: Grounded in Protection Motivation Theory (PMT) and augmented by organizational drivers (Top Management Support and Information Security Awareness), this study empirically investigates the cognitive, psychological, and organizational factors predicting Information Security Policy Compliance Intention (ISPCI) and Actual Compliance Behavior (ACB) among healthcare professionals in Mogadishu, Somalia. In addition, the study examines structural invariance across public and private hospital sectors. Methods: A cross-sectional explanatory survey design was executed across eight major tertiary healthcare facilities in Mogadishu (3 public and 5 private). Empirical data were obtained from N = 384 active clinical and administrative personnel (physicians, registered nurses, laboratory scientists, pharmacists, and medical records/IT officers). Partial Least Squares Structural Equation Modeling (PLS-SEM) and Multi-Group Analysis (PLS-MGA) were conducted using SmartPLS 4 to assess the psychometric measurement and structural hypotheses. Results: The empirical model demonstrated substantial explanatory power, accounting for 54.8% of the variance in Compliance Intention (R2 = 0.548) and 37.5% of the variance in Actual Compliance Behavior (R2 = 0.375). Coping appraisal constructs emerged as dominant predictors: Self-Efficacy (β = 0.236, t = 5.120, p < 0.001) and Response Efficacy (β = 0.215, t = 4.632, p < 0.001) significantly fostered compliance intentions, whereas Response Cost exerted a significant inhibiting effect (β = -0.178, t = 3.892, p < 0.001). Threat appraisal elements (Perceived Severity: β = 0.162, p < 0.001; Perceived Vulnerability: β = 0.141, p = 0.002) and organizational enablers (Information Security Awareness: β = 0.254, p < 0.001; Top Management Support: β = 0.218, p < 0.001) strongly reinforced compliance. Compliance Intention, in turn, robustly translated into Actual Compliance Behavior (β = 0.612, t = 16.420, p < 0.001). Multi-group analysis confirmed structural invariance across public and private hospitals (Δβ ≤ 0.082, p > 0.05). Conclusions & Implications: Healthcare cybersecurity in fragile contexts cannot rely solely on fear appeals or perimeter defenses. Sustainable compliance requires institutional leadership to lower workflow friction (response costs) by integrating seamless single-sign-on protocols and deploying secure enterprise clinical communication platforms to replace insecure consumer apps. Hospital executives and the Federal Ministry of Health must institutionalize continuous, role-tailored cybersecurity education to transform clinical staff from the weakest security link into active healthcare cyber-defenders.