BYOD Security Practices in Australian Hospitals – A Qualitative Study

The rapid adoption of Bring-Your-Own-Device (BYOD) in hospitals presents a conundrum, with potential benefits in productivity and mobility counterbalanced by significant data security concerns. This study aims to address the gaps in existing research by offering a comprehensive qualitative exploration of BYOD security practices in hospitals. Seven in-depth semi-structured interviews were conducted among IT personnel overseeing cybersecurity in Australian public hospitals, shedding light on the unique BYOD challenges faced by healthcare institutions. A hybrid thematic analysis was carried out to capture socio-technical factors influencing BYOD security. Results reveal that while BYOD is widely used across several device types, limitations are imposed on device functionalities and services by hospital managements to manage security risks. Furthermore, the over-reliance on staff behavior emerges as a critical challenge, leading to cybersecurity risks such as data leakage, and inadvertent sharing of patient information. Technological solutions like mobile device management (MDM) and virtualisation, though employed to enhance control, face resistance due to concerns about privacy invasion. In terms of policy, enforcement issues contribute to low compliance, emphasising the need for comprehensive, tailored, and updated BYOD policies that align with clinical workflows. The study also identifies awareness challenges, proposing incentivized, broadened, and customised training programs to enhance clinicians’ engagement. Establishing a proactive cybersecurity culture, coupled with active stakeholder engagement, is highlighted as pivotal for safe and productive BYOD use. This research contributes valuable insights into the complexities of managing hospital BYOD security, informing future improvements in strategy, policies, and processes.