Better Safe Than Sorry: Case Study on Marginal Utility of Technical Cybersecurity Measures in Healthcare

The paper presents the microeconomic theory of marginal utility altered according to the terms of cybersecurity investment in healthcare. As part of the paper, cooperation was initiated with a Czech hospital which unsuccessfully applied for a subsidy from the National Recovery Plan. Due to the rejection of the subsidy, but the still underdeveloped state of cybersecurity in the healthcare facility, the author was approached with a request for assistance in negotiating financial support with the hospital’s top management from its own resources. The paper alters the ROSI model of return on security investment in order to clearly show the impact of the proposed investments on each protected person, and especially their marginal financial burden on the entire facility. The presented alteration of the ROSI model is applicable across the healthcare sector and beyond, especially in the industries that face difficulties counting the exact cost of data loss.