ArticleJournal of medical Internet research2020
Why Employees (Still) Click on Phishing Links: Investigation in Hospitals.
Article in Journal of medical Internet research, 2020. The graph could read no effect estimate from its abstract, so it casts no vote on the map. Cited by 20 papers, 1 of them a synthesis that pooled it.
What it found
Each row is one number read from the abstract, on the scale the paper reported it, with its interval. Left of the dashed line favours the treatment, right favours the comparator. Under each row is the sentence it came from. New to these charts? A ten-minute tutorial.
The abstract states no effect estimate the extractor could read, or names no intervention and outcome on the map, so this paper lights no cell and moves no belief. It is still indexed, cited and linked below.
The trial behind it
Trials whose registry record cites this paper, or whose number appears in the abstract. A trial that started after this paper was published is citing it as background, not reporting it.
Neither the registry nor the abstract names a trial number. If this is a trial report, that itself is worth knowing.
Who cites it
20 citing papers in PubMed, 1 synthesis or guideline pooled it.
- Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review.Sensors (Basel, Switzerland) · 2021Pooled it
- Cognitive Dissonance-Based Priming Intervention: Randomized Encouragement With in-the-Wild Phishing Simulation Attack in Health Care.Journal of medical Internet research · 2026Trial
- Bridging data gaps and tackling human vulnerabilities in healthcare cybersecurity with generative AI.PLOS digital health · 2025Article
- Prompt injection attacks on vision language models in oncology.Nature communications · 2025Article
- Factors Influencing Telemedicine Adoption Among Health Care Professionals: Qualitative Interview Study.JMIR formative research · 2025Article
- Cyber Hygiene Methodology for Raising Cybersecurity and Data Privacy Awareness in Health Care Organizations: Concept Study.Journal of medical Internet research · 2023Article
- The impact of lecture playback speeds on concentration and memory.BMC medical education · 2023Article
- State-of-the-art session key generation on priority-based adaptive neural machine (PANM) in telemedicine.Neural computing & applications · 2023Article
- Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors.Healthcare (Basel, Switzerland) · 2022Review
- The COVID-19 scamdemic: A survey of phishing attacks and their countermeasures during COVID-19.IET information security · 2022Review
- A Cybersecurity Culture Survey Targeting Healthcare Critical Infrastructures.Healthcare (Basel, Switzerland) · 2022Article
- Hospital cybersecurity risks and gaps: Review (for the non-cyber professional).Frontiers in digital health · 2022Review
- Sensors for Context-Aware Smart Healthcare: A Security Perspective.Sensors (Basel, Switzerland) · 2021Review
- Hospitals' Cybersecurity Culture during the COVID-19 Crisis.Healthcare (Basel, Switzerland) · 2021Article
- Information Security Awareness and Behaviors of Health Care Professionals at Public Health Care Facilities.Applied clinical informatics · 2021Article
- Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review.Journal of medical Internet research · 2021Article
- Cybersecurity Risks in a Pandemic.Journal of medical Internet research · 2020Article
- The Role of Health Concerns in Phishing Susceptibility: Survey Design Study.Journal of medical Internet research · 2020Article
- Human Cognition Through the Lens of Social Engineering Cyberattacks.Frontiers in psychology · 2020Review
- Article
Corrections and comments
PubMed lists nothing against this paper. Absence here is not a guarantee, only a check that was made.
Authors and funding
4 authors.
Funding
No grant is acknowledged in the PubMed record.
Abstract
backgroundHospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients.
objectiveThis study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual clicking data.
methodsWe first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of compliance intention. We matched employees' survey results with their actual clicking data from phishing campaigns.
resultsOur analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well as collective felt trust and trust in information security technology, are positively related to compliance intention. However, compliance intention is not significantly related to compliance behavior. Only the level of employees' workload is positively associated with the likelihood of employees clicking on a phishing link.
conclusionsThis is one of the few studies in information security and decision making that observed compliance behavior by analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie, clicking on phishing links), hospitals should better manage employees' workload to increase information security. Our findings can help health care organizations augment employees' compliance with their cybersecurity policies and reduce the likelihood of clicking on phishing links.
Indexed as
Identifiers
What OpenQuestion holds
Registered trials
Read under generation 80e0d062 · epoch 390. Bibliography from PubMed, PubMed Central and OpenAlex; grants from NIH RePORTER; trial links from ClinicalTrials.gov; estimates, votes and beliefs from the OpenQuestion graph.