ASSESSMENT OF CYBERSECURITY KNOWLEDGE, ATTITUDES, AND PRACTICES AMONG HEALTHCARE WORKERS AT AN-NAJAH NATIONAL UNIVERSITY HOSPITAL: A CROSS-SECTIONAL STUDY

Abstract

Background: In the light of the increasing reliance on digital technologies and electronic health records in healthcare institutions, cybersecurity has become an essential safeguard for patients’ safety and the continuity of health services. Healthcare workers play an important role in ensuring information security; nevertheless, a lack of cybersecurity awareness, attitude, or practice may be a potential threat and cause a cyberattack. Consequently, this research attempted to evaluate the cybersecurity knowledge, attitudes, and practices (KAP) level among healthcare workers in a university teaching hospital in Nablus, Palestine. Methods: A cross-sectional survey using a structured questionnaire based on past literature was conducted. A stratified proportional convenience sample of 245 healthcare workers was recruited from a university teaching hospital in Nablus, Palestine. Participants’ sociodemographic information was also obtained. Descriptive analysis was used to provide summary statistics on the sociodemographic details and knowledge, attitude, and practice (KAP) scores. Categorical variables were analyzed using frequency and percentages, whereas KAP scores were reported using the median and interquartile range (IQR). Normality was assessed using the Shapiro-Wilk test, because the distribution of KAP scores was non-normal, nonparametric tests were performed. Mann-Whitney U test and Kruskal-Wallis test were used to determine differences in KAP scores according to various sociodemographic variables. Spearman’s rank correlation coefficient was used to identify correlations between various KAP domains. Internal consistency reliability was assessed separately for each domain using the Kuder-Richardson Formula 20 (KR-20) for the Knowledge section and Cronbach’s alpha for the Attitudes and Practices sections. The level of significance was set at 0.05. Results: The number of participants involved in this study was 245 healthcare workers. There were 124 males (50.6%) and 121 females (49.4%), with a median age of 32 years (IQR = 7) and median work experience of 8 years (IQR = 7). The largest proportion among participants consisted of nurses (44.5%), followed by allied healthcare professionals (21.2%), physicians (18.0%), and administrative staff (16.3%). It is worth noting that 64.5% of all the participants did not have any cybersecurity training, while those who received cybersecurity training showed much greater knowledge, attitude, and practice scores (p ≤ 0.001). Participants were aware of the most common threats concerning cybersecurity, for example, phishing emails (82.4%) and unauthorized devices (87.8%), but they did not show sufficient knowledge about password security (42.4%) and ransomware (51.0%). Overall, median scores revealed that attitudes (77.5) and practices (77.8) were higher than the level of knowledge (70.0). In addition, there was a significant association between attitudes and practices (ρ = 0.537, p < 0.001). Conclusions: Healthcare workers demonstrated higher levels of attitudes and practices toward cybersecurity compared to knowledge, with limitations in essential areas like password security and ransomware awareness. Cybersecurity training was significantly associated with higher KAP scores; however, as this was a cross-sectional study, causal relationships cannot be established, and longitudinal studies are needed to further evaluate this association. Findings underscore the need for targeted training programs and continuous awareness initiatives to enhance information security within healthcare settings.