HIM 530 Module 8 Workforce Culture Short Paper Example

Click, Then Call: Building a Security Culture Where Staff Report Mistakes at Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Module Eight Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Click, Then Call: Building a Security Culture Where Staff Report Mistakes at Osprey Point Health

Last month, a remote coder at Osprey Point Health clicked a link in a message dressed up as a payroll notice and entered her password. She realized her mistake within minutes but waited two days to report it, worried she would be disciplined. In those two days, the attacker used her account to send phishing emails to 300 colleagues. Controls such as multifactor authentication, added under the risk management plan, now limit what a stolen password can do. But the two-day delay points to a problem no tool fixes: a culture in which people hide mistakes.

What the Delay Cost

The two days mattered. Of the 300 colleagues who received the attacker's messages from the coder's real account, 14 opened the link and 3 entered their own passwords before the security team blocked the sender. Investigators then had to review the mailboxes of all four compromised accounts for patient information and determine whether a breach had occurred. The review took about 60 staff hours and found one spreadsheet of release of information requests with patient names, which required a breach risk assessment. Had the coder reported within minutes, the security team estimates that the attacker's messages would have been stopped before any were sent.

Why Busy People Click

Phishing works because it targets ordinary work habits. Among the health systems whose staff Gordon et al. (2019) tested with fake phishing messages, roughly one message in seven drew a click, with the likelihood of clicking falling as more campaigns were conducted. Jalali et al. (2020) studied hospital employees and found that knowing about phishing risk did not by itself keep people from clicking, and they pointed to the pressure of busy work as part of the explanation. For Osprey Point, this means that annual awareness training alone will not solve the problem. Staff who process hundreds of messages a day, many of them urgent, will sometimes click; the goal is to make clicks rarer and reports faster.

Why Fear Slows Reporting

The coder's delay reflects a culture problem. Edmondson (1999) found that teams in which members believed they could raise problems without being punished or embarrassed showed more learning behavior and performed better. In security, the most valuable learning behavior is reporting quickly. Every hour between a click and a report gives an attacker more time. Osprey Point's past practice of listing phishing clicks in employee evaluations taught staff that admitting a click was risky, which is the opposite of what the medical center needs.

A Report-First Culture

The new approach treats a prompt report as success, even after a click. Three changes support it. First, every email client will have a one-click button to report suspicious messages, which sends the message to the security team and removes it from the user's inbox. Second, the sanctions policy will be revised so that an employee who clicks and reports promptly faces no discipline; discipline is reserved for repeated disregard of training or for concealment. Third, the security team will thank reporters personally and publish anonymized monthly examples of phishing caught by staff, showing that reports make a difference.

Role-Based Training

Different roles face different threats. Release of information staff at Osprey Point receive phone calls from people claiming to be patients, attorneys or insurers, and some are attempts to obtain records under false pretenses. Their training will focus on identity verification: calling back through a number on file, requiring written authorizations for third parties and recognizing pressure tactics such as urgent demands from supposed executives. Coders will train on credential theft and on suspicious messages that appear to come from coding software vendors. Supervisors will learn how to respond when an employee reports a mistake, since a manager's first reaction shapes whether the next employee reports at all.

Remote Staff and Home Settings

Most of Osprey Point's health information staff now work from home, where the usual cues of an office are missing. There is no colleague at the next desk to ask whether an email looks odd, and personal and work messages arrive on nearby devices. The culture plan therefore includes a staffed chat channel where anyone can ask the security team about a suspicious message and get an answer within minutes during business hours. Remote staff also receive short training on home risks, such as family members using work laptops and printing records at home, and the remote work policy's rules on private workspaces are reinforced in each team's monthly meeting.

Simulations Done Fairly

Phishing simulations will continue quarterly, since research suggests repeated exposure reduces clicking. They will be designed to teach rather than trap: realistic but not cruel, avoiding lures that exploit staff anxieties such as fake layoff notices or pandemic bonuses. Employees who click see a short explanation of the clues they missed, and those who click repeatedly receive brief one-on-one coaching rather than public identification.

Leaders Set the Tone

Culture follows what leaders do. The chief executive and department directors will complete the same simulations and training as staff, and the chief information officer will describe at a town hall a time a phishing email nearly fooled her. When a leader reports a suspicious message, the security team will say so, with permission, in its monthly update. These signals tell staff that anyone can be fooled and that reporting is expected at every level.

Measuring Culture

Table 1 lists the measures, which value reporting as highly as avoiding clicks.

Table 1. Security Culture Measures

Note. Measures and targets proposed by the author; composite data.

Conclusion

Osprey Point cannot train every click away, but it can make clicks rarer and reports immediate. Understanding why busy people click, removing the fear that delays reporting, making reporting easy, training by role, running fair simulations and having leaders model the behavior build a culture in which a mistake like the coder's is reported in minutes rather than days.

References

Edmondson, A. (1999). Psychological safety and learning behavior in work teams. Administrative Science Quarterly, 44(2), 350-383. https://doi.org/10.2307/2666999

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Jalali, M. S., Bruckes, M., Westmattelmann, D., & Schewe, G. (2020). Why employees (still) click on phishing links: Investigation in hospitals. Journal of Medical Internet Research, 22(1), Article e16775. https://doi.org/10.2196/16775