Paper Type

Short

Paper Number

PACIS2026-1286

Description

Healthcare organizations increasingly depend on interconnected digital systems, increasing vulnerability to cyber incidents that disrupt operations and threaten patient safety. Existing incident response frameworks emphasize technical actions after detection but overlook how frontline staff identify and report anomalies. This study proposes the Cyber Situational Awareness–Incident Response (CSA-IR) Process Model, explaining how cybersecurity awareness develops across healthcare stakeholder layers during early incident recognition and escalation. Using Situational Awareness Theory and Design Science Research, the model highlights distributed organizational awareness and differing stakeholder responses based on expertise, improving early detection and escalation capabilities.

Comments

12-HCI

Share

COinS
 
Jul 5th, 12:00 AM

Cyber Situational Awareness in Healthcare Incident Response

Healthcare organizations increasingly depend on interconnected digital systems, increasing vulnerability to cyber incidents that disrupt operations and threaten patient safety. Existing incident response frameworks emphasize technical actions after detection but overlook how frontline staff identify and report anomalies. This study proposes the Cyber Situational Awareness–Incident Response (CSA-IR) Process Model, explaining how cybersecurity awareness develops across healthcare stakeholder layers during early incident recognition and escalation. Using Situational Awareness Theory and Design Science Research, the model highlights distributed organizational awareness and differing stakeholder responses based on expertise, improving early detection and escalation capabilities.