The goal was to develop an online questionnaire that covered most chapters of the ISO/IEC standard 27002, Information technology – Security techniques – Code of practice for information-security management, and required less than 20 minutes to fill out. The online “EFS Survey” tool [13] was used to design and host the questionnaire. The questionnaire incorporated 24 parameters defined in the ISO/IEC 27002 standard, Information technology – Security techniques – Code of practice for information-security management, with some parameters combined into one question (see Appendix 1 for the complete set of questions with the corresponding chapters of the standard). All questions were identically structured and had four possible answers: (1) “unknown/not implemented,” (2) “partially implemented,” (3) “completely implemented,” and (4) “completely implemented and continuously monitored and improved.” The same layout and order of answers was used for all questions to reduce visual complexity. The questionnaire consisted of 19 screens, with 2 questions displayed on each screen. Questions regarding general parameters of the hospital, such as type of hospital, number of beds, number of full-time equivalents (FTEs) of job positions, total number of employees, number of FTEs in information technology (IT), total number of employees in IT, and number of computer workstations at the hospital, were assessed before the actual questionnaire. The questionnaire was reviewed by several national experts from the fields of medical informatics and information security not directly involved in the survey. To ensure technical functionality, the questionnaire was comprehensively tested by three test participants prior to its distribution.

The CIOs of all 112 hospitals in the German-speaking portion of Switzerland were informed via email about the planned study 6 months before its inception. They were also informed that the study would be conducted by students of a Master of Advanced Studies in Medical Informatics at the Berne University of Applied Science. The survey was announced a second time in a personal letter [14] and, 2 weeks later, a third time via a personal email that contained a hyperlink with a personal key. Participants were informed in the correspondence that the survey should take a maximum of 15 to 20 minutes to complete and that confidential treatment of data was guaranteed.

To encourage timely responses, a genographic test from National Geographic [15] was offered as draw prize to one of the first 50 participants. Furthermore, the participants were ensured a detailed benchmark analysis. Participants were asked to respond within 2 months. To improve the response rate, two reminder emails were sent out 10 days after this 2-month period and again 1 week later.

The participants gave informed consent by affirming the opening question of the questionnaire: “Do you agree to participate in our survey? And do you give your consent that the data may be published in an anonymized form?”

There was a unique key included in the individual hyperlinks sent out to participants to access the survey tool. The key was logged by the tool and exported with the data; therefore, duplicate entries from the same user were precluded. The tool was configured to continue only after a question was completed. A back button allowed for corrections.

Data with personal information were stored in encrypted form when exported from the survey tool. Persons involved in the statistical evaluation were blinded and worked with anonymized data. A monitoring group was in charge of protecting the data and the interests of the participants. All students involved in the investigation were required to sign a confidentiality agreement.

Scores were introduced to perform a statistical analysis of the data collected. A linear score from 0 (answer 1) to 3 (answer 4) was used, as shown in Table 1. The higher a hospital’s overall score, the more sophisticated its data security management.

Hospitals were classified into (1) academic (university) hospitals with a research mandate from the state, (2) non-academic public hospitals with an emergency ward, (3) rehabilitation clinics, and (4) private hospitals. Furthermore, the hospitals were split into two groups based on hospital size (ie, hospitals with > 150 beds and hospitals with ≤ 150 beds.

For data reduction, a factor analysis with varimax rotation and Kaiser normalization using SPSS version 15 (SPSS Inc, Chicago, IL, USA) was applied to group-related questions into independent factors.The Kaiser normalization eliminated all components with eigenvalues under 1.0, thus extracting 7 reasonable factors. No further cutoff criteria for determining the optimal number of factors were explored.

Since normal distribution could not be shown using a Shapiro-Wilk test, a two-way non-parametric analysis of variance (Friedman test) was performed for both the type of risk factors determined by the factor analysis and the group of hospitals. The difference between hospital types was then determined using pairwise testing with Bonferroni’s corrections. Subsequently, the influence of each of the 7 risk factors on the differentiation between hospital types was calculated using a non-parametric one-way analysis of variance (Kruskal-Wallis test). The effect of hospital size (number of beds) was determined using a Friedman test, also taking into account the 7 risk factors.

Of the 112 CIOs invited to participate in the survey, 69 (61.6%) responded. Of these, 7 did not give informed consent, 9 aborted the questionnaire while answering the general questions about the hospital, and 2 aborted the questionnaire while answering the questions about information security. In Table 2, “responded,” “participated,” and “completed” indicate that the survey page was visited, that the informed consent page was filled out, and that the questionnaire was fully completed, respectively. Thus, there was a 90% (62/69) participation rate and a 74% (51/69) completion rate [16]. Only the 51 completed datasets were used for further analysis.

Of the 51 hospitals in which a CIO had completed the questionnaire, 4 were university hospitals, 29 were public hospitals, 6 were rehabilitation clinics, and 12 were private hospitals.The hospitals which completed the questionnaire had total scores ranging from 30.6% to 81.9% out of a maximum score of 100%. These scores are presented in Table 3 for the two hospital sizes and for the four hospital types.

To visualize the overall distribution of information security for hospitals in German-speaking Switzerland, each hospital’s individual score was calculated as a percentage of the maximum score. These percentages are shown in Figure 1 as functions of the number of beds in a hospital. Additionally, a least squares regression curve was laid over the cumulated scores. The curve characterizes the distribution of information security per hospital bed. The 50% line shows that, according to the regression curve, 50% of all hospital beds reached a score of 49.2% or less of the maximum score.

The factor analysis extracted 7 factors, explaining 70% of the total variance. The questions were assigned to the factor with the highest correlation (Table 4).

The grouping of the questions into factors gave interesting insights into their relationship and made it possible to assign a group term to each of the 7 groups of questions (Table 5).

The null hypothesis that all hospital types reach the same scores could be rejected (P < .05) on the basis of the Friedman test for all 28 groups (7 risk-factor groups and 4 types of hospitals). With the Kruskal-Wallis test, a significant difference (P < .05) in factor 7 (backup and security zones) between hospital types was found, with university hospitals ranking lowest and private hospitals highest (Figure 2). Using (conservative) pairwise testing and Bonferroni’s correction, however, no significant difference was found (P = .02 which is greater than .05/7 = .0071). No significant effect was observed with respect to hospital size (Figure 3).

In this investigation, a comprehensive, but efficient and rapid, method to survey information security in institutions was introduced and successfully applied in 51 Swiss hospitals. Half (50.00%, 8588/17,177) of all hospital beds had a score of less than 49.2% of the maximum possible score (100%). In other words, a patient in one of these hospitals runs a 50% risk that he or she will lie in a hospital bed for which information security scores only reach 49%. Furthermore, university hospitals had lower scores for basic security features than private hospitals, although this difference does not reach statistical significance when conservative testing procedures are applied.

The lack of tools to quickly and inexpensively assess the information security of large numbers of hospitals led us to develop an effective and comprehensive survey tool. Only the 24 most-pertinent parameters of the total 133 parameters in the ISO/IEC 27002 standard were included to keep the resulting questionnaire manageable in a reasonable amount of time and to restrict the amount of data generated. This was possible by combining several subchapters into one parameter and selecting questions especially relevant to hospitals.

Tools, such as the one presented here, will become increasingly important as more and more countries need to address issues of information security in their health care systems.

Only the data of hospitals that fully completed the questionnaire were analyzed. However, a selection bias may have influenced participation: Hospitals envisaging a potential for improvement in their security management may have been more willing to fill out the questionnaire to receive free advice through our benchmark report. On the other hand, hospitals apprehensive of a bad ranking might have refrained from answering. Unfortunately, this bias cannot be verified retrospectively.

Only 44% (20/45) of the smaller hospitals responded to the survey, compared to 73% (49/67) of the larger hospitals (Table 2). It is possible that smaller hospitals have fewer IT resources and, therefore, did not take the time to fill out our questionnaire. However, it should be noted that larger hospitals aborted the questionnaire more frequently. Fewer university hospitals completed the questionnaire than other hospitals (Table 2). The number of invited university hospitals may appear misleadingly high, as the German-speaking part of Switzerland only has three university hospitals. However, several university hospitals have subunits (eg, children’s hospitals) with completely or partially independent IT structures. Fortunately, for each university hospital, exactly one eligible person representing the entire institution filled in the questionnaire. It is likely that these institutions appointed someone to respond, which also explains the frequency of aborted questionnaires.

Whether the responders filled out the questionnaire truthfully, whether they portrayed information security as more sophisticated than it actually is, or whether some respondents even understated their hospital’s performance to be able to apply for more funds for their department remains unclear. These questions can only be explored with an on-site investigation.

Meaningful groups of security items were formed using factor analysis. The items of the first 5 factors dealt with similar topics. The final 2 factors, however, mixed different topics. This led to a decrease of eigenvalues and of the explanatory power of higher factor numbers as a consequence because of the very nature of factor analysis. Although all items in factor 6 (encryption and staging) showed an unambiguous high correlation with their factor, the mapping of question 8 about “security zones” to factor 7 (backup and security zones) was less straightforward because this question also showed high correlation with factor 5 (attack protection) to which it might also have been attributed based on its content. However, the authors decided to base factor attribution on the highest correlation and accepted the automated mapping suggested by the factor analysis.

Switzerland is a small country with four different linguistic regions. Because only hospitals in the German-speaking part of Switzerland were included, the number of hospitals surveyed was relatively low. It would be interesting to perform the study in a larger, more uniform country to be able to work with larger numbers.

Of the 133 controls in the ISO/IEC 27002, Information technology – Security techniques – Code of practice for information-security management, the 24 that referred to issues of basic security were selected for our questionnaire.

Secure information processing in hospitals, such as preventing the loss or the (conscious or unintentional) manipulation of data, is crucial for patients’ health. Moreover, patient health data is protected by law in Switzerland: All patient data must be stored, transmitted, and processed in a secure way that ensures confidentiality and integrity. Our results showed that only 50% of the hospital beds reach 50% of the maximum security score, implying a substantial need for improvement in many of the controls surveyed.

To address the most evident risks found in Swiss hospitals, we recommend considering the following points. We limit ourselves to the 8 questions with the lowest scores (see Appendix 1 for questions and for the reference to the ISO/IEC 27002 section [9]):

Implementing these measures will close the most important information security gaps in Swiss hospitals. They also lay the foundation for further security optimizations.

In this paper, a comprehensive and efficient survey tool to obtain meaningful data concerning information security was introduced. Applied to assess information security in hospitals within the German-speaking section of Switzerland, it revealed surprisingly low security scores, especially for basic security issues. These results raise serious questions as to whether Swiss hospitals meet their patients’ expectations and the country’s legal requirements with regard to the level of information security they can guarantee. Our survey identified an urgent need for action to improve information security in hospitals, independent of their size and type.

In the future, the need for secure information handling in hospitals will increase greatly because of increased IT usage and digitalization in the health care sector. Information must also be protected from cyber threats that are increasing in number and sophistication. In the future, we will see more cyber threats that will directly attack industrial plants or a country’s or region’s critical infrastructures [17,18]. Hospitals are part of this critical infrastructure of a country; therefore, they must be protected from such information security breaches.