10 February 2020

Abstract
Background: Hospitals have been one of the major targets for phishing attacks. Despite efforts to improve information security
compliance, hospitals still significantly suffer from such attacks, impacting the quality of care and the safety of patients.
Objective: This study aimed to investigate why hospital employees decide to click on phishing emails by analyzing actual
clicking data.
Methods: We first gauged the factors that influence clicking behavior using the theory of planned behavior (TPB) and integrating
trust theories. We then conducted a survey in hospitals and used structural equation modeling to investigate the components of
compliance intention. We matched employees’ survey results with their actual clicking data from phishing campaigns.
Results: Our analysis (N=397) reveals that TPB factors (attitude, subjective norms, and perceived behavioral control), as well
as collective felt trust and trust in information security technology, are positively related to compliance intention. However,
compliance intention is not significantly related to compliance behavior. Only the level of employees’ workload is positively
associated with the likelihood of employees clicking on a phishing link.
Conclusions: This is one of the few studies in information security and decision making that observed compliance behavior by
analyzing clicking data rather than using self-reported data. We show that, in the context of phishing emails, intention and
compliance might not be as strongly linked as previously assumed; hence, hospitals must remain vigilant with vulnerabilities that
cannot be easily managed. Importantly, given the significant association between workload and noncompliance behavior (ie,
clicking on phishing links), hospitals should better manage employees’ workload to increase information security. Our findings
can help health care organizations augment employees’ compliance with their cybersecurity policies and reduce the likelihood
of clicking on phishing links.