Cyber security in healthcare in the era of digital transformation: A research on private hospitals in Turkey

Digital transformation is fundamentally reshaping the delivery and management of healthcare services by enhancing the efficiency of patient care and improving service quality. However, it also introduces new threats to the security of personal health data. Cyberattacks targeting hospital data and systems pose a significant concern, particularly for institutions responsible for safeguarding patients' sensitive health information. Ensuring cybersecurity in hospitals is critically important not only for protecting patients' data and lives who are the primary victims of such attacks but also for maintaining the uninterrupted provision of healthcare services. In this context, the first aim of this study is to assess the cybersecurity levels of private hospitals and to examine whether these levels differ based on employee and hospital characteristics. The second aim is to analyze the current state of cybersecurity in private hospitals and identify areas for improvement. To achieve these objectives, a mixed-methods approach combining both quantitative and qualitative techniques was employed. The research adopted a convergent parallel mixed-method design, giving equal weight to qualitative and quantitative data. Quantitative data were collected via surveys administered to 632 participants, selected through purposive sampling among employees working in private hospitals across Turkey, and analyzed using the SPSS 24.0 statistical software. Qualitative data were gathered through interviews with 10 participants responsible for cybersecurity, also selected through purposive sampling from the quantitative sample, and analyzed using content analysis via the MAXQDA 2024 Pro software. The quantitative findings indicate that while healthcare professionals rated the cybersecurity of their hospitals as high, they acknowledged insufficient personal awareness of cybersecurity practices. The qualitative results further highlight the absence of dedicated cybersecurity units in hospitals, low awareness levels among staff, and a pressing need for training. In conclusion, ensuring effective cybersecurity in hospitals requires a holistic approach that encompasses technological infrastructure, process management, and the human factor. Sustainable cybersecurity can only be achieved by positively transforming employee behaviors and enhancing awareness particularly through targeted training focused on the human element.