A Cyber-Security Model for Private Hospitals: A Case Study of a Group of

Hospital in Nairobi, Kenya

Justus N. Nyagwencha, Kavin Basweti, Eugene Raburu

United States International University-Africa
P.O. Box 14634-00800,
Nairobi, Kenya.
+254714488304
jnyagwencha@usiu.ac.ke

ABSTRACT
Internet crime is perceived to be an advanced type of crime that has not yet infiltrated third world countries like Kenya. However,
cybercrime is growing in all parts of the world, and most users of the internet have actually fallen victims at one point in time.
Most victims suffer and do not speak out especially healthcare institutions due to the fear of backlash from the general public.
Moreover, the cybercrimes threats to healthcare equipment, electronic healthcare technology is prevalent worldwide and creates
enormous potential to improve clinical outcomes and transform the delivery of care. Overall, this study strived to come up with a
cyber-security framework for fighting cybercrime in the health sector in Kenya. Specifically, this research project sought to
outline the major cyber threats and vulnerabilities, develop a cyber-security framework and validate it for adoption within health
sector in Kenya. A descriptive research design was adopted in the study. The population of the study consisted of a private group
of hospitals staff. The study focused on top and mid-level IT and other departmental heads that work for the private group of
hospitals in Nairobi Kenya. The hospital had a total of 206 staff in Nairobi. This study used convenience sampling. Based on the
Yamane formula, the study sampled 135 employees from all departments of private group of hospitals. Primary data was
gathered by use of a questionnaire. Frequency tables and percentages were used to present the findings. Correlation and simple
regression analysis were used to indicate simple relationships between individual constructs with the dependent variable. For
model evaluation, Structural Equation Modelling (SEM) was used. The study found out that top management commitment had a
moderate influence on cyber-security (r = .338, p = .000), organizational factors had a strong influence on cyber-security (r
= .604, p = .000), IT policies had a weak influence on cyber-security (r = .209, p = .028), and IT literacy had a strong influence
on cyber-security (r = .642, p = .000). From SEM analysis, the study confirmed that the path coefficients were positive for top
management commitment, organizational factors and IT literacy with cyber-security. The paths coefficients were, however,
negative for IT policies and threats and vulnerabilities with cyber-security. The study recommends that monitoring of the
performance of cyber-security as well as continuous awareness and training programs on cyber security for all employees.
General Terms
Cybercrime, Security, Framework, IT, Healthcare

Keywords
Electronic Health Records, IT practices, cybersecurity threat, cyber-security framework.