{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T23:16:20Z","timestamp":1771629380183,"version":"3.50.1"},"reference-count":72,"publisher":"Informa UK Limited","issue":"2","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Journal of Management Information Systems"],"published-print":{"date-parts":[[2013,10]]},"DOI":"10.2753\/mis0742-1222300202","type":"journal-article","created":{"date-parts":[[2014,3,4]],"date-time":"2014-03-04T02:08:52Z","timestamp":1393898932000},"page":"41-66","source":"Crossref","is-referenced-by-count":66,"title":["Health-Care Security Strategies for Data Protection and Regulatory Compliance"],"prefix":"10.1080","volume":"30","author":[{"given":"Juhee","family":"Kwon","sequence":"first","affiliation":[{"name":"a Information Systems Department at College of Business, City University of Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"M. Eric","family":"Johnson","sequence":"additional","affiliation":[{"name":"b Owen Graduate School of Management, Vanderbilt University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"301","published-online":{"date-parts":[[2014,12,8]]},"reference":[{"key":"1","unstructured":"AICPA\/CICA privacy maturity model. American Institute of Certified Public Accountants, Inc., New York, March 2011 (available at <a target=\"_blank\" href='http:\/\/www.aicpa.org\/interestareas\/informationtechnology\/resources\/privacy\/downloadabledocuments\/10-229_aicpa_cica%20privacy%20maturity%20model_finalebook_revised0612.pdf'>www.aicpa.org\/interestareas\/informationtechnology\/resources\/privacy\/downloadabledocuments\/10-229_aicpa_cica%20privacy%20maturity%20model_finalebook_revised0612.pdf<\/a>"},{"issue":"3","key":"2","doi-asserted-by":"crossref","first-page":"191","DOI":"10.2753\/MIS0742-1222220307","article-title":"An empirical examination of the influence of organizational culture on knowledge management practices","volume":"22","author":"M. Alavi","year":"2005-6","journal-title":"Journal of Management Information Systems"},{"issue":"9","key":"3","doi-asserted-by":"crossref","first-page":"1359","DOI":"10.1287\/mnsc.1060.0542","article-title":"Value implications of investments in information technology","volume":"52","author":"M. Anderson","year":"2006","journal-title":"Management Science"},{"issue":"1","key":"4","first-page":"5","article-title":"The differential performance effects of healthcare information technology adoption","volume":"24","author":"B. Anol","year":"2007","journal-title":"Information Systems Management"},{"issue":"5","key":"5","doi-asserted-by":"crossref","first-page":"763","DOI":"10.1287\/orsc.1070.0306","article-title":"IT assets, organizational capabilities, and firm performance: How resource allocations and organizational differences explain performance variation","volume":"18","author":"S. Aral","year":"2007","journal-title":"Organization Science"},{"issue":"3","key":"6","doi-asserted-by":"crossref","first-page":"367","DOI":"10.1080\/1478336032000046661","article-title":"Self-assessment application and learning in organizations: A special reference to the ontological dimension","volume":"14","author":"F. Balbastre","year":"2003","journal-title":"Total Quality Management & Business Excellence"},{"issue":"1","key":"7","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1016\/S0167-9236(96)00059-0","article-title":"Decision support for managing organizational design dynamics","volume":"22","author":"A. Barua","year":"1998","journal-title":"Decision Support Systems"},{"key":"8","unstructured":"Behara, R.; Derric, C.; and Hu, Q. A process approach to information security: Lessons from quality management. In <i>Proceedings of the 2006 Americas Conference on Information Systems.<\/i> Acapulco: Association for Information Systems, 2006, pp. 169-178 (available at <a target=\"_blank\" href='http:\/\/aisel.aisnet.org\/amcis2006\/169\/'>http:\/\/aisel.aisnet.org\/amcis2006\/169\/<\/a>"},{"key":"9","volume-title":"Regression Diagnostics: Identifying Influential Data and Sources of Collinearity","author":"D. Belsley","year":"2004"},{"issue":"4","key":"10","doi-asserted-by":"crossref","first-page":"437","DOI":"10.1287\/isre.1070.0148","article-title":"The performance effects of complementarities between information systems, marketing, manufacturing, and supply chain processes","volume":"18","author":"S. Bharadwaj","year":"2007","journal-title":"Information Systems Research"},{"issue":"1","key":"11","first-page":"45","article-title":"Managing the next wave of enterprise systems: Leveraging lessons from ERP","volume":"2","author":"C. Brown","year":"2003","journal-title":"MIS Quarterly Executive"},{"issue":"3","key":"12","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: An empirical study of rational-based beliefs and information security awareness","volume":"34","author":"B. Bulgurcu","year":"2010","journal-title":"MIS Quarterly"},{"issue":"13","key":"13","doi-asserted-by":"crossref","first-page":"1257","DOI":"10.1002\/smj.428","article-title":"The relationships between intangible organizational elements and organizational performance","volume":"25","author":"A. Carmeli","year":"2004","journal-title":"Strategic Management Journal"},{"key":"14","unstructured":"Casaretto, J. Security compliance does not equal security. Wikibon Blog, July 2011 (available at <a target=\"_blank\" href='http:\/\/wikibon.org\/blog\/security-compliance-does-not-equal-security\/'>http:\/\/wikibon.org\/blog\/security-compliance-does-not-equal-security\/<\/a>"},{"issue":"2","key":"15","doi-asserted-by":"crossref","first-page":"281","DOI":"10.2753\/MIS0742-1222250211","article-title":"Decision-theoretic and game-theoretic approaches to IT security investment","volume":"25","author":"H. Cavusoglu","year":"2008","journal-title":"Journal of Management Information Systems"},{"issue":"4","key":"16","doi-asserted-by":"crossref","first-page":"579","DOI":"10.1007\/s10796-010-9232-6","article-title":"Information systems resources and information security","volume":"13","author":"K. Chang","year":"2011","journal-title":"Information Systems Frontiers"},{"issue":"3","key":"17","doi-asserted-by":"crossref","first-page":"241","DOI":"10.2753\/MIS0742-1222260308","article-title":"Risks and benefits of signaling information system characteristics to strategic attackers","volume":"26","author":"M. Cremonini","year":"2009-10","journal-title":"Journal of Management Information Systems"},{"issue":"6","key":"18","doi-asserted-by":"crossref","first-page":"643","DOI":"10.1057\/ejis.2011.23","article-title":"A review and analysis of deterrence theory in the IS security literature: Making sense of the disparate findings","volume":"20","author":"J. D'Arcy","year":"2011","journal-title":"European Journal of Information Systems"},{"issue":"1","key":"19","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1287\/isre.1070.0160","article-title":"User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach practice","volume":"20","author":"J. D'Arcy","year":"2009","journal-title":"Information Systems Research"},{"issue":"4","key":"20","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1080\/07421222.2000.11518265","article-title":"Information technology payoff in the health-care industry: A longitudinal study","volume":"16","author":"S. Devaraj","year":"2000","journal-title":"Journal of Management Information Systems"},{"issue":"3","key":"21","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1287\/mnsc.49.3.273.12736","article-title":"Performance impacts of information technology: Is actual usage the missing link?","volume":"49","author":"S. Devaraj","year":"2003","journal-title":"Management Science"},{"issue":"12","key":"22","doi-asserted-by":"crossref","first-page":"1504","DOI":"10.1287\/mnsc.35.12.1504","article-title":"Asset stock accumulation and sustainability of competitive advantage","volume":"35","author":"I. Dierickx","year":"1989","journal-title":"Management Science"},{"issue":"6","key":"23","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1016\/S1754-4548(11)70080-8","article-title":"Compliance strategies: A.k.a. alphabet soup","volume":"8","author":"F. Donovan","year":"2011","journal-title":"Infosecurity"},{"issue":"1","key":"24","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/j.jfineco.2004.06.013","article-title":"Dynamic risk management: Theory and evidence","volume":"78","author":"F. Fehle","year":"2005","journal-title":"Journal of Financial Economics"},{"issue":"3","key":"25","doi-asserted-by":"crossref","first-page":"419","DOI":"10.1287\/isre.1110.0382","article-title":"The role of information systems in healthcare: Current research and future trends","volume":"22","author":"R. Fichman","year":"2011","journal-title":"Information Systems Research"},{"key":"26","article-title":"Strategic advantage or strategic necessity? The case of Internet banking in the U. S. banking industry","author":"K. Goh","year":"2013"},{"issue":"4","key":"27","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1002\/smj.4250171110","article-title":"Toward a knowledge-based theory of the firm","volume":"17","author":"R. Grant","year":"1996","journal-title":"Strategic Management Journal"},{"key":"28","volume-title":"Econometric Analysis","author":"W. Greene","year":"2003"},{"issue":"6","key":"29","doi-asserted-by":"crossref","first-page":"784","DOI":"10.1287\/mnsc.49.6.784.16023","article-title":"Quality improvement and infrastructure activity costs in software development: A longitudinal analysis","volume":"49","author":"D. Harter","year":"2003","journal-title":"Management Science"},{"issue":"3","key":"30","doi-asserted-by":"crossref","first-page":"337","DOI":"10.2753\/MIS0742-1222250310","article-title":"Investments in information security: A real options perspective with Bayesian postaudit","volume":"25","author":"H. Herath","year":"2008-9","journal-title":"Journal of Management Information Systems"},{"issue":"5","key":"31","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1108\/09685220310500153","article-title":"An integrated system theory of information security management","volume":"11","author":"K. Hong","year":"2003","journal-title":"Information Management & Computer Security"},{"issue":"4","key":"32","doi-asserted-by":"crossref","first-page":"522","DOI":"10.1287\/mnsc.43.4.522","article-title":"The performance effects of process management techniques","volume":"43","author":"C. Ittner","year":"1997","journal-title":"Management Science"},{"issue":"4","key":"33","doi-asserted-by":"crossref","first-page":"563","DOI":"10.1287\/mnsc.47.4.563.9831","article-title":"An empirical examination of dynamic qualitybased learning models","volume":"47","author":"C. Ittner","year":"2001","journal-title":"Management Science"},{"issue":"3","key":"34","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1109\/MSP.2009.77","article-title":"Security through information risk management","volume":"7","author":"M. Johnson","year":"2009","journal-title":"IEEE Security & Privacy"},{"issue":"1","key":"35","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1145\/1435417.1435446","article-title":"Improved security through information security governance","volume":"52","author":"A. Johnston","year":"2009","journal-title":"Communications of the ACM"},{"issue":"3","key":"36","doi-asserted-by":"crossref","first-page":"549","DOI":"10.2307\/25750691","article-title":"Fear appeals and information security behaviors: An empirical study","volume":"34","author":"A. Johnston","year":"2010","journal-title":"MIS Quarterly"},{"issue":"3","key":"37","first-page":"163","article-title":"Effective information security requires a balance of social and technology factors","volume":"9","author":"T. Kayworth","year":"2010","journal-title":"MIS Quarterly Executive"},{"issue":"2","key":"38","doi-asserted-by":"crossref","first-page":"241","DOI":"10.2753\/MIS0742-1222250210","article-title":"Understanding the value of countermeasure portfolios in information systems security","volume":"25","author":"R. Kumar","year":"2008","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"39","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1108\/09685221011035223","article-title":"Understanding and transforming organizational security culture","volume":"18","author":"D. Lacey","year":"2010","journal-title":"Information Management & Computer Security"},{"key":"40","unstructured":"Largest compilation of private-sector comments on nationwide interoperable health information exchange to date. Press Release, U. S. Department of Health & Human Services, Washington, DC, June 3, 2005 (available at <a target=\"_blank\" href='http:\/\/archive.hhs.gov\/news\/press\/2005pres\/20050603.html'>http:\/\/archive.hhs.gov\/news\/press\/2005pres\/20050603.html<\/a>"},{"issue":"1","key":"41","first-page":"1","article-title":"Assessing business-IT alignment maturity","volume":"4","author":"J. Luftman","year":"2000","journal-title":"Communications of the Association for Information Systems"},{"issue":"5","key":"42","doi-asserted-by":"crossref","first-page":"363","DOI":"10.1002\/smj.4250130505","article-title":"The resource-based view within the conversation of strategic management","volume":"13","author":"J. Mahoney","year":"1992","journal-title":"Strategic Management Journal"},{"issue":"4","key":"43","doi-asserted-by":"crossref","first-page":"482","DOI":"10.1287\/orsc.10.4.482","article-title":"On the edge: Heeding the warnings of unusual events","volume":"10","author":"A. Marcus","year":"1999","journal-title":"Organization Science"},{"issue":"2","key":"44","doi-asserted-by":"crossref","first-page":"432","DOI":"10.1287\/orsc.1100.0546","article-title":"Creating economic value through social values: Introducing a culturally informed resource-based view","volume":"22","author":"C. Maurer","year":"2011","journal-title":"Organization Science"},{"issue":"9","key":"45","doi-asserted-by":"crossref","first-page":"697","DOI":"10.1002\/(SICI)1097-0266(199710)18:9<697::AID-SMJ909>3.0.CO;2-C","article-title":"Sustainable competitive advantage: Combining institutional and resource-based views","volume":"18","author":"C. Oliver","year":"1997","journal-title":"Strategic Management Journal"},{"issue":"1","key":"46","first-page":"1","article-title":"Changing the mind-set: Creating a risk-conscious and security-aware culture","volume":"2","author":"J. Pironti","year":"2012","journal-title":"ISACA Journal"},{"issue":"2","key":"47","doi-asserted-by":"crossref","first-page":"601","DOI":"10.2307\/41703469","article-title":"IS employee attitudes and perceptions at varying levels of software process maturity","volume":"36","author":"J. Ply","year":"2012","journal-title":"MIS Quarterly"},{"issue":"2","key":"48","doi-asserted-by":"crossref","first-page":"97","DOI":"10.2753\/MIS0742-1222260205","article-title":"Information security: Facilitating user precautions vis-\u00e0-vis enforcement against attackers","volume":"26","author":"I. Png","year":"2009","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"49","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1002\/smj.4250160105","article-title":"Total quality management as competitive advantage: A review and empirical study","volume":"16","author":"T. Powell","year":"1995","journal-title":"Strategic Management Journal"},{"issue":"4","key":"50","doi-asserted-by":"crossref","first-page":"757","DOI":"10.2307\/25750704","article-title":"Improving employees' compliance through information systems security training: An action research study","volume":"34","author":"P. Puhakainen","year":"2010","journal-title":"MIS Quarterly"},{"issue":"3","key":"51","doi-asserted-by":"crossref","first-page":"617","DOI":"10.2307\/20650313","article-title":"Offshore information systems project success: The role of social embeddedness and cultural characteristics","volume":"33","author":"A. Rai","year":"2009","journal-title":"MIS Quarterly"},{"issue":"2","key":"52","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1016\/j.cose.2011.12.001","article-title":"Unrealistic optimism on information security management","volume":"31","author":"H. Rhee","year":"2012","journal-title":"Computers & Security"},{"issue":"1","key":"53","first-page":"31","article-title":"Develop long-term competitiveness through IT assets","volume":"38","author":"J. Ross","year":"1996","journal-title":"Sloan Management Review"},{"issue":"3","key":"54","doi-asserted-by":"crossref","first-page":"393","DOI":"10.2307\/1907619","article-title":"The estimation of economic relationships using instrumental variables","volume":"26","author":"J. Sargan","year":"1958","journal-title":"Econometrica"},{"issue":"3","key":"55","doi-asserted-by":"crossref","first-page":"463","DOI":"10.2307\/25750687","article-title":"Circuits of power: A study of mandated compliance to an information systems security de jure standard in a government organization","volume":"34","author":"S. Smith","year":"2010","journal-title":"MIS Quarterly"},{"issue":"3","key":"56","doi-asserted-by":"crossref","first-page":"503","DOI":"10.2307\/25750689","article-title":"User participation in information systems security risk management","volume":"34","author":"J. Spears","year":"2010","journal-title":"MIS Quarterly"},{"issue":"1","key":"57","doi-asserted-by":"crossref","first-page":"2","DOI":"10.2307\/1251799","article-title":"Market-based assets and shareholder value: A framework for analysis","volume":"62","author":"R. Srivastava","year":"1998","journal-title":"Journal of Marketing"},{"key":"58","unstructured":"State security breach notification laws. National Conference of State Legislatures, Denver, CO, 2012 (available at <a target=\"_blank\" href='http:\/\/www.ncsl.org\/issues-research\/telecom\/security-breach-notification-laws.aspx'>www.ncsl.org\/issues-research\/telecom\/security-breach-notification-laws.aspx<\/a>"},{"key":"59","volume-title":"Information Security: Policy, Processes, and Practices","author":"D. Straub","year":"2008"},{"issue":"1","key":"60","doi-asserted-by":"crossref","first-page":"57","DOI":"10.2307\/25148717","article-title":"Performance effects of information technology synergies in multibusiness firms","volume":"30","author":"H. Tanriverdi","year":"2006","journal-title":"MIS Quarterly"},{"issue":"2","key":"61","doi-asserted-by":"crossref","first-page":"97","DOI":"10.1002\/smj.435","article-title":"Knowledge relatedness and the performance of multibusiness firms","volume":"26","author":"H. Tanriverdi","year":"2005","journal-title":"Strategic Management Journal"},{"issue":"7","key":"62","doi-asserted-by":"crossref","first-page":"509","DOI":"10.1002\/(SICI)1097-0266(199708)18:7<509::AID-SMJ882>3.0.CO;2-Z","article-title":"Dynamic capabilities and strategic management","volume":"18","author":"D. Teece","year":"1997","journal-title":"Strategic Management Journal"},{"issue":"2","key":"63","doi-asserted-by":"crossref","first-page":"288","DOI":"10.1287\/isre.1080.0206","article-title":"Complementarities between organizational IT architecture and governance structure","volume":"21","author":"A. Tiwana","year":"2010","journal-title":"Information Systems Research"},{"key":"64","unstructured":"2010 Healthcare Information Management and Systems Society analytics report: Security of patient data. HIMSS Analytics, Chicago, April 2010 (available at <a target=\"_blank\" href='http:\/\/www.krollcybersecurity.com\/media\/2010_Kroll-HIMSS_Study_FINAL.pdf'>www.krollcybersecurity.com\/media\/2010_Kroll-HIMSS_Study_FINAL.pdf<\/a>"},{"key":"65","unstructured":"2012 Healthcare Information Management and Systems Society analytics report: Security of patient data. HIMSS Analytics, Chicago, April 2012 (available at <a target=\"_blank\" href='http:\/\/www.krollcybersecurity.com\/media\/Kroll-HIMSS_2012_-_Security_of_Patient_Data_040912.pdf'>www.krollcybersecurity.com\/media\/Kroll-HIMSS_2012_-_Security_of_Patient_Data_040912.pdf<\/a>"},{"issue":"1","key":"66","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1145\/502269.502303","article-title":"Does electronic monitoring of employee Internet usage work?","volume":"45","author":"A. Urbaczewski","year":"2002","journal-title":"Communications of the ACM"},{"issue":"6","key":"67","doi-asserted-by":"crossref","first-page":"443","DOI":"10.1016\/j.cose.2005.07.003","article-title":"Information security governance\u2014Compliance management vs. operational management","volume":"24","author":"S. von Solms","year":"2005","journal-title":"Computers & Security"},{"key":"68","volume-title":"Information System Control and Audit","author":"R. Weber","year":"1999"},{"issue":"2","key":"69","doi-asserted-by":"crossref","first-page":"171","DOI":"10.1002\/smj.4250050207","article-title":"Resource-based view of the firm","volume":"5","author":"B. Wernerfelt","year":"1984","journal-title":"Strategic Management Journal"},{"key":"70","volume-title":"Principles of Information Security","author":"M. Whitman","year":"2011"},{"key":"71","volume-title":"Econometric Analysis of Cross Section and Panel Data","author":"J. Wooldridge","year":"2002"},{"issue":"1","key":"72","doi-asserted-by":"crossref","first-page":"167","DOI":"10.1080\/07421222.2004.11045794","article-title":"The complementarity of information technology infrastructure and e-commerce capability: A resource-based assessment of their business value","volume":"21","author":"K. Zhu","year":"2004","journal-title":"Journal of Management Information Systems"}],"container-title":["Journal of Management Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.tandfonline.com\/doi\/pdf\/10.2753\/MIS0742-1222300202","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,8,8]],"date-time":"2019-08-08T03:55:09Z","timestamp":1565236509000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.tandfonline.com\/doi\/full\/10.2753\/MIS0742-1222300202"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,10]]},"references-count":72,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2014,12,8]]},"published-print":{"date-parts":[[2013,10]]}},"alternative-id":["10.2753\/MIS0742-1222300202"],"URL":"https:\/\/doi.org\/10.2753\/mis0742-1222300202","relation":{},"ISSN":["0742-1222","1557-928X"],"issn-type":[{"value":"0742-1222","type":"print"},{"value":"1557-928X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013,10]]}}}