{'fraction_non_alphanumeric': 0.025137025137025138, 'fraction_numerical': 0.009612009612009613, 'mean_word_length': 5.518479408658923, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Information Security Maturity Model for Healthcare Organizations in the United States

This article provides a maturity model for information security for healthcare organizations in the United States. Healthcare organizations are faced with increasing threats to the security of their information systems. The maturity model identifies specific performance metrics, with relative importance measures, that can be used to enhance information security at healthcare organizations allowing them to focus scarce resources on mitigating the most important information security threat vectors. This generalizable, hierarchical decision model uses both qualitative and quantitative metrics based on objective goals. This model may be used as a baseline by which to measure individual organizational performance, to measure performance against other organizations, or to monitor changes in the information security environment over time.


I. INTRODUCTION
T HE healthcare sector has increased implementation of information systems dramatically since the advent of the American Recovery and Reinvestment Act (ARRA) of 2009. Formerly a laggard in the utilization of technology to support enhanced efficiencies and improved business operations [1], ARRA [2] enabled the centers for medicare and medicaid services (CMS) to provide financial incentives for the effective use of health information technology (HIT), and beginning in 2015, financial penalties for not implementing HIT That demonstrated "meaningful use" [3]. Largely because of this law, HIT has become ubiquitous in the United States.
The proliferation of HIT has also created a new and significant risk to health organizations, protecting the privacy and integrity of large caches of protected health information (PHI). The Health Insurance Portability and Accountability Act (HIPAA) of 1996 require healthcare organizations, known as "covered entities," to ensure the protection of individual identifiable information [4], [5]. The department of health and human services' Office for Civil Rights (OCR) serves to monitor compliance of covered entities with the provisions of HIPAA. In recent years the OCR has dramatically increased their compliance monitoring and auditing of covered entities. This increased monitoring and auditing has led to a significant increase in both the number and cost of fines to covered entities. The U.S. Department of HHS OCR web site reporting breach activity [6] has become known as the "wall of shame." This article examines the literature to explore the current state of the information security environment at healthcare organizations. It provides value by creating a measurement system that incorporates both qualitative and quantitative metrics. A generalizable model is created and validated by subject matter experts that produces a score to evaluate overall performance in cybersecurity for healthcare organization. Through a criterion-based validation process, experts agree the model may also be used to understand the relative importance of individual metrics to aid organizations in understanding which cybersecurity strategies may provide the most value in increasing overall performance. Subject matter experts agree that the model accurately reflects performance results and case studies confirm this assessment.

II. LITERATURE REVIEW
Information security incidents and breaches have grown exponentially in recent years and have made headlines across the globe. These threats affect all types of organizations large and small, across all industries and across geographic boundaries. During the 2013 Christmas shopping season, a cyberattack on Target Corporation's retail store netted millions of customer's credit card information [7]. In June of 2015, The United States Office of Personnel Management discovered that the background records for current, former, and prospective Federal employees had been stolen, including the records of over 21 million individuals [8]. In June of 2021 FBI Director Christopher Wray compared ransomware challenge to 9/11 [9]. This is a mere sampling of the incidents that have hit the press in recent years. This sample serves to illustrate the significant risk and vulnerability posed by cybercriminals. Of further note, healthcare is persistently ranked as the number one target of cybercriminals, followed by education, government, retail, financial sectors in varying orders, due to the richness of the data available in the healthcare sector [10]- [13].
Several key factors have driven this growth. First, there are many more systems at organizations, large and small, that store information, than there have ever been before. Second, some of the information stored in this proliferation of information systems is highly valuable and as a result the number of cybercriminals, and networks of cybercriminals has grown substantially [14]. Third, managing the security controls required to protect the information stored electronically is expensive, rapidly changing [15], and complex [16]. As a result, many organizations across most industry sectors have not, or are simply unable to, establish a strong information security environment [17]. Culbertson notes that the volume of threats to healthcare organizations is steadily growing, and that mitigating risk to an acceptable level will be a massive undertaking [18]. When looking specifically at healthcare organizations it should be noted that patient health records contain all the information a thief needs to perpetrate identify theft [19]. Agrawal et al. [20] claims that continuous data breaches targeting these invaluable medical records have become a nemesis for healthcare organizations. Finally, according to HIMSS Analytics over 80 percent of the security breaches in the healthcare sector since the enactment of HIPAA trace back to people within the organization [21], [22]. Human behavior and simple mistakes, regardless of industry, are a large factor in data loss [23].
Information security risks are presented to organizations through multiple vectors-system transmission paths, hardware, software, or the internet for example. Cybercriminals utilize a variety of nefarious tools to gain access to sensitive data, systems, or people (e.g., phishing, malware, zero-day exploits, denial of service attacks, SQL injections, ransomware, manin-the-middle attacks) [15], [24]. This collection of vectors and approaches is rapidly changing and is difficult for most organizations to remain responsive to.
Healthcare organizations need to be mindful not only of patient privacy concerns but also of the negative business impacts such as billing theft, identity theft or interruption of critical business functions posed by cybercriminals. The negative impact of breaches in healthcare organizations is extreme. Not only are these events costly, routinely reaching beyond seven-figure price tags, but the reputational harm can be difficult to recover from. Most importantly, some information security incidents could prohibit the healthcare organizations from providing critical patient care activities. In May 2017, the WannaCry ransomware incident not only shutdown transportation systems and other governmental systems across the globe, but also forced Britain's public health systems to turn away patients even though no patient data was compromised [25]. These incidents not only have the potential of causing financial loss to individuals and organizations, but also pose a very real threat to healthcare organizations in serving their critical mission of treating patients. Clinicians rely on electronic medical records (EMRs), infusion pumps, and many other tools to provide the current standard of care [26]. In September of 2020, the first patient death attributed to cybercriminals occurred when a woman did not survive a transfer between healthcare facilities that had been necessitated because of a cyberattack at Düsseldorf University Hospital [27].
The environment of the organization in support of information security has tremendous importance in the effectiveness of information security compliance. While there are several definitions for organizational culture/environment, the definition provided by Deal (1982) has often been cited as particularly relevant in the evaluation of information security environments. This specific definition identifies the follow key characteristics:. 1) Shared values, which define the expected behavior in the workplace. 2) Heroes who have earned distinction by living the organizational values. 3) Rituals and ceremonies, which are physical expressions of the organizational culture/environment. 4) The cultural social network within the organization, which perpetuates the culture/environment and guards against deviations [28]. Creating an environment where information resources are protected is a necessary component of a successful information security strategy.
There has been significant research documenting the volume of breach activity and likely threat vectors [29]. In addition, there is a fair amount of research on which specific industries are being impacted by breaches and the cost associated with those breaches. The average cost of a healthcare breach is $7.13M, higher than the average total cost of a data breach in any other sector, and nearly double the global average cost regardless of industry [30].
To prepare for, and respond to, information security threats models, also known as cybersecurity frameworks, have been developed and refined over the years to identify information security best practices. Information security models and metrics were recognized on the hard problem list of the United States INFOSEC Research Council in 2005, a situation confirmed by the United States National Science and Technology Council in 2011 and further supported as one of the five hard problems in science and security in 2015 [31]. The next few pages explore existing models and associated metrics and suggests how those models could be used as a foundation for creation of an information security maturity model for healthcare organizations in the United States.
Information security's key objective is the protection of confidentiality, integrity and availability of data, often referred to as the CIA triad, without impinging on organizational productivity [32], [33].
There are numerous information security models currently in use with similar but not identical desired outcomes documented and similar, but not identical, methodologies proposed. There are a great number of models that assess information security risk. Some of these models are qualitative in nature and others are more quantitative [34], [35]. A few have become standards, however there is no definitive maturity model that could be used for reference benchmarking [36]- [38].
Maturity models are instruments that define an evolutionary path to increasingly meeting the defined objective. General maturity models have been widely used in information systems research [39]. Maturity models have also been used in the healthcare domain specifically in the information system sector [40]- [42]. In the case of information security, the defined objective would be defined as an environment that has robust controls to mitigate information security risk as aligned with organizational business objectives. Models must be simple enough that organizations of all sizes can measure their maturity as well as develop action plans to improve maturity levels. This is a significant challenge with existing models. Listed below is a brief description of the most prevalent information security models that are considered standards.
Lacking consistent and effective maturity models for information security, we look to maturity models that have been developed in healthcare for other purposes. The HIMSS Electronic Medical Record Adoption Model (EMRAM) is such a model. HIMSS EMRAM was designed to identify the various stages of maturity in EMRs for hospitals [43].
The literature reviewed confirms that information security is a significant risk to healthcare organizations. Further, when organizations understand their information security maturity, they are better positioned to ensure protection of confidentiality, integrity, and availability of their data, avoiding costly information security incidents which cause both financial and reputational harm.
The role of user motivation and attitude in information security, while recognized, has not been treated seriously [44]. Despite user training, information security compliance remains problematic [45] and more research should be done to explore what types of learning are most effective. Additional research must also be done to determine what instills a strong information security environment in organizations [46], [47]. Further, not all groups within an organization will react similarly to the same initiatives for promoting security awareness [48]. Studies which specifically examine the human component of information security are needed [49]. All to these factors distill to a core theme around a neccesity for further research in defining the current state of information security environment within organizations and ways in which that environment might be improved.
There is a significant gap in information security models that provide a maturity score, clearly defined metrics, and recommendations that may be used as a roadmap for healthcare organizations. Many authors suggest the need for new information security models that address the gaps of existing models [50]- [52]. There is a specific need in the industry to provide a maturity model that is easy to understand and provides clear direction regarding prioritization for investment of information security resources. A new model is required that, while not replacing existing models or comprehensive risk assessments, would provide a framework of best practices for healthcare organizations of any size. Such a model could serve as a benchmark for comparing security profiles across the industry. Fig. 1 maps the gaps to research questions that were developed leading to research objectives noted above.

III. METHODOLOGY AND MODEL DEVELOPMENT
The hierarchical decision model (HDM) is providing a hierarchical approach to problem solving but differs in using a constant sum approach to quantifying judgements. HDM is well-known for providing a framework for quantifying subjective information so that effective qualitative judgements may be made for decision-making purposes [53]- [55]. A key capability of HDM is the ability to quantify expert judgement thereby incorporating both structured and unstructured data into the model. HDM breaks down complex issues into key components that can be singularly identified and measured at the individual level with respect to criteria across multiple levels of the hierarchy. Components are broken down into pairwise comparison segments, where industry experts can evaluate a level of preference of one criterion over another as opposed to declaring an absolute preference. The constant sum approach requires experts to provide a numeric and relative value among options to largely qualitative questions. The researcher can then verify each expert's opinion with that of other experts, thereby validating the proposed model and documenting values across multiple opinions. HDM models have been broadly used to compare technology options for decades. HDM has been used successfully in many areas including robotics [56], project management [57], R&D management [58], patent analysis [59], wearable technologies [60], technology transfer [61], [62], and energy [63]- [66].

A. Model Objectives
The following five information security objectives were identified.
1) Organizational Support: Organizational support is a key pillar of successful information security programs and can be defined as a high level of support for information security, including support at the Board level of the organization. Support is demonstrated by engagement and understanding of information security risk by modeling behaviors and by provision of financial support. The original model was modified from "leadership support" to explicitly named "board of directors" level support based on feedback from subject matter experts. As seen in broadly publicized recent information security incidents at healthcare organizations, such as the incident at Scripps health [67], the potential for reputational harm to organizations who experience information security incidents is high.
2) Policies and Standards: Information security policies and standards are of critical importance to any cybersecurity framework and are especially important in highly regulated healthcare organizations [5]. Organizations that document their information security policies and procedures, update them routinely, and make them available to all users of technology are likely to have a more robust information security environment.
3) Awareness and Training: Human behavior is a significant factor in information security environments [23]. When workforce members possess an understanding and acceptance about the need for all organizational members to protect information assets, organizations are better positioned to have a mature information security environment. Through diverse training and awareness events, organizations can share information with organizational members about the risks and risk mitigation strategies related to information security and thereby improve their performance. 4) Information Security Technical Hygiene: Information systems require active system maintenance to prohibit information security vulnerabilities. Organizations that implement technology and process controls to maintain system health are well positioned to minimize their information security risks and improve their information security maturity. Routine technical hygiene is the foundation of information security best practices, as is well documented in all cybersecurity frameworks [68]-[70].

5) Mitigation of External Threats:
External information security threats are pervasive [71], as recent cybersecurity incidents in healthcare organizations [25], [27] illustrate. Organizations with mature information security programs implement technical controls to mitigate external threats. These tools help organizations understand when restricted data may have left the organization, minimize incoming spam, which may be phishing attempts, and prevent and detect unauthorized users from accessing an organization's network.

B. Goals and Outputs
Each of the five objectives noted above has either four or five associated measurable goals.
Leadership and management: Information security professionals have long faced the challenge of engaging organizational leadership and management in support of a strong information security culture. [72], [74], [75].
2) Policies and Standards Goals: Policy documentation and awareness: Policies are used to define the rules by which an organization agrees to operate and are important in the realm of information security programs [73], [78], [80], [81].
Procedure documentation and awareness: Information security procedures are the companion to information security, essentially providing the "how" of compliance related to procedures [73], [81], [82] Technical standard documentation and awareness: Technical standards (e.g., hardware standards, configuration standards, patch management standards [68], [70], [84] should be documented and updated regularly by the organization to ensure all organization members (as appropriate) understand requirements related to information security.
Sanction documentation and awareness: Sanctions are defined as a set of repercussions associated with noncompliance related to information security policies [78], [79], [83], [84].

3) Awareness and Training Goals:
Communications: Broad communication about information security is a cornerstone of successful information security programs [72], [75], [85], [86]. a) Awareness events: Awareness events are planned occasions designed to raise awareness of information security knowledge throughout an organization and have been determined to improve information security programs and the culture related to information security [75], [78], [87] b) Information portal: An information portal is defined as an easily accessible internal source that provides a knowledge base of security related information [75], [86], [87].  I  MATURITY ASSESSMENT SCORE FOR STAND-ALONE COMMUNITY HOSPITAL   TABLE II  SUMMARY OF KEY DEMOGRAPHICS FOR CASE STUDY SITES   TABLE III MATURITY SCORES FOR CASE STUDY SITES c) Training: Training, while sometimes discounted by trainees, is a powerful tool in creating a culture which supports strong information security practices [47], [73], [80], [88], [89]. d) Behavioral and real-time teaching: Behavioral testing and real-time teaching, used appropriately, are effective tools in testing work force member's compliance behavior to demonstrate the common schemes to penetrate information security defenses [75], [80], [81], [86].

4) Information Security Technical Hygiene Goals a)
Physical controls: Physical access controls which limit access to technology infrastructure (equipment/media), or confidential information are essential. Typical controls generally include, but are not limited to, locked barriers, badged access, and security cameras [5], [68], [69], [70]. b) Asset management: Under the theory that you cannot protect what you don't know about, all major cybersecurity frameworks [5], [68], [69], [70]. c) Routine security updates: Mature information security programs are characterized by processes and technical tools  e) Identity, authentication, access management and monitoring: Identity, authentication, access management, and monitoring are components of comprehensive information security programs as well as major cybersecurity frameworks [5], [68], [69], [70].

5) Mitigation of External Threats Goals a) Data Loss Prevention:
Data loss prevention tools are components of comprehensive information security programs as well as major cybersecurity frameworks [5], [68], [69], [70]. b) Antispam and malware protection: These tools are consistently components of comprehensive information security programs as well as major cybersecurity frameworks [5], [68], [69], [70]. c) Intrusion detection and prevention: This information security element has received more attention in recent years and is included in both the NIST cybersecurity framework [68] as well as the Center for Internet Security framework [70]. d) Protection of network: Technical tools that minimize threats from outside the network (e.g., network access control, network segmentation, firewalls, routine vulnerability scanning) are key elements of an effective information security plan.

C. Desirability Curve Development
As noted above, expert judgement is used to quantify desirability curves for each metric. Development of desirability curves is a method which converts qualitative or quantitative data for a given element in the model to a scaled quantitative value [56], [59], [64]. Using a scale of 0 to 100, where 0 is the least desirable state and 100 is the ideal state, a scale with normalized values is developed.
The resulting curves are provided in the Appendix. The pairwise comparison technique was used for the quantification process for each decision element. Judgment quantification instruments were designed and administered to each panel of experts to collect pairwise comparison information. Fig. 2 shows the finalized validated model with decision element weights as derived from expert feedback.

IV. VALIDATION: CASE STUDIES
Healthcare organization come in many different sizes and shapes. To test the model for generalizability a variety of different organization types and sizes were selected for case study inclusion. The following organization types were included in the case studies: 1) Critical Access Hospital: Critical Access Hospital is a designation given to eligible rural hospitals by the CMSs. The designation is designed to increase access to healthcare for rural communities and reduce the financial vulnerability of these sites. Critical Access Hospitals have 25 or fewer acute care inpatient beds, are located 35 miles from another hospital, and provide 24/7 emergency care services. 2) Stand-Alone Community Hospital: Stand-alone community hospitals are generally the sole or predominant healthcare provider in the market they serve. They are independent and are not aligned to any larger health system. These community hospitals are generally closely aligned with local physician groups (calculation of the score of this hospital in provided in Table I). 3) Integrated Delivery Network (IDN): An IDN is a system of healthcare facilities and providers that offer both healthcare services as well as healthcare insurance plans to a defined patient population which may, or may not, be a related to a specific geographic area. They vary greatly in size (number of facilities, providers, patients served). 4) Large Healthcare System: A healthcare system is a collection of facilities and providers, who may or may not be employed by the healthcare facility, who work together to deliver a variety of healthcare services. Unlike the IDN noted above the healthcare system does not explicitly offer healthcare care insurance plans. In this case, large is defined as greater than one hospital and more than 500 inpatient beds. 5) Academic Medical Center: Academic medical centers are universities that teach medical students and include one or more hospitals as well as provider practice plans to provide hands-on experience to their students as well as graduate medical education training. Academic medical centers provide a wide range of healthcare services for patients and often include cutting edge research capabilities. The Chief Information Officer was contacted at each potential case study site to ascertain their interest and ability to participate in the article. These decision makers and experts were able to respond to the data collection instrument and in one case asked if they could include other information security experts within their organization in the process to ensure accuracy of response. Table II gives a summary of key demographics [90] associated with each case study site for 2020. A summary of the health information security maturity model scores is given in Table III.
The variety given in Table IV may be caused by several factors. Cost of some solutions may be higher than others. Some solutions will be easier to implement than others. Lack of frameworks which measure the importance of the factors related to creating a mature information security environment may have led to a less focused approach on which measures provide the greatest value. In any case, these baseline scores provide a framework to measure performance in a quantified way going forward. Information security choices are complex, and the output of the health information model should not serve as a laundry list of things to do, but instead as a tool that can be used for further analysis to prioritize high value work that could contribute to improving overall maturity in information security. Further analysis of the scores at each case study site allows for specific recommendation for each site. Sharing scores with peers, if conducted in a confidential manner, could provide an opportunity to share best practices and lessons learned. During the case study process one site suggested the model could be used by a group of regional peers at one of their periodic meetings to facilitate a discussion of this kind.

A. Research and Practical Implications
The article validated the decision criteria and relative linkages for each criterion consistent with information gleaned from the literature review. One of the interesting findings is that while the research shows the importance of all criteria in the model, it specifically identifies the criteria that hold a greater level of importance, through a higher ranked weighted value. The results also confirm that technology solutions alone are not enough to create a mature information security environment.
The most important element of the model based on expert panel quantification is intrusion detection and prevention and is defined as a "24x7 intrusion detection and prevention (a.k.a. managed detection response) program utilizing Security Information and Event Management tools" based on both literature review as well as expert feedback. As noted earlier, this specific element was added to the model because of expert feedback. It is not surprising that this criterion ranked highly as external cyber threats have grown in frequency and negative impact. The importance of proactive cyberthreat intelligence is noted by Khan et al. [91] in their proposal for augmented threat intelligence.
The second highest rated element of the model based on expert panel quantification is protection of network and is defined as "technical tools that minimize threats from outside the network (e.g., network access control, network segmentation, firewalls, and routine vulnerability scanning)" based on both literature review as well as expert feedback. As with intrusion detection and prevention, protection of network is focused on limiting access to an organization's network and further securing known vulnerabilities within the network. The importance of network protection was highlighted in Wang's [92] work promoting artificial intelligence solutions in this space. The high rating received by this element is also likely related to the recent increase in frequency and negative impact of external actors.
Third on the list of highest-ranking elements of the model based on expert panel quantification is identity, authentication, and access management and monitoring, defined as "technical tools that ensure only those that need to access sensitive data and systems are able to do so," based on both literature review as well as expert feedback. As with intrusion detection and prevention and protection of network, identity, authentication and access management and monitoring is focused on limitation of access to organizational information systems. Unlike the two highest rated criteria, this element provides for segregation of access at the individual system level in addition to minimizing access to the organization at the global level. In this way, access to sensitive data such as PHI is further limited. While interest in limiting access at the system level is not unique to healthcare organizations it is especially important at healthcare organizations due to the increased risk associated with those data types, thus the importance of this criteria as rated by experts is understandable. The importance of identity management as part of a larger cybersecurity strategy is noted in the work of Khan et al. [93] as they explored novel solutions to this vexing challenge through use of blockchain technologies.

A. Contributions
By creating a maturity model for information security in healthcare environments, this article contributes to the existing body of knowledge on technology management maturity assessments in the healthcare industry, as well as maturity models in support of information security. Specifically, as noted in the literature review, more information is needed on the ways that healthcare organizations measure, monitor, and optimize their information security environments. The literature review further noted a lack of structured, comprehensive, and usable assessment tools for healthcare organizations in measuring their performance so they could prioritize scarce resources and share best practices related to information security among peers. This article provides a multicriteria tool which has been quantified and validated for repeat use in multiple healthcare organization types which produces a score. The maturity model may also provide insight into the importance of the human element of information security.
The model supports improved decision making at the institutional level by helping organizations better under the maturity of their information security environments. This model is a cost-effective solution which is easy to administer, minimizing the need for third-part resources or extensive human resources to maintain. The healthcare information security maturity model will help organizations make better decisions about where to apply their scarce resources to improve their information security environments. This model may be especially useful at small or less mature healthcare organizations due to the low level of effort required to complete an institutional assessment. Using the model healthcare organizations will be able to deploy information security programs that will improve the integrity of data as well as the reliability of information systems, thereby improving their information security compliance and minimizing the risk of both internal and external threats. The potential to improve information security within the healthcare industry is vast and a successful maturity model will not only improve information security environments, potentially savings hundreds of millions of dollars, it might also literally save lives.
The model may also be used to share best practices across healthcare organizations regardless of the type of organization. There has been growing interest in the healthcare community to share, confidentially with peers, some level of information about the information security environments within respective organizations. A major provider of electronic records began the conduct of a confidential information security benchmark activity in 2018 which allows some healthcare information to learn more about the tools and staffing levels of their peers in a way that masks the individual organizations contributing to the survey. This exercise did not produce a score of any kind, but it illustrates a willingness on the part of healthcare organizations to share more about their information security in a trusted environment. As the cybersecurity threat has increased, many organizations are more willing, and even eager, to share best practices and lessons learned in confidential forums. While this may seem a minor shift, it has led to the development of several communities of interest both inside and outside of healthcare, nationally and regionally. These communities build upon the trusted relationships of information technology professionals, and sometimes include partnership with federal agencies. It is evident that where cybersecurity used to be a cloak-and-dagger exercise, it has become a team sport as organizations learn that they are better prepared to fight the cybersecurity battle informed by the knowledge and experience of a broader community. Table V shows how this article has addressed the gaps identified in the literature review.

B. Limitations and Future Research
The first limitation of this article is associated with the use of expert panels. While a broad variety of experts were utilized in the conduct of this article, experts are subject to the same human biases we all have. They may be inconsistent, or disagreement may be found among experts. To protect against this specific risk, the model was tested to identify either disagreement or inconsistency. In addition, some of the data was collected through verbal interaction to minimize confusion related to complexity of some research concepts.
A primary output of this article is the creation of a generalizable information security maturity model for healthcare organizations. While created solely with healthcare experts, many foundational elements related to information security are not necessarily industry specific. The model may be more broadly generalizable to a variety of industries. Exploration of this opportunity could lead to either creation of new maturity models that are industry specific or it could determine that the existing model is more broadly generalizable than tested during the current article. If this line of research were pursued, further study could compare the resulting models and analyzing similarities or differences.
There is potential to use the model as a foundation for the development of an education roadmap for cybersecurity professionals either within healthcare or outside of healthcare if the model is found to be more broadly generalizable than demonstrated by the article. The need for information security specialists is high and current educational programs largely focus on technology solutions alone. This article has demonstrated that technology solutions alone are not enough to create mature information security environments. A comprehensive educational program that includes the human element of information security could be quite valuable APPENDIX See Figs. at next page.