SciELO - Scientific Electronic Library Online

vol.31 issue2 author indexsubject indexarticles search
Home Pagealphabetic serial listing  

Services on Demand



Related links

  • On index processCited by Google
  • On index processSimilars in Google


South African Computer Journal

On-line version ISSN 2313-7835
Print version ISSN 1015-7999

SACJ vol.31 n.2 Grahamstown Dec. 2019 



Leveraging intrinsic resources for the protection of health information assets



Kevin Kativu; Dalenca Pottas

Nelson Mandela University, Summerstrand North Campus, Port Elizabeth, South Africa. (corresponding),




The prevailing state of rural economies continues to constrain the use of digital applications for improved healthcare. These constraints are attributed to the unavailability of key infrastructure and financial resources. Moreover, a prevailing shortage of skilled health workers highlights the critical role digital solutions have to play in alleviating health service delivery challenges. Resource-constrained settings need secure low cost and long shelf-life solutions that leverage existing resources to provide adequate and secure health services. The objective of this paper is to identify the existing resources that can be engaged in the protection of the broader health information assets (including digital applications). To meet the objective, a single case study was conducted. Questionnaires were distributed to twenty-five Community Health Workers to identify existing stressors and resources in the context. The paper leads with a description of resource-constrained settings, highlights the challenges facing healthcare systems in these contexts and emphasizes the need for health information asset protection. The findings, recommendations and conclusions are subsequently presented. The contribution of this paper is a set of recommendations for improving health information asset protection in resource-constrained settings as informed by stressors and resources identified in the case study.
CATEGORIES: · Security and privacy ~ Social aspects of security and privacy

Keywords: security and protection, organizational impacts, system management




Prevailing trends in the information and communication technologies (ICT) sector, have accelerated the dependency on digital information for the efficient dispatch of business processes and workflows. These trends can be attributed to increased use of mobile devices, smartphones, laptops, tablets, and personal sensors (Feldman, Martin, & Skotnes, 2012). Mobility has been at the forefront of these advancements, taking advantage of the lower cost of mobile devices, growing open source health information system community and rapidly expanding mobile telecommunications infrastructure. While many economic sectors have embraced the digital drive, the healthcare industry maintains notoriety for its resistance to change (Groves, Kayyali, Knott, & Kuiken, 2016). This can be exacerbated in the rural healthcare setup where existing staff shortages attributed to poor working conditions and low remuneration (Chikanda, 2006) discourage the adoption of any additional tasks to the existing workflows. Consequently, an emphasis should be placed on equipping rural based institutions with the mechanisms and capabilities to leverage technological tools in an effort to improve service quality and accessibility (Hitt & Brynjolfsson, 2002). Rural-based healthcare institutions stand to significantly benefit from the aforementioned technological trends. As captured information transitions from static paper-based systems towards digital records, better quality care becomes more accessible through improved clinical decision support, disease surveillance, and population health management among other data-driven benefits (Raghupathi & Raghupathi, 2014).

1.1 The resource-constrained context

Rural settings are typically described as resource constrained and are characterised by poor infrastructure such as electricity, road and telecommunication networks (Gaede & Versteeg, 2011). Additionally, rural healthcare suffers a critical shortage of skilled staff in public institutions which can largely be attributed to the push-pull factors affecting rural to urban migration of skilled workers (Strümpfer, 1995). A consequence of the lack of skilled labour is the prevalence of task shifting which can be described as the redistribution of medical and health service responsibilities from qualified health professionals to health workers with less training and qualifications (Agyapong, Farren, & McAuliffe, 2016; Clarke et al., 2012; Heunis, Wouters, Kigozi, Rensburg, & Jacobs, 2016). This problem is particularly severe in Sub-Saharan Africa (Gupta & Dal Poz, 2009) and has been compounded by the persistent migration of skilled health care workers.

The inability to attract and retain skilled labour has resulted in the need for community-centric solutions to remediate existing shortages. CHWs are community members who are provided with basic patient care training in order to facilitate the delivery of healthcare and health-related services within their communities. A significant challenge is that CHWs are less skilled when compared to their professional counterparts, and in many cases, volunteer their services only when able to do so. Consequently, when tasked with using digital information technology tools to deliver health services, the learning curve is steep and an understanding of the sensitivity of health information is lacking. This has the adverse effect of potentially creating data security vulnerabilities stemming from user error and possible lack of adequate security training and experience.

In the rural healthcare context, mobile computing devices extend the productivity of a health worker by enabling mobility thereby allowing the wider provision of health services to remote and digitally disconnected homesteads. The benefits of mobility in the rural context are further supported by Braun, Catalani, Wimbush, and Israelski (Braun, Catalani, Wimbush, & Israelski, 2013) who suggest mobile technology can potentially enhance the capacity of community health workers to innovate, improve accuracy and productivity. Community health workers (CHWs) typically commute between patients whilst carrying mobile computing devices that have either been customized or are host to applications that facilitate the provision of health-related services.

Embracing technology is not without its pitfalls. Healthcare is a critical service that is dependent on sensitive health-related patient information. The gravitation towards technology-driven health information systems particularly in resource-constrained settings requires a holistic review of security controls that are deemed suitable and attainable given the lack of financial resources and expertise. Failure to provide context-relevant solutions may result in a push-back from the would-be system users who may perceive such changes as disruptive and maybe intimidated by unfamiliar systems. This may have the adverse effect of rendering sensitive health information exposed and the opportunity for malicious or accidental incidents increases.



Information is a critical requirement for the well-being of an organisation, consequently, information and the derived knowledge have increasingly become recognised as information assets (IT Governance Institute, 2006). Accordingly, the information resources of an organisation have an attached value. The attached value allows for the information resources to be classified as information assets. Information assets in the healthcare context can be described as information and other resources such as infrastructure and human capital that support the information systems and enable the operational use of health information. By virtue of being an asset, these resources have value to the health service delivery process and must be adequately maintained and protected in order to sustain the operations of the health information systems (HIS).

Assets can generally be classified as either tangible or intangible. Information is an intangible asset and in the scope of healthcare, will take the form of either health status information, health-related information, health service information or health management information (Matshidze & Hanmer, 2007). Tangible assets include the physical devices and tools that are used in the delivery of the health service.

Information stored in medical / health records is considered sensitive and the loss or unauthorised access to such information may have severe repercussions on the individuals whose information has been compromised as well as the organisation who was trusted with the confidentiality of this information.

The Ponemon Institute reported that nearly 90 per cent of healthcare organizations represented in their study had a data breach in the past two years (2014-2016) with nearly half of those having more than five data breaches in the same time period (Matshidze & Hanmer, 2007). A significant emphasis was placed on employee negligence, mobile device insecurity, use of public cloud services and employee-owned devices. This once again emphasises the critical role of the user in safeguarding health information. The study focused on the users' day-to-day experience with the aim of identifying contextual challenges and resources. An emphasis was placed on collecting context-specific data with the aim of establishing the context sensitivity of the identified resources and stressors for the protection of health information assets.



A case single case study was conducted amongst community health workers employed by a not for profit organisation in the rural Eastern Cape. A mix of convenience and purposive sampling was employed in selecting participants. Convenience sampling was used to identify an institution meeting the requirements for the study which are: (1) the institution must operate within the rural communities exclusively (2) the bulk of the workforce must be drawn from the rural community (3) the institution must make use of some form of computing devices in their day-to-day delivery of health-related services. The individual participants were sampled purposively with the aim of drawing participants from different operational roles within the organisation. However, one of the requirements for participation was that the individuals must have been actively involved in the day-to-day health service delivery. Twenty-five candidates met the requirements and were subsequently selected for participation and the questionnaires were hand delivered for completion in a single session for individual completion. The semi-structured questionnaire consisting of twenty-two questions was developed and tested for comprehensibility with a sub-set of supervisory staff in the organisation. The questionnaire was designed to probe three main areas as follows: (1) day-to-day infield activities (2) proficiency with IT tools and security comprehension (3) on-site activities including data redundancy and data protection mechanisms. The specific aim of the questionnaire was to determine the understanding of procedures from the perspectives of the daily users and identify any inherent internal or external health information stressors/resources. Deductive content analysis was used analyse and subsequently theme the resulting data set. The case study ultimately served as the testing ground for the use of resource-based perspectives in addressing health information security issues in a rural, resource-constrained context.

3.1 Methodology bias

The use of convenience sampling presents some bias related drawbacks since the sampled population may not be representative beyond the scope of their environment. Additionally, there is a risk of collusion and collaboration amongstthe participants as earlierdiscussed. Allparticipants are members of the same community and report to the same organization. Consequently, the feedback could be biased towards presenting the community or the organization in a positive light for fear ofreprimand. In an effort to avert bias (1) each participant was informed verbally and in writing that the feedback would be anonymous (2) confidentiality forms were distributed to each participant reassuring that the information gathered will be used explicitly for the study (3) no participant personal details were recorded (4) each participant was asked to complete the questionnaire individually and the questionnaires were not collected in any particular order.

3.2 Theoretical grounding

Health information assets in resource-constrained settings may consist of the intrinsic/extrinsic resources that contribute towards the protection of health information. The rural health context presents some unique constraints owing to the lower levels of infrastructure development and a severe shortage of critical knowledge workers. This has the effect of diminishing the capacity of healthcare organisations to consistently deliver quality care efficiently and implement security controls effectively. Additionally, information security awareness and computer literacy are not considered a critical requirement for the employment of CHWs.

Adopting a resource-based perspective encourages the shift in focus from problem-centric solution development to resource-based solution development. Specifically, in healthcare, the pathogenic and Salutogenic perspectives provide the problem-centric / resource based contrast.

According to Bauer, Davies, and Pelikan (Bauer et al., 2003). Ongoing health development can be analysed from Salutogenic (health resources and positive health) or pathogenic perspectives (risk factors and disease). Salutogenic perspectives emphasize the creation of health (A. Morgan & Ziglio, 2007) and examine how resources in human life support development towards positive health (Bauer et al., 2003).

Pathogenic perspectives focus on the prevention of disease by analysing how risk factors of individuals and their environment lead to ill health (Bauer et al., 2003).

All too often, health measurement instruments focus on measuring ill-health as opposed to a more holistic view on health (Bringsén, Andersson, & Ejlertsson, 2009). The Salutogenesis theory within the context of resource-based perspectives brings to focus the factors or traits, be it an individual, group, or community-based that contribute positively to the health outcomes of a community. The reality is that the Salutogenic and pathogenic perspectives are simultaneous, co-dependent processes that interact and complement each other to achieve a common goal.

The concept of Salutogenesis was derived from the works of Antonovsky who is generally regarded as the founder of the term. Antonovskys primary concern was to investigate the origins of health as opposed to the traditional investigations into what causes disease (Antonovsky, 1987). Salutogenesis can, therefore, be aligned within the positive domains of health. Promoting positive health outcomes shifts the focus from traditional deficit models that are primarily concerned with identifying intrinsic shortcomings or the lack of when exploring a subject matter (D. L. Morgan, 2014). The Salutogenic framework defines general resistance resources and stressors as two opposing constructs and these are subsequently discussed.

3.3 General resistance resources

The General Resistance Resources (GRRs) are the mechanisms through which the Salutogenic processes operate. Within a Salutogenic framework, people reporting greater GRR will report a greater sense of coherence, are likely to be more motivated to manage adversity, recognise the challenge(s) underlying adversity and believe that resources are available to remediate the situation (Parkin, 2015). Typical examples of GRRs are money, knowledge, experience, self-esteem, healthy behaviour, commitment, social support, cultural capital, intelligence, traditions and view of life. Lindstrm and Eriksson stress the importance of peoples ability to use GRRs in order to effectively improve health outcomes (Eriksson & Lindström, 2005). This study argues that the same GRRs can be leveraged to improve health information security outcomes without the need for additional investments in infrastructure and resources.

3.4 Stressors

Stressors can be described as omnipresent detractors of well-being. The effect of stressors on a person's well-being depends significantly on the availability and one's ability to utilise their GRRs (Gaede & Versteeg, 2011). Stressors manifest in many different forms but all have the common consequence of creating disease on a person experiencing the stimuli. While primarily investigated from a healthcare perspective, stressors can be a generic reference to any negative stimuli or event that results in a negative outcome for a person, group, or entity exposed to the stimuli. Pathogenic perspectives are concerned with identifying the stressors first then subsequently identifying or developing resources that either prevent or remediate the effects of the stressors. Through experience and the repeated exposure to stressors, individuals, groups or entities increasingly develop a resistance to the stressors by either identifying GRRs or developing coping mechanisms that make the stressors tolerable.

This study draws from the Salutogenic/pathogenic contrast to establish the contrast between traditional problem-centric and resource-based perspectives to information systems development. The use of these constructs is discussed in the results section.



To analyse the feedback from the questionnaires, a process based on the constructs was developed and it is illustrated in Figure 1.

Stressors (aggravators to the health information asset protection objectives) were identified and catalogued. These were further categorised into those that are within the means of the organisation to resolve given the available resources (intrinsic) and those that require external intervention (extrinsic). The extrinsic findings are sidelined for consideration at a later stage when the means are available, and the process that follows involves mapping the existing resources to the identified stressors in an effort to mitigate the adverse effects utilising only the means that are available/sustainable to the organisation. The categorised intrinsic stressors and resources identified in the context are subsequently presented in Table 1. Each listing is associated with the respective question from which the factor was identified as [Qx]. The participants involved in the identification of the factor are presented in the narrative that follows as [Px].

Stressor: Lack of accountability stemming from the lack of device ingress and egress records (Q6) - Are there any records kept regarding your collection and return of the devices?

Participant feedback analysis: Responses to this question indicate that there are no records of device collection or return. The organisation can take advantage of the fact that each user is issued a dedicated device for their daily activities. Binding a user to a specific device and storing records on who has been issued which device can aid in instilling accountability.

Stressor: Incidents of device failure (Q9- Have you ever experienced a device failure? And if so, how often?)

Participant feedback analysis: The feedback was equally divided with half of the participants indicating that they have experienced device failure and the other half have not. Further analysis is complex without understanding the underlying cause of the device failure. The frequency of device failure would typically require technical skills to provide maintenance and repairs. However, not all device failure can be classified as catastrophic, hence, some minor troubleshooting tasks can be performed by the CHWs if provided with adequate training. The organisation can take advantage of the existing training structures to include basic hardware troubleshooting into the disseminated skillsets.

Stressor: Lacking trust relationship with community members (Q18 - In your opinion, are the clients generally forthcoming with information regarding their health status? Q21 - Are the patients generally comfortable with the use of the devices during the screening process?)

Participant feedback analysis [Q18]: The responses indicate that the patients are generally forthcoming as the majority of the participants indicated as such: [P2] yes, they depend on the health education they get from Chow and they may end up motivated for their health risks to consider them. However, some patients are not comfortable and may resist any attention from the CHWs or not respond truthfully: [P5] no, some of them have a problem of denial.

Participant feedback analysis [Q21]: Feedback regarding patient comfort with the use of the devices for health screening purposes was mixed. For the most part, the CHWs are of the consensus that the patients are comfortable, but in two cases, the CHWs highlighted trust issues: [P16] no, others ask many questions about it and they suspect that we are about to take their grant, but I manage to explain for them and [P23] no, they don't believe everything especial when you ask their identity document to see the age. Establishing trust with the community members (patients) is likely to result in patients providing accurate information. A few CHWs noted how some patients were hesitant to provide information regarding their health status as they were not fully trusting of the CHWs. Leveraging the compliant behaviour of some of the CHWs to serve the role of champions and/or mentors to the non-compliant CHWs may aid in improving the organisational image and thus improving the trust relationships. Additionally, the CHWs can leverage the process of obtaining patient consent to adequately reassure the patient that their activities are in the best interest of the patient. The CHWs can also take advantage of the trusting patients who have seen positive results for the interventions to provide advocacy within the community thereby reassuring the rest of the community on the legitimacy of the services being rendered.

Stressor: Lacking IT proficiency (Q11- On a scale of 1 5, how proficient would you say you are with using the device?)

Participant feedback analysis: The majority of the participants selected option 2 comfortable working with common applications, This was the second lowest competency option possibly indicating a lack of proficiency beyond performing the required task. A single participant selected option 1 for very basic skills. The organisation has a big role to play in improving the general IT literacy of the CHWs. As previously discussed, improved IT literacy can result in increased CHW efficiency, reduce the incidence of human error/omission and reduce the frequency of device failure.

Stressor: Lacking security control awareness (Q13 - In your opinion, what security measures are in place on the device/application to prevent the loss or theft of information?)

Participant feedback analysis: Responses to this question include [P10] having my own user and password and always save at the end as identified by some participants. However, some participants indicated that there were no security measures in place and others simply did not know. Some interesting responses included [P4] none, it always safe because I work in my community and they know me and [P11] we save information. The existing training structures can be leveraged to provide security control awareness. Additionally, the existing awareness knowledge present in some of the CHWs can be shared through peer training and mentorship strategies. This reduces the reliance on organisational training structures for the dissemination of security control awareness information.

Stressor: Scepticisms of screening processes (Q19 - Based on your judgement, do the patients understand the information conveyed to them before divulging any health-related information?; Q21 [previously discussed])

Participant feedback analysis: The responses indicate that only some of the patients are well informed of the activities to be conducted prior to any action. The CHWs convey their intention and the potential benefits to the patient as seen from the following extracts: [P4] yes, because we do introduce what we are here for, what will be doing, [P2] yes, the health education come up with new information full of advices. However, some responses indicate the lack of trust and perhaps elements of misunderstanding: [P23] no, sometimes it may happen especially for the first time because they don't believe that we are dealing with health status only and several responses of just [P15,18,19] no. Scepticism can be overcome through the informed consent process. The CHWs can ensure that the patient has been adequately informed and reassured about the intent of the CHW. Additionally, compliant behaviour can be learnt through peer mentoring and observation with the aim of presenting the CHW in a professional manner. Moreover, overcoming the scepticism aids in building trust. Moreover, advocacy in the community may be sought from patients who have benefited from the system and are trusting of the CHWs activities.

Stressor: Consent granted without full awareness of the implications (Q19 - previously discussed) Participant feedback analysis: This again can be addressed by ensuring adequate information is disseminated during the process of seeking consent. The CHW must ensure the patient is fully aware of the implications of granting consent. The following section maps the identified resources to the Salutogenic constructs discussed in section 4.6.



The specific objective of the case study was to determine the viability of adopting a resource-based perspective as an alternative to the traditional deficit based perspectives in information systems protection mechanisms. This was achieved using a semi-structured questionnaire aimed at identifying resources and stressors. These findings were subsequently analysed and the identified resources with potential remediating characteristics were mapped to the identified stressors. In identifying resource based controls, it should not be overlooked that appropriate technical controls such as cryptography and biometric authentication can go a long way in mitigating against some of the stressors. However, the applicability of these controls is dependent on the availability of technical know-how and support. The study seeks to determine the availability of controls in a context in which these resources are severely scarce or unavailable. Therefore, without undermining the significant relevance of technical controls in addressing the stressors, in a critical resource-constrained context, these would only be available through external interventions/service providers. The process of identifying resources makes for provision for the implementation of technical controls as and when the required resources are available, however in the interim, internal controls utilising existing resources may provide some measure of protection to facilitate the continued use of ICTs for service delivery albeit with reduced health information security vulnerabilities.

The identified controls may not address the complete list of stressors but can go a long way in stifling the vulnerability of the health information assets. External interventions can be added as and when the means are available to address the remaining stressors. However, knowledge of the stressors in itself may allow the organisation to identify workarounds or preventative measures that can minimise the negative impact of the unresolvable stressors.



Due to the unavailability of a diverse set of participants, the demographics of the participants consisted entirely of CHWs and a single Supervisory / IT staff member consequently, the questions were targeted primarily at this demographic. This however presented some limitations on the feedback provided. To obtain more accurate feedback, one must try as much as possible to include a diverse set of participants. From the researcher's experience, one question that came up was who would be responsible for driving this process?. It was clear that although the goal is to use resources immediately available within the context, some initial guidance from knowledgeable individuals in information systems/information security may be required. As part of their activities, internal organisational capacity must be developed to enable the process to continue to deliver results post the initiation stages.



The study aimed to identify resources that may be applied in an effort to alleviate some of the challenges/stressors facing health information assets. These include the digital assets (health records), infrastructure (devices) and human capital (users) in resource-constrained settings. A case study was conducted through which the resource-based perspective was applied in the identification of resources and stressors. The feedback from the participants was analysed and subsequent mappings and recommendations were made. There is scope for the study to be expanded to cover a larger demographic in future research and this would aid in identifying similarities and informing the resource based control development process over time.



While conducting the study, several limitations were noted. The scope of the study was limited to a single institution due to availability and convenience. However, a wider sample would have improved the generalisability of the findings.



Agyapong, V I. O., Farren, C., & McAuliffe, E. (2016). Improving Ghana's mental healthcare through task-shifting-Psychiatrists' and health policy directors' perceptions about government's commitment and the role of community mental health workers. Globalization and Health, 12(1), 57.        [ Links ]

Antonovsky, A. (1987). Unraveling the mystery of health: How people manage stress and stay well. The Journal of Nervous and Mental Disease, 177(7), 439-440.        [ Links ]

Bauer, G., Davies, J. K., Pelikan, J., Noack, H., Broesskamp, U., & Hill, C. (2003). Advancing a theoretical model for public health and health promotion indicator development: Proposal from the EUHPID consortium. European Journal of Public Health, 13(3 Suppl), 107-113.        [ Links ]

Braun, R., Catalani, C., Wimbush, J., & Israelski, D. (2013). Community health workers and mobile technology: A systematic review of the literature. PLoS ONE, 8(6), e65772.         [ Links ]

Bringsén, Α., Andersson, H. I., & Ejlertsson, G. (2009). Development and quality analysis of the Salutogenic Health Indicator Scale (SHIS). Scandinavian Journal of Public Health, 37(1), 13-19.        [ Links ]

Chikanda, A. (2006). Skilled health professionals' migration and its impact on health delivery in Zimbabwe. Journal of Ethnic and Migration Studies, 32(4), 667-680.        [ Links ]

Clarke, J., Hidalgo, M. G., Lioy, A., Petkovic, M., Vishik, C., & Ward, J. (2012). Consumerization of IT: Top Risks and Opportunities. Retrieved from

Eriksson, M., & Lindström, B. (2005). Validity of Antonovsky's sense of coherence scale: A systematic review. Journal of Epidemiology and Community Health, 59(6), 460-6.        [ Links ]

Feldman, B., Martin, E. M., & Skotnes, T. (2012). Big Data in Healthcare - Hype and Hope. DrBonnie360. Retrieved from

Gaede, B., & Versteeg, M. (2011). The state of the right to health in rural South Africa. South African Health Review, 2011 (1), 99-106.         [ Links ]

Groves, P, Kayyali, B., Knott, D., & Kuiken, S. V (2016). The 'big data' revolution in healthcare: Accelerating value and innovation. Center for US Health System Reform Business Technology Office.

Gupta, N., & Dal Poz, M. R. (2009). Assessment of human resources for health using cross-national comparison of facility surveys in six countries. Human Resources for Health, 7(22).        [ Links ]

Heunis, C., Wouters, E., Kigozi, G., Rensburg, E. J. V, & Jacobs, N. (2016). TB / HIV-related training, knowledge and attitudes of community health workers in the Free State province, South Africa. African Journal of AIDS Research, 5906(3), 113-119.        [ Links ]

Hitt, L. M., & Brynjolfsson, E. (2002). Information technology, organizational transformation, and business performance. In Productivity, inequality, and the digital economy (pp. 55-91). MIT Press.

IT Governance Institute. (2006). Information Security Governance: Guidance for Boards of Directors and Executive Management. ISACA.

Matshidze, P, & Hanmer, L. (2007). Health information systems in the private health sector: Pooling of resources and purchasing of health care. South African Health Review, 2007(1), 89-102.         [ Links ]

Morgan, A., & Ziglio, E. (2007). Revitalising the evidence base for public health: An assets model. Promotion & Education, 14(2), 17-22.        [ Links ]

Morgan, D. L. (2014). Pragmatism as a paradigm for social research. Qualitative Inquiry, 20(8), 1045-1053.        [ Links ]

Parkin, S. (2015). Salutogenesis: Contextualising place and space in the policies and politics of recovery from drug dependence (UK). International Journal of Drug Policy.

Raghupathi, W., & Raghupathi, V (2014). Big data analytics in healthcare: Promise and potential. Health Information Science and Systems, 2(1), 3.         [ Links ]

Strümpfer, D. (1995). The origins of health and strength: From 'salutogenesis' to 'fortigenesis'. South African Journal ofPsychology, 25(2), 81-89.         [ Links ]



Received: 29 Aug 2017
Accepted: 11 Nov 2019
Available online: 20 Dec 2019

Creative Commons License All the contents of this journal, except where otherwise noted, is licensed under a Creative Commons Attribution License