Week 13- Reading Summary – Leting Zhang

Angst, C.M., Block, E.S., D’arcy, J. and Kelley, K., 2017. When do IT security investments matter? Accounting for the influence of institutional factors in the context of healthcare data breaches. MIS Quarterly, 41(3), pp.893-916.

Although organizations take numerous approaches to secure their IT asset, data breach incidents still happen very frequently across industries. To investigate the underlying reasons, this study examines the effectiveness of IT  security investment in the healthcare industry through the lens of Neo – institutional theory, specifically,  how symbolic adoption and substantive adoption influence the success of security investment, what kinds of institutional factors  associated with the two types of adoptions, why IT security investment has a delayed effect.

According to the institutional theory, the motivation to adopt a practice is not only by actual benefit, but also to seek legitimacy in the social structure. In most cases, this pressure can result in symbolic adoption, which means practice would not be fully implemented and their benefit would not be maximized. However, symbolic adoption and substantive adoption can not be observed directly, so the paper suggests several organizational characteristics that can predict each type of adoption. Combining with theory and available data,  the study proposes that these characteristics can contribute to symbolic adoption: 1. members of smaller health systems; 2. long  established; 3. smaller size; 4. for-profit; 5. teaching ; 6.faith-based;7. less entrepreneurial ; then it further suggests 1. more IT security investment will reduce breaches; 2. substantive adoption will enhance the effectiveness of IT security investment over time; 3.symbolic  adoption will decrease the effectiveness of IT security investment in the over time.

It collects hospital level data from HIMSS and data breach incidents from different sources. Then, it uses a growth mixture model (GMM) for dichotomous outcomes to test hypotheses. A part of hypotheses are supported by the results.