# Factors Influencing Internet of Medical Things (IoMT) Cybersecurity Protective Behaviours Among Healthcare Workers

Sinazo Brown, Zainab Ruhwanya, Ayanda Pekane

► To cite this version:

Sinazo Brown, Zainab Ruhwanya, Ayanda Pekane. Factors Influencing Internet of Medical Things (IoMT) Cybersecurity Protective Behaviours Among Healthcare Workers. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.432-444, 10.1007/978-3-031-38530-8_34. hal-05462105

HAL Id: hal-05462105

https://inria.hal.science/hal-05462105v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Factors Influencing Internet of Medical Things (IoMT) Cybersecurity Protective Behaviours Among Healthcare Workers

Sinazo Brown, Zainab Ruhwanya✉, and Ayanda Pekane✉✉

University of Cape Town, Cape Town, South Africa
{zainab.ruhwanya, ayanda.pekane}@uct.ac.za

**Abstract.** The healthcare sector is increasingly adopting technologies like the Internet of Things (IoT) to improve healthcare service delivery and outcomes. As the adoption rates increase, so do the attack rates. The Internet of Medical Things (IoMT) has increasingly become a target of cyberattacks. There is an awareness that human factors significantly contribute to IoMT vulnerabilities but minimal research on the phenomenon. This research explores the factors influencing the behaviours of South African healthcare workers as they relate to IoMT cybersecurity. The theoretical model for the research was developed based on literature and the Information-Motivation-Behavioural (IMB) Skills model to study how these factors influence the behaviour of South African healthcare workers. Partial Least Squares Structural and Equation Modeling (PLS-SEM) were used to assess the model. The results suggest that Information and Behavioural Skills positively influence behaviour, indicating that knowledge and perceived ability are required to enact cybersecurity protective behaviour.

**Keywords:** Internet of Medical Things · IoMT · IoMT Cybersecurity · Information Motivation Behavioural Skills Model · IMB · Healthcare Workers

# 1 Introduction

## 1.1 Background

The healthcare sector has significantly integrating technology, notably the Internet of Things (IoT), into its services, enhancing healthcare delivery [1]. Within healthcare, this application of IoT is referred to as the Internet of Medical Things (IoMT). By 2019, IoMT accounted for a third of IoT usage, illustrating its rising importance [2, 3]. This adoption has improved healthcare outcomes and helped in reducing costs [3].

However, along with these benefits, the rise in IoMT usage has introduced substantial cybersecurity challenges. These systems have become frequent cyberattack targets, posing serious data security threats and potentially endangering patient safety [4, 5]. Despite the mounting evidence of the role of human factors in these security vulnerabilities, there is a notable lack of research in this area, particularly within the South African context [6, 7].
Research in South Africa has focused on the implications of technology adoption in healthcare, often neglecting the pivotal security issues. For example, studies on wearable devices have shown a tendency for users to prioritise performance over security [8]. There is a reported lack of understanding among users regarding security risks associated with these devices [6]. This is alarming considering that the literature suggests a strong link between human error and successful cyberattacks on IoMT. As South Africa continues to invest in advanced medical technology, the need for stringent security measures and the protection of patient data have become increasingly urgent. It is therefore imperative to understand the factors that influence secure behaviours to address these emerging risks and ensure the safe use of IoMT [9].

The primary objective of this study is to explore the factors influencing cybersecurity-protective behaviour among healthcare workers in South Africa within the context of IoMT. We base our investigation on a theoretical model rooted in the Information-Motivation-Behavioural (IMB) Skills framework [10], and enriched by existing information security literature [11]. By examining these factors, we aim to provide valuable insights into the cybersecurity-protective behaviour of healthcare workers. Ultimately, our research seeks to contribute to developing targeted interventions that can enhance healthcare workers' security behaviours when using IoMT, ensuring the protection of patient data and, most importantly, human lives.

# 2 Literature Review

## 2.1 Internet of Medical Things (IoMT)

The Internet of Things (IoT) is “a dynamic, self-configuring network of physical and virtual things powered with interoperable communication protocols, media, and standards. These things have attributes capable of connecting to information networks and can perform sensing, data processing, networking, and communication” [12, p.645]. When integrated with healthcare, this is known as the Internet of Medical Things (IoMT) [3]. By connecting medical-grade devices with healthcare infrastructures, IoMT enables remote communication between patients and healthcare providers [13]. Two environments for IoMT applications have been identified: healthcare facilities such as hospitals and the homes of patients [14]. IoMT includes devices that work with body sensors to monitor patients’ health, facilitating remote monitoring and diagnosis, and reducing the need for regular hospital visits. The advantages of IoMT include cost reductions due to early intervention [3, 15].

IoMT solutions comprise wearable, implantable, and in-hospital devices. Wearable devices collect patient vitals such as physical activity metrics, heart rates, and blood pressure levels for real-time monitoring and diagnostics [15]. These devices include fitness trackers, smart health watches, and belts [3, 15]. Used for remote health monitoring, these devices transmit readings of patient vitals to healthcare providers, enabling remote monitoring and diagnosis [15]. Patients may also utilise them for self-monitoring [16]. Implantable devices, in contrast, are placed inside the patient’s body. They monitor patient vitals like glucose levels and transmit these results via radio frequency to other devices [17]. Examples include cardiac defibrillators, pacemakers, and insulin pumps
[18, 19]. Lastly, in-hospital devices are utilised in hospitals to assess patients and admin-
ister medical treatments [20]. Examples include Magnetic Resonance Imaging (MRI)
machines, surgical robots, electrocardiogram machines, and anaesthesia machines [3,
18].

## 2.2 IoMT and Cybersecurity

The Internet of Medical Things (IoMT) has significantly advanced healthcare, but also attracts hackers with varying motivations [5]. As of 2019, nearly 90% of healthcare organisations using IoMT reported at least one security breach [2]. Poor cybersecurity can endanger lives [3, 4], and human error, often due to factors like workload, personality traits, and lack of awareness, is a major threat [7, 15, 21–24].

IoMT cybersecurity should address both technical and human factors through a socio-technical approach [25, 26], involving technical solutions like encryption and blockchain integration [14, 27–29], and non-technical measures, such as shared responsibility guidelines [30]. Cybersecurity must protect user and organisational assets while maintaining data confidentiality, integrity, and availability [4, 14].

Unmet IoMT cybersecurity objectives endanger human lives [3, 4]. The inability to access accurate patient data due to cybersecurity breaches may result in incorrect treatment decisions. Any compromise in the integrity and availability of this data can have severe repercussions for patient care and outcomes. For instance, if an attacker gains control over a device worn or implanted in a patient, they could manipulate the device to cause harm to the patient [19]. A security company demonstrated this risk by exploiting vulnerabilities in device functionality, intercepting an insulin pump, and administrating insulin without the patient's knowledge [4, 20]. Consequently, cybersecurity priorities must be adapted based on the type of IoMT and its use, distinguishing between threats to data and threats to life [31].

# 3 Theoretical Framework

## 3.1 The Information-Motivation-Behavioural Skills Model

Various empirical studies have employed the Information-Motivation-Behavioural Skills (IMB) framework to design and evaluate interventions targeting diverse health behaviours [32]. This framework posits that three primary factors influence behaviour: information, motivation, and behavioural skills. Information encompasses knowledge and awareness about a specific behaviour, while motivation consists of attitudes, beliefs, and perceived social norms. Behavioural skills refer to the ability to perform the behaviour.

In the information security context, the IMB model has been utilised to examine privacy and cybersecurity behaviours [11, 33–37]. The model has been applied to enhance the effectiveness of information security awareness campaigns [34], explore the knowledge-behaviour gap in users’ security practices [35], and examine factors influencing the use of privacy settings on smartphones [11].
## 3.2 Hypotheses Development

The IMB model consists of three components: information, motivation, and behavior, as depicted in Fig. 1. This research model has been adapted from the existing literature to gain insights into the factors that influence IoMT cybersecurity protective behaviour. The model suggests that the constructs of information, motivation, and behavioral skills play a crucial role in shaping behaviour. Figure 1 provides an overview of the relationships between these constructs and presents the derived hypotheses, which are explained in detail below.

<figure><img src="image_4.png" /><figcaption>Fig. 1. IMB Skills Model for IoMT Cybersecurity behaviour</figcaption></figure>

**Information.** refers to an individual's understanding of concepts related to a particular behaviour. In their implementation of the model, [11] operationalised information as knowledge, consisting of two types: privacy knowledge and technical knowledge. In the context of IoMT cybersecurity behaviour, privacy knowledge pertains to users' awareness of IoMT privacy and security settings, while technology knowledge involves proper IoMT usage. Research using the IMB Skills model has operationalised information as awareness of risks and knowledge about behavioural action [11, 33]. As such, the following hypotheses have been derived:

* Hypothesis 1a: IoMT cybersecurity risk awareness positively influences IoMT cybersecurity protective behaviour.

* Hypothesis 1b: IoMT cybersecurity knowledge positively influences IoMT cybersecurity protective behaviour.

* Hypothesis 1c: IoMT technology knowledge positively influences IoMT cybersecurity protective behaviour.

Research suggests that perceived abilities, often operationalised as self-efficacy, are required to enact a behaviour. Self-efficacy is the individual's ability, competence and confidence about performing a behaviour [38]. Studies have shown that self-efficacy significantly impacts one's ability to perform and cope with a task and that lack of
knowledge negatively affects one's self-efficacy. The following hypotheses therefore arise:

Hypothesis 2: IoMT cybersecurity risk awareness positively affects IoMT cybersecurity self-efficacy.

Hypothesis 3: IoMT cybersecurity knowledge has a positive effect on IoMT cybersecurity self-efficacy.

Hypothesis 4: IoMT technology knowledge has a positive effect on IoMT technology self-efficacy.

**Motivation** consists of personal motivation and social motivation. Personal motivation pertains to individual attitudes, while social motivation is influenced by an individual's social support system. It is argued that subjective norms can influence users' perceptions of their self-efficacy for the technology and its privacy settings [11]. Furthermore research shows that lower levels of subjective norms lead to less privacy-protective behaviour [11, 34] emphasises the application of the IMB model, particularly its social motivation component, to enhance the effectiveness of information security awareness campaigns, highlighting the significance of considering normative knowledge and social norms in shaping information security behaviour. [11] argue that individuals' willingness to share information negatively influences their intention to use protective settings.

Hypothesis 5a: IoMT subjective norms have a positive influence on IoMT Cybersecurity Self-Efficacy.

Hypothesis 5b: IoMT subjective norms positively influence IoMT Technology Self-Efficacy.

Hypothesis 6a: IoMT information sharing preferences positively influence IoMT Cybersecurity Self-Efficacy.

Hypothesis 6b: IoMT information sharing preferences positively influence IoMT Technology Self-Efficacy.

Hypothesis 7a: IoMT subjective norms positively influence IoMT cybersecurity protective behaviour.

Hypothesis 7b: IoMT information sharing preferences negatively influence IoMT cybersecurity protective behaviour.

**Behavioural Skills** encompasses actual and perceived skills. In order to perform a behaviour, an individual must believe they can and have the necessary skills to do so. Self-efficacy, a measure of an individual's belief in their knowledge of the relevant technology and ability to use it, has been found to influence behaviours positively [37]. Consequently, the following hypotheses are formed:

Hypothesis 8a: IoMT Cybersecurity Self-Efficacy positively influences IoMT cybersecurity protective behaviour.

Hypothesis 8b: IoMT Technology Self-Efficacy positively influences IoMT cybersecurity protective behaviour.

# 4 Research Methodology

Quantitative methods were employed in this research through the distribution of questionnaire surveys to healthcare workers at an academic hospital serving the South African public. Healthcare workers include a range of professionals, such as doctors, nurses, and
laboratory technicians, all involved in delivering patient care within healthcare facilities [39]. For the population of 5,300 healthcare workers at a South African university, the study used a probability sampling method to derive a sample of 357, thereby allowing for precise inferences with a 5% margin of error.

**Data collection** involved a web-based, self-completed survey questionnaire cre-
ated and disseminated using Qualtrics. Inferential statistical analysis was subsequently
applied, with the chosen statistical method aiding in hypothesis testing [40]. Prior to the
survey's official distribution, the instrument was pretested by graduate students at the
same South African public university.

**Instrument Development.** In this research, constructs were drawn from previously validated measures and tailored specifically to the context of IoMT Cybersecurity. These included, Risk Awareness [41], Cybersecurity Knowledge [36], Technology Knowledge [42], Subjective Norms [43], Sharing Preferences [11], Cybersecurity Self-Efficacy [11], Technology Self-Efficacy [44], and Behaviour [36]. A 5-point Likert scale (1"Strongly Disagree" to 5"Strongly Agree") gauged respondents' agreement with measurement items. The Qualtrics software platform was used for survey development and distribution. The questionnaire was first pilot tested with 12 postgraduate students, a subset of the target population.

Following a pretest, items were refined to ensure grammatical accuracy, usability, and clarity, including an addition of a comprehensive explanation of IoMT for the participants' benefit.

**Participants.** At the conclusion of the survey period, a total of 312 responses were recorded. However, only 68 responses (19% response rate) were deemed complete and valid for subsequent data analysis. The response rate falls within the common range of 15–20% for web-based, self-completed surveys [40, 45]. It is important to note that the study was conducted in 2021 during the pandemic, which may have contributed to the relatively low response rate. Healthcare workers were experiencing unprecedented challenges and increased workloads during this time, potentially impacting their willingness and availability to participate in the survey.

**5 Findings**

**Demographic Profile.** The demographics of the participants who completed the survey are as follows: a total of 68 healthcare workers participated; the majority were medical students aged 21–24 (82.35%), with women making up 63.24% and men 35.29%. Participants’ clinical careers varied, with 60.29% having 12 months or less experience, 14.71% having 12–24 months, and 25% having 24 months or more. Occupations included physicians (27.94%), audiologists (5.88%), occupational therapists (8.82%), physiotherapists (16.18%), speech language pathologists (1.47%), and others (39.71%). The higher selection of ‘other’ might have been due to ambiguity in the question, as it could have included nurses and dentists. However, ‘other’ may also represent medical students in their respective fields, as most respondents had a high school education as their highest level (60.29%), consistent with their student status. Regarding IoMT use, 57.35% had less than one year of experience, 20.59% had 1–2 years, 16.18% had 2–5 years, and
5.88% had five or more years. The lack of diversity of the participants was an added limitation. Most of the participants were in the early years of their careers, with minimal use of IoMT. In contrast, we would not argue that this sample is highly generalisable to the overall healthcare workers population. It is reasonable that it could be generalised to healthcare workers in a medical school setting.

**Descriptive Statistics.** When determining the level of awareness South African health-care workers have about IoMT cybersecurity, responses were filtered based on the number of years of IoMT use to ascertain self-reported IoMT cybersecurity awareness. The majority of respondents (57.6%) had less than one year of experience with IoMT use, and 76.9% of them indicated not being aware of the potential IoMT cybersecurity threats and their negative consequences.

As the years of experience increased, so did the participant's awareness of IoMT cybersecurity and threats. For instance, among participants with 1–2 years of experience, 23.1% were not at all aware, and 50% were moderately aware of IoMT cybersecurity threats. The majority of the participants with 2–5 years of experience showed to be more aware of IoMT cybersecurity and threats. Finally, participants with five or more years of experience demonstrated the highest awareness levels, with none of them being not at all aware and 12.5% being very much aware of IoMT cybersecurity threats. A similar trend can be observed in the participants' perception of IoMT cybersecurity's relevance to their practice. Among those with less than one year of experience, 76.2% considered it not at all true, while 33.3% of those with five or more years of experience considered it very much true. Lastly, when asked about the consequences of IoMT cybersecurity, 75% of participants with less than one year of experience considered them untrue, while 57.1% of those with five or more years of experience considered them very much true. Overall, the increase in experience correlates with increased awareness of IoMT cybersecurity.

**Assessment of Measurement Model.** Partial Least Squares Structural Equation Modeling (PLS-SEM) was employed to assess the research model and test hypotheses using the SmartPLS software package. PLS-SEM was chosen due to the complexity of the path model, featuring multiple latent constructs and indicators [46]. The assessment followed a two-step approach, first evaluating the measurement model's reliability and validity and then assessing the structural model [47].

The IoMT Cybersecurity IMB Skills model assessment used PLS-SEM to analyze complex path models with multiple latent constructs and indicators. The measurement model was evaluated for reliability, discriminant validity, and convergent validity. Reliable indicators with loadings above 0.60 were retained [46], and those below were removed; these included IoMTB3, IoMTB4, IoMTB6, IoMTB10, IoMTB11 and IoMTB12. All other indicators were retained as they met the reliability standard resulting in a valid and reliable model.

Internal consistency was established through Cronbach's alpha and composite reliability measures, with values above 0.70 considered acceptable. Composite reliability of values 0.70 to 0.90 is considered satisfactory [48]. However, as seen in Table 1, the high composite reliability value of 0.964 for the IoMT Cybersecurity Knowledge construct suggests indicator redundancy and reduced construct validity. This is because composite reliability higher than 0.95 can suggest indicator redundancy, reducing construct validity [48].
Convergent validity was assessed through the AVE of each construct, which measures whether the latent construct can explain more than half of its indicators' variances. AVE values of 0.50 or more indicate sufficient convergent validity [46], and all AVE values in this study were 0.50 or above, indicating good convergent reliability as seen in Table 1.

Discriminant validity, which indicates the uniqueness and distinctiveness of each latent construct, was assessed using the heterotrait-monotrait (HTMT) ratio of correlations and cross-loading of indicators [48, 49]. The HTMT method, with a threshold of 0.90, and cross-loadings examination showed that discriminant validity was met for all latent constructs as seen in Table 2, providing a solid foundation for hypothesis testing in the next section.

<table><caption>**Table 1. Reliability and Validity Tests**</caption><thead><tr><th></th><th>Cronbach's Alpha</th><th>Composite Reliability</th><th>Average Variance Extracted (AVE)</th></tr></thead><tbody><tr><td>BEHAVIOUR</td><td>0.794</td><td>0.853</td><td>0.50</td></tr><tr><td>IoMT Cybersecurity Knowledge (IoMTCK)</td><td>0.960</td><td>0.964</td><td>0.57</td></tr><tr><td>IoMT Cybersecurity Risk Awareness (IoMTCRA)</td><td>0.898</td><td>0.936</td><td>0.83</td></tr><tr><td>IoMT Cybersecurity Self-Efficacy (IoMTCSE)</td><td>0.899</td><td>0.937</td><td>0.83</td></tr><tr><td>IoMT Sharing Preference (IoMTSP)</td><td>0.848</td><td>0.904</td><td>0.76</td></tr><tr><td>IoMT Subjective Norms (IoMTSN)</td><td>0.897</td><td>0.935</td><td>0.83</td></tr><tr><td>IoMT Technology Knowledge (IoMTTK)</td><td>0.850</td><td>0.894</td><td>0.63</td></tr><tr><td>IoMT Technology Self-Efficacy (IoMTTSE)</td><td>0.846</td><td>0.908</td><td>0.77</td></tr></tbody></table>

**Assessment of The Structural Model.** The structural model assessment includes the coefficient of determination (R²), the blindfolding-based cross-validated redundancy measure (Q²), and the path coefficient. The R² measures the insample predictive ability, with values of 0.75, 0.50, and 0.25 considered substantial, moderate, or weak, respectively [50]. However, the study context should be considered, as in consumer behaviour disciplines, a measure of 0.20 is considered high [50]. The construct “Behaviour” as seen in Table 3 has an R² of 0.671, which is high in the study context, explaining 67.1% of the variance. Similarly, IoMT Cybersecurity Self-Efficacy (34.5%) and IoMT Technology Self-Efficacy (33.4%) demonstrate predictive ability. Since R² only measures in-sample
<table><caption>**Table 2.** Heterotrait-Monotrait (HTMT) Ratio of Correlations.</caption><thead><tr><th></th><th>BEHAVIOUR</th><th>IoMTCK</th><th>IoMTCRA</th><th>IoMTCS-E</th><th>IoMTSP</th><th>IoMTSN</th><th>IoMTTK</th></tr></thead><tbody><tr><td>BEHAVIOUR</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>IoMTCK</td><td>0.710</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>IoMTCRA</td><td>0.531</td><td>0.641</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>IoMTCSE</td><td>0.851</td><td>0.575</td><td>0.588</td><td></td><td></td><td></td><td></td></tr><tr><td>IoMTSP</td><td>0.463</td><td>0.253</td><td>0.195</td><td>0.396</td><td></td><td></td><td></td></tr><tr><td>IoMTSN</td><td>0.486</td><td>0.239</td><td>0.177</td><td>0.412</td><td>0.440</td><td></td><td></td></tr><tr><td>IoMTTK</td><td>0.681</td><td>0.562</td><td>0.649</td><td>0.664</td><td>0.416</td><td>0.397</td><td></td></tr><tr><td>IoMTTSE</td><td>0.593</td><td>0.425</td><td>0.453</td><td>0.697</td><td>0.307</td><td>0.300</td><td>0.787</td></tr></tbody></table>

predictive ability, (Q²) is used to assess out-of-sample predictive power. With all (Q²) values above 0, Behaviour, IoMTCSE, and IoMTTSE all have predictive relevance.

**Hypotheses Testing.** To test the hypothesised relationships, path coefficients, t-values, and p-values are assessed [40]. The p-value represents the probability that a statistical result occurs by chance [40]. A p-value lower than the significance level (5%) indicates a statistically significant relationship [40]. T-values are also assessed for significance testing [51], with a path coefficient considered significant if the t-value is greater than 1.96 (using a two-tailed t-test with a significance level of 5%) [51]. Table 4 shows the hypotheses tested; nine were not supported of the 14 hypotheses tested. Table 4 shows that IoMT cybersecurity knowledge positively influences IoMT cybersecurity protective behaviour (H1b). On the other hand, we found that IoMT cybersecurity risk awareness (H1a) and IoMT technology knowledge (H1c) do not significantly influence IoMT cybersecurity protective behaviour. Our findings suggest that IoMT cybersecurity self-efficacy (H2 and H3) and IoMT technology self-efficacy (H4) positively affect their respective protective behaviours. Additionally, we found that IoMT subjective norms and information-sharing preferences do not significantly influence IoMT cybersecurity self-efficacy or technology self-efficacy, nor do they have a significant effect on IoMT cybersecurity protective behaviour (H5a, H5b, H6a, H6b, H7a, and H7b), with the p-value being higher than the significance level of 0.05 and t-value lower than 1.96.

<table><caption>**Table 3.** Predictive Measures.</caption><thead><tr><th></th><th>R2</th><th>Q2</th></tr></thead><tbody><tr><td>BEHAVIOUR</td><td>0.671</td><td>0.287</td></tr><tr><td>IoMT Cybersecurity Self-Efficacy (IoMTCSE)</td><td>0.455</td><td>0.345</td></tr><tr><td>IoMT Technology Self-Efficacy (IoMTTSE)</td><td>0.473</td><td>0.334</td></tr></tbody></table>
<table><caption>**Table 4.** Path Coefficient.</caption><thead><tr><th>Hypothesis</th><th>Path</th><th>Path Coefficient</th><th>t-value</th><th>p-value</th><th>Supported</th></tr></thead><tbody><tr><td>H1a</td><td>IoMTCRA → BEHAVIOUR</td><td>-0.063</td><td>0.628</td><td>0.53</td><td>No</td></tr><tr><td>H1b</td><td>IoMTCK → BEHAVIOUR</td><td>0.343</td><td>3.812</td><td>0</td><td>Yes</td></tr><tr><td>H1c</td><td>IoMTTK → BEHAVIOUR</td><td>0.121</td><td>0.85</td><td>0.395</td><td>No</td></tr><tr><td>H2</td><td>IoMTCRA → IoMTCSE</td><td>0.306</td><td>2.365</td><td>0.018</td><td>Yes</td></tr><tr><td>H3</td><td>IoMTCK → IoMTCSE</td><td>0.281</td><td>2.204</td><td>0.028</td><td>Yes</td></tr><tr><td>H4</td><td>IoMTTK → IoMTTSE</td><td>0.672</td><td>7.542</td><td>0</td><td>Yes</td></tr><tr><td>H5a</td><td>IoMTSN → IoMTCSE</td><td>0.193</td><td>1.82</td><td>0.069</td><td>No</td></tr><tr><td>H5b</td><td>IoMTSN → IoMTTSE</td><td>-0.005</td><td>0.05</td><td>0.96</td><td>No</td></tr><tr><td>H6a</td><td>IoMTSP → IoMTCSE</td><td>0.178</td><td>1.635</td><td>0.102</td><td>No</td></tr><tr><td>H6b</td><td>IoMTSP → IoMTTSE</td><td>0.041</td><td>0.331</td><td>0.741</td><td>No</td></tr><tr><td>H7a</td><td>IoMTSN → BEHAVIOUR</td><td>0.096</td><td>1.111</td><td>0.267</td><td>No</td></tr><tr><td>H7b</td><td>IoMTSP → BEHAVIOUR</td><td>0.107</td><td>1.145</td><td>0.252</td><td>No</td></tr><tr><td>H8a</td><td>IoMTCSE → BEHAVIOUR</td><td>0.447</td><td>3.736</td><td>0</td><td>Yes</td></tr><tr><td>H8b</td><td>IoMTTSE → BEHAVIOUR</td><td>-0.013</td><td>0.11</td><td>0.913</td><td>No</td></tr></tbody></table>

# 6 Discussion

The empirical results reveal several insights. A major one is the pronounced influence of IoMT cybersecurity knowledge (IoMTCK) on protective behaviour, aligning with earlier studies [5, 11]. Conversely, IoMT cybersecurity risk awareness (IoMTCRA) did not significantly affect protective behaviour, This divergence might be attributed to the novelty and complexity of IoMT technologies, suggesting that mere awareness of potential threats might not be sufficient for healthcare professionals who may not fully understand these complex systems.

Our study found that IoMTCRA and IoMT technology knowledge (IoMTTK) both positively impact participants' self-efficacy in IoMT cybersecurity, indicating the importance of enhancing healthcare workers' self-efficacy in this context. This shows that healthcare professionals need specific IoMT cybersecurity knowledge rather than just general technological familiarity.

Moreover, the study shows both Information and Behavioural Skills influence South African healthcare workers' attitudes towards IoMT cybersecurity. Self-efficacy positively influenced protective behaviour, suggesting that perceived competence can foster protective behaviour in healthcare cybersecurity. This is consistent with previous studies [11, 32, 52].

Interestingly, no significant relationship was found between motivation and behaviour, particularly IoMT subjective norms (IoMTSN) and information sharing preferences (IoMTSP)'s influence on self-efficacy and protective behaviour corroborating with [11]. This is contrary to previous research that highlighted the role of subjective
norms in shaping cybersecurity behaviour [52]. This highlights professional practices and guidelines in healthcare may influence cybersecurity protective behaviour more than perceived social pressure.

# 7 Conclusion

This study uses the IMB Skills model to explore IoMT cybersecurity-protective behaviour factors among South African healthcare workers. The findings underline the importance of enhancing healthcare workers’ IoMT cybersecurity knowledge and self-efficacy in managing cybersecurity risks. However, subjective norms, information-sharing preferences, and technological knowledge did not significantly affect protective behaviour, necessitating further research.

Our study contributes to research on healthcare cybersecurity protective behaviour and extends the IMB Skills model’s application to IoMT cybersecurity. The findings emphasise enhancing cybersecurity knowledge and self-efficacy beliefs among health-care workers. Targeted training, addressing knowledge gaps, and focusing on individual behaviours can strengthen cybersecurity measures in IoMT usage by healthcare workers.

# References

1. Kotronis, C., et al.: Evaluating internet of medical things (IoMT)-based systems from a human-centric perspective. Internet of Things **8**, 100125 (2019)

2. Alsubaei, F., Abuhussein, A., Shandilya, V., Shiva, S.: IoMT-SAF: internet of medical things security assessment framework. Internet of Things **8**, 100123 (2019)

3. Yaacoub, J.P.A., et al.: Securing internet of medical things systems: limitations, issues and recommendations. Futur. Gener. Comput. Syst. **105**, 581–606 (2020)

4. Alexander, B., Haseeb, S., Baranchuk, A.: Are implanted electronic devices hackable? Trends Cardiovasc. Med. **29**(8), 476–480 (2019)

5. Baranchuk, A., et al.: Cybersecurity for cardiac implantable electronic devices: what should you know? J. Am. Coll. Cardiol. **71**(11), 1284–1288 (2018)

6. Cilliers, L.: Wearable devices in healthcare: privacy and information security issues. Health Inf. Manag. J. **49**(2–3), 150–156 (2020)

7. Evans, M., He, Y., Maglaras, L., Janicke, H.: Heart-is: a novel technique for evaluating human error-related information security incidents. Comput. Secur. **80**, 74–89 (2019)

8. Rubin, A., Ophoff, J.: Investigating adoption factors of wearable technology in health and fitness. In: 2018 Open Innovations Conference (OI), pp. 176–186. IEEE (2018)

9. Agwa-Ejon, J., Pradhan, A.: The impact of technology on the health care services in Gauteng province, South Africa. In: International Association for Management of Technology (IAMOT) Annual Conference (2014)

10. Fisher, W.A., Fisher, J.D., Shuper, P.A.: Social psychology and the fight against aids: an information-motivation-behavioral skills model for the prediction and promotion of health behavior change. In: Advances in Experimental Social Psychology, vol. 50, pp. 105–193. Elsevier (2014)

11. Crossler, R.E., Bélanger, F.: Why would i use location-protective settings on my smartphone? Motivating protective behaviors and the existence of the privacy knowledge-belief gap. Inf. Syst. Res. **30**(3), 995–1006 (2019)
12. Al-Turjman, F., Nawaz, M.H., Ulusar, U.D.: Intelligence in the internet of medical things era: a systematic review of current and future trends. Comput. Commun. **150**, 644–660 (2020)

13. Gatouillat, A., Badr, Y., Massot, B., Sejdić, E.: Internet of medical things: a review of recent contributions dealing with cyber-physical systems in medicine. IEEE Internet of Things J. **5**(5), 3810–3822 (2018)

14. Hatzivasilis, G., Soultatos, O., Ioannidis, S., Verikoukis, C., Demetriou, G., Tsatsoulis, C.: Review of security and privacy for the internet of medical things (IoMT). In: 2019 15th International Conference on Distributed Computing in Sensor Systems (DCOSS), pp. 457–464. IEEE (2019)

15. Putta, S.R., Abuhussein, A., Alsubaei, F., Shiva, S., Atiewi, S.: Security benchmarks for wearable medical things: stakeholders-centric approach. In: Yang, X.-S., Sherratt, S., Dey, N., Joshi, A. (eds.) Fourth International Congress on Information and Communication Technology. AISC, vol. 1027, pp. 405–418. Springer, Singapore (2020). https://doi.org/10.1007/978-981-32-9343-4_32

16. Abraham, M.: Wearable technology: a health-and-care actuary's perspective. Institute and Faculty of Actuaries (2016)

17. Wazid, M., Das, A.K., Rodrigues, J.J., Shetty, S., Park, Y.: IoMT malware detection approaches: analysis and research challenges. IEEE Access **7**, 182459–182476 (2019)

18. Alsubaei, F., Abuhussein, A., Shiva, S.: Security and privacy in the internet of medical things: taxonomy and risk assessment. In: 2017 IEEE 42nd Conference on Local Computer Networks Workshops (LCN Workshops), pp. 112–120. IEEE (2017)

19. Williams, P.A., Woodward, A.J.: Cybersecurity vulnerabilities in medical devices: a complex environment and multifaceted problem. Med. Dev. (Auckland, NZ) **8**, 305 (2015)

20. Koutras, D., Stergiopoulos, G., Dasaklis, T., Kotzanikolaou, P., Glynos, D., Douligeris, C.: Security in IoMT communications: a survey. Sensors **20**(17), 4828 (2020)

21. Arend, I., Shabtai, A., Idan, T., Keinan, R., Bereby-Meyer, Y.: Passive-and notactive-risk tendencies predict cyber security behavior. Comput. Secur. **97**, 101964 (2020)

22. Chowdhury, N.H., Adam, M.T., Teubner, T.: Time pressure in human cybersecurity behavior: theoretical framework and countermeasures. Comput. Secur. **97**, 101931 (2020)

23. Gratian, M., Bandi, S., Cukier, M., Dykstra, J., Ginther, A.: Correlating human traits and cyber security behavior intentions. Comput. Secur. **73**, 345–358 (2018)

24. Puat, H.A.M., Abd Rahman, N.A.: IoMT: a review of pacemaker vulnerabilities and security strategy. In: Journal of Physics: Conference Series, vol. 1712, p. 012009. IOP Publishing (2020)

25. McEvoy, T.R., Kowalski, S.J.: Deriving cyber security risks from human and organizational factors-a socio-technical approach. Complex Syst. Inf. Model. Q. (18), 47–64 (2019)

26. De Bruijn, H., Janssen, M.: Building cybersecurity awareness: the need for evidence-based framing strategies. Gov. Inf. Q. **34**(1), 1–7 (2017)

27. Rizk, D., Rizk, R., Hsu, S.: Applied layered-security model to IoMT. In: 2019 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 227–227. IEEE (2019)

28. Papaioannou, M., et al.: A survey on security threats and countermeasures in internet of medical things (IoMT). Trans. Emerg. Telecommun. Technol. **33**, e4049 (2020)

29. Dai, H.N., Imran, M., Haider, N.: Blockchain-enabled internet of medical things to combat covid-19. IEEE Internet of Things Mag. **3**(3), 52–57 (2020)

30. Webb, T., Dayal, S.: Building the wall: addressing cybersecurity risks in medical devices in the USA and Australia. Comput. Law Secur. Rev. **33**(4), 559–563 (2017)

31. Jones, R.W., Katzis, K.: Cybersecurity and the medical device product development lifecycle. ICIMTH, pp. 76–79 (2017)
32. Fisher, W.A., Fisher, J.D., Harman, J.: The information-motivation-behavioral skills model: a general social psychological approach to understanding and promoting health behavior. Soc. Psychol. Found. Health Illness **22**(4), 82–106 (2003)

33. Crossler, R.E., Bélanger, F.: The mobile privacy-security knowledge gap model: understanding behaviors. *Hawaii International Conference on System Sciences* (2017)

34. Khan, B., Alghathbar, K.S., Khan, M.K.: Information security awareness campaign: an alternate approach. In: Kim, T.-h, Adeli, H., Robles, R.J., Balitanas, M. (eds.) ISA 2011. CCIS, vol. 200, pp. 1–10. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-23141-4_1

35. Scott, J., Ophoff, J.: Investigating the knowledge-behaviour gap in mitigating personal information compromise. In: HAISA, pp. 236–245 (2018)

36. Farooq, A., Jeske, D., Isoaho, J.: Predicting students' security behavior using information-motivation-behavioral skills model. In: Dhillon, G., Karlsson, F., Hedström, K., Zúquete, A. (eds.) ICT Systems Security and Privacy Protection. IFIP Advances in Information and Communication Technology, vol. 562, pp. 238–252. Springer, Heidelberg (2019). https://doi.org/10.1007/978-3-030-22312-0_17

37. Iqbal, J., Soroya, S.H., Mahmood, K.: Financial information security behavior in online banking. Inf. Dev. 0266669221149346 (2023)

38. Bandura, A.: Self-efficacy: toward a unifying theory of behavioral change. Psychol. Rev. **84**(2), 191–215 (1977). https://doi.org/10.1037/0033-295X.84.2.191

39. Joseph, B., Joseph, M.: The health of the healthcare workers. Ind. J. Occup. Environ. Med. **20**(2), 71 (2016)

40. Bhattacharjee, A.: Social science research: principles, methods, and practices (2012)

41. Bulgurcu, B., Cavusoglu, H., Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Q. 523–548 (2010)

42. Büchi, M., Just, N., Latzer, M.: Caring is not enough: the importance of internet skills for online privacy protection. Inf. Commun. Soc. **20**(8), 1261–1278 (2017)

43. Hoque, R., Sorwar, G.: Understanding factors influencing the adoption of mhealth by the elderly: an extension of the UTAUT model. Int. J. Med. Informatics **101**, 75–84 (2017)

44. Hajiheydari, N., Delgosha, M.S., Olya, H.: Scepticism and resistance to IoMT in healthcare: application of behavioural reasoning theory with configurational perspective. Technol. Forecast. Soc. Chang. **169**, 120807 (2021)

45. Wall, J.D., Palvia, P., Lowry, P.B.: Control-related motivations and information security policy compliance: the role of autonomy and efficacy. J. Inf. Priv. Secur. **9**(4), 52–79 (2013). https://doi.org/10.1080/15536548.2013.10845690

46. Hair, J.F., Jr., Howard, M.C., Nitzl, C.: Assessing measurement model quality in PLS-SEM using confirmatory composite analysis. J. Bus. Res. **109**, 101–110 (2020)

47. Hair, J.F., Ringle, C.M., Sarstedt, M.: PLSSEM: indeed a silver bullet journal of marketing theory and practice, **19**(2) 139–152 (2011). https://doi.org/10.2753/MTP1069-6679190202

48. Hair, J.F., Jr., Sarstedt, M., Ringle, C.M., Gudergan, S.P.: Advanced Issues in Partial Least Squares Structural Equation Modeling. Sage Publications, Newbury Park (2017)

49. Hamid, M.R.A., Sami, W., Sidek, M.H.M.: Discriminant validity assessment: use of Fornell & Larcker criterion versus HTMT criterion. J. Phys. Conf. Ser. **890**, 012163 (2017). https://doi.org/10.1088/1742-6596/890/1/012163

50. Hair, J.F., Risher, J.J., Sarstedt, M., Ringle, C.M.: When to use and how to report the results of PLS-SEM. Eur. Bus. Rev. **31**, 2–24 (2019)

51. Wong, K.K.K.: Partial least squares structural equation modeling (PLS-SEM) techniques using SmartPLS. Mark. Bull. **24**(1), 1–32 (2013)

52. Ifinedo, P.: Understanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory. In: Computers and Security, vol. 31, pp. 83–95. Elsevier Ltd. (2012). https://doi.org/10.1016/j.cose.2011.10.007