Treffer: Exploring information security compliant behaviors in healthcare Knowledge Process Outsourcing (KPOs).

Background: The healthcare industry increasingly relies on Knowledge Process Outsourcing (KPO) to manage vast amounts of sensitive patient data. Ensuring information security compliance is critical to protecting patient privacy and maintaining data integrity. This study aims to explore the current state of information security compliance in healthcare KPOs and the factors influencing it.
Methods: A quantitative approach was employed to analyze existing security policies in healthcare KPOs. Key aspects investigated include employee training, technological measures, regulatory adherence, and organizational culture. Statistical analyses were used to evaluate the relationships between these factors and their impact on compliance.
Results: The study revealed significant gaps in security practices and compliance levels among healthcare KPOs. Employee training and organizational culture were identified as pivotal in mitigating security risks, while technology and regulatory adherence played supporting roles. The findings also highlighted best practices to enhance security compliance.
Practical Contribution: This study provides actionable insights for healthcare KPOs, IT security leaders, and policymakers. The results emphasize that investing in security awareness training, promoting HIS adoption, and integrating AI-driven security frameworks will be more effective than merely imposing regulations. Organizations should focus on continuous employee education, AI-powered anomaly detection, and blockchain-enhanced EHR systems to strengthen security compliance. The study's findings serve as a roadmap for designing security policies that align with real-world operational challenges in the healthcare outsourcing sector.
Conclusions: This research provides actionable insights for KPO leaders, healthcare providers, and policymakers to strengthen information security compliance in healthcare KPOs. By addressing critical vulnerabilities and fostering a culture of security, the study contributes to safeguarding sensitive patient data amid evolving threats and regulations.
Trial Registration: Not applicable.
(© 2025. The Author(s).)

Declarations. Ethics approval and consent to participate: The authors confirm that all experiments were performed in accordance with relevant guidelines and regulations. The need for ethics approval and informed consent is deemed unnecessary according to national regulations: Sri Lanka National Policy on Health Information Sect. 4/ 2017, Sect. 4.1/ 2017 (Data/Information Security, Client Privacy, Confidentiality and Ethics) and Sect. 4.2/ 2017 (Data and information security for client data protection). Nevertheless, the study prioritized the issue of consent. all participants provided informed consent prior to their participation in the survey. The consent form explained the purpose of the survey, procedures involved, potential risks and benefits, confidentiality measures, and the right to withdraw from the survey at any time. Participants were also informed that their data would be kept confidential and used only for research purposes. Consent for publication: Not applicable. Competing interests: The authors declare no competing interests.