Design and Implementation of Tabletop Cybersecurity Simulation for Health Informatics Graduate Students

Abstract

Background Experiential learning through simulation allows students to apply didactic knowledge to real-world situations. Tabletop simulation allows for the exploration of a variety of topics, including cybersecurity in health care. Due to its low frequency, yet high-risk nature, simulation is a perfect educational modality to practice responding to a cybersecurity attack. As such, the authors designed and executed a tabletop cybersecurity simulation consisting of a prebriefing, four rounds of injects detailing potential cybersecurity breaches that students must address, and structured debriefings that included input from cybersecurity content experts. This simulation was performed in 2018, 2019, 2022, and 2023, during graduate Health Informatics (HI) students' residential visits.

Objective The simulation allowed opportunities for HI students to apply knowledge of cybersecurity principles to an unfolding tabletop simulation containing injects of scenarios they may encounter in the real world.

Methods Survey data were used to assess the students' perceptions of the simulation. Topics assessed included overall satisfaction, teamwork and communication, and length of the event. Additionally, in 2022 and 2023, data were collected on psychological safety and whether to include them in future HI residential visits.

Results Eighty-eight graduate HI students took part in the cybersecurity simulation over four annual residential visits. Most students were satisfied with the event, found it valuable, and could see it impacting their future practice as informaticists. Additionally, students indicated high levels of psychological safety. Multiple students requested that additional simulations be incorporated into the curriculum.

Conclusion A tabletop cybersecurity simulation was utilized to allow HI students the ability to apply knowledge related to cybersecurity breaches to real-world examples. The simulation's best practices of prebriefing, psychological safety, and structured debriefing with expert feedback were emphasized in the simulation's design and implementation. Students found the simulation valuable and worth including in the curriculum.

Keywords

informatics education - cybersecurity - simulation - health care

Protection of Human Subjects

The HI on-site visit survey is conducted as part of ongoing program quality improvement efforts and therefore exempt from institutional review board approval.

The standard simulation survey is classified by the University of Alabama at Birmingham Institutional Review Board as exempt (approval no.: IRB-120822005).

Publication History

Received: 30 May 2024

Accepted: 13 August 2024

Article published online:
06 November 2024

• References

• 1 Alhuwail D, Al-Jafar E, Abdulsalam Y, AlDuaij S. Information security awareness and behaviors of health care professionals at public health care facilities. Appl Clin Inform 2021; 12 (04) 924-932
• 2 Niki O, Saira G, Arvind S, Mike D. Cyber-attacks are a permanent and substantial threat to health systems: education must reflect that. Digit Health 2022; 8: 20 552076221104665
• 3 Alanazi A, Nicholson N, Thomas S. The use of simulation training to improve knowledge, Skills, and confidence among healthcare students: a systematic review. Internet J Allied Health Sci Pract 2017; 15: Article 2
• 4 Kolb D, Boyatzis R, Mainemelis C. Perspectives on Thinking, Learning, and Cognitive Styles. (Sternberg RJ, Zhang L-F, eds.). Routledge; 2014
• 5 Downing D, Chang TP, Robertson JM. et al. Healthcare Simulation Dictionary. 2nd ed.. (Lioce L, Lopreiato J, eds.). Agency for Healthcare Research and Quality; 2020
• 6 Choi J, Bove LA, Tarte V, Choi WJ. Impact of simulated electronic health records on informatics competency of students in informatics course. Healthc Inform Res 2021; 27 (01) 67-72
• 7 Chan KG, Pawi S, Ong MF, Kowitlawakul Y, Goy SC. Simulated electronic health documentation: A cross-sectional exploration of factors influencing nursing students' intention to use. Nurse Educ Pract 2020; 48: 102864
• 8 Everett-Thomas R, Joseph L, Trujillo G. Using virtual simulation and electronic health records to assess student nurses' documentation and critical thinking skills. Nurse Educ Today 2021; 99: 104770
• 9 Repsha C, Morse B, Lee SE, Katz J, Burrows E, Teates J. Use of a simulated electronic health record to support nursing student informatics knowledge and skills. CIN: Computers, Informatics. Comput Inform Nurs 2020; 38 (02) 55-59
• 10 Winters DM, McDonald JK, Hansen DL. et al. The Playable Case Study: an Online Simulation for Skill and Attitudinal Learning. Faculty Publications; 2020
• 11 Karagiannis S, Magkos E. Engaging students in basic cybersecurity concepts using digital game-based learning: computer games as virtual learning environments. In Advances in Core Computer Science-based Technologies. 2021: 55-81
• 12 Scherb C, Heitz LB, Grimberg F, Grieder H, Maurer M. A cyber attack simulation for teaching cybersecurity. Paper presented at: Society 5.0 Integrating Digital World and Real World to Solve Challenges in Business and Society; June 2023.
• 13 Maggio LA, Dameff C, Kanter SL, Woods B, Tully J. Cybersecurity challenges and the academic health center: an interactive tabletop simulation for executives. Acad Med 2021; 96 (06) 850-853
• 14 Joint Cybersecurity Advisory. Ransomware activity targeting the healthcare and public health sector. 2020. Accessed April 1, 2024 at: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
• 15 Alder S. IBM: Average Cost of a Healthcare Data Breach Increases to Almost $11 Million. The HIPAA Journal. Accessed April 1, 2024 at: The updated url for question 13 is: https://www.hipaajournal.com/2023-cost-healthcare-data-breach/
• 16 Decker S, Alinier G, Crawford SB, Gordon RM, Jenkins D, Wilson C. Healthcare Simulation Standards of Best Practice™: the debriefing process. Clin Simul Nurs 2021; 58: 27-32
• 17 McDermott DS, Ludlow J, Horsley E, Meakim C. Healthcare Simulation Standards of Best Practice™: Prebriefing: preparation and briefing. Clin Simul Nurs 2021; 58: 9-13
• 18 Valenta AL, Berner ES, Boren SA. et al. AMIA Board White Paper: AMIA 2017 core competencies for applied health informatics education at the master's degree level. J Am Med Inform Assoc 2018; 25 (12) 1657-1668
• 19 Watts PI, McDermott DS, Alinier G. et al. Healthcare simulation standards of best practice™: simulation design. Clin Simul Nurs 2021; 58: 14-21
• 20 Brophy J. Developing students' appreciation for what is taught in school. Educ Psychol 2008; 43 (03) 132-141
• 21 Grimm P. Social desirability bias. In: Wiley International Encyclopedia of Marketing. Wiley; 2010