Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology

ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

An Examination of Threats and Countermeasures

Relating to Healthcare Cyber Risks: The Case of
Kenyatta National Hospital
Stephen Okongo Ario1; Dr. Jecton T. Anyango2; Jenu John3
1.
MSc. Computer Information Systems Kenya Methodist University (KEMU)
2.
Lecturer, Department of Computer Science KEMU University.
3.
Lecture, KEMU University.

Abstract respondents always verify that the attachment is from a

known and expected source. Knowledge of social
 Background engineering attacks is limited, with only 18% of
Africa has seen an exponential increase in internet respondents aware of these threats and 82% unfamiliar
penetration and ICT affordances since the turn of the with them. Regarding email scams, 51% do not know what
twenty-first century. Healthcare institutions are an email scam is or how to recognize one, underscoring a
scrambling to put in place the appropriate safeguards to need for further training. Finally, while 85% of
protect their patients' data from unauthorized access since respondents believe their computers are not valuable to
the need to protect private information has become hackers, 15% recognize their potential as targets,
critical, particularly for cybercriminals eyeing the data of reflecting differing perceptions of risk and emphasizing
medical patients. This thesis investigates cyber security the need for ongoing cyber security education.
threats and countermeasures in healthcare, with a focus on
Kenyatta National Hospital (KNH). Given Africa's Keywords:- Cyber Threats, Cybercrime, Cyber Security.
increased internet use and the critical need to protect
patient data from cybercriminals, the study explores how I. INTRODUCTION
data protection and cyber security influence healthcare
delivery at the hospital. Sarker et al. (2020) stated that a number of security
incidents, including malware attacks, phishing scams, denial
 Key Objectives of service attacks, malware attacks, unauthorized access, and
To examine cyber threats and countermeasures zero-day attacks, have increased in frequency in recent years
employed by KNH as well as analyzing the impact of due to the growing reliance on digitalization and the Internet
Kenya's Cybercrime Act. of Things (IoT). For instance, the security industry was aware
of fewer than 50 million distinct malware executables in 2010,
 Results but by 2019, that figure had skyrocketed to almost 900 million
The survey at Kenyatta National Hospital shows dangerous executables.
strong cybersecurity measures, with 89% having dedicated
resources and 88% using computers regularly. Regarding Countless economic and social operations are rapidly
the Kenya Cybercrime Act, 74% know how to detect and being digitized as internet technology evolves. Internet
report hacks, though 8% have encountered malware and banking, interactive sites, healthcare networking and data
12% lack basic malware knowledge. 78% have anti-virus storage, smart metering, and corporate platforms are just a few
software, and 63% verify email attachments, while examples of digital data-driven activity. The volume and rate
knowledge of social engineering and email scams is limited, at which digital information is produced and preserved is
revealing a need for further education. The second expanding at a rapid pace. Although most content is
objective looked at the impact of Kenya Cybercrime Act, insignificant, a significant chunk contains salient information
as a local data protection laws on supporting patient- or personally identifiable information (PII) which must be
healthcare system at Kenyatta National Hospital. A safeguarded. Scholars have consented that to keep data
significant majority, 74%, are aware of when their confidential, explicit physical and digital cyber security
computer is hacked or infected and know whom to contact defenses are required (Seemma, Nandhini & Sowamiya,
in such cases. The results also show that 79% of 2018).
respondents have never encountered a virus or trojan on
their computers. When opening email attachments, 63% of

IJISRT24SEP714 www.ijisrt.com 937

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

Turner (2018) asserts that while the Internet has made the and result in physical injury to patients. Strong cyber security
world smaller, it has also made us more aware of viewpoints measures are unquestionably necessary for healthcare
that were previously less varied and challenging. Hacking has companies to preserve the quality of patient care, protect
also quickly gained traction among cybercriminals and patient confidentiality, and preserve the integrity of their
evolved at a similar pace to security. Seemma, Nandhini, and systems (Seemma, Nandhini & Sowamiya, 2018).
Sowamiya (2018) contended that there are many
contradictions and ambiguities surrounding the idea of According to Kahyaogl and Caliyurt (2018), digital
security, which can be understood as a process rather than an technology is becoming more and more important in
end in and of itself. It is the process of maintaining a suitable healthcare, which has enhanced patient care, decreased
level of risk, and an organization cannot be considered safe at expenses, and boosted efficiency. But this reliance on
any point after the most recent confirmation that it is technology has also left healthcare providers open to
complying with its security plan (Rosenzweig, 2013). cyberattacks, which can have serious negative effects on their
finances, legal standing, and reputation in addition to perhaps
Hardware, software, and data that are enabled by the jeopardizing the health and safety of their patients.
internet have taken on the responsibility of protecting cyber
security from cyber-attacks. Cybersecurity is a branch of Kenya, like many other nations, has a lot of cybersecurity
security that aims to ensure data availability, confidentiality, challenges. Organizations in the public and commercial
and integrity (Rohrer & Hom, 2017). Accordingly, McKenna sectors are finding it difficult to stay up to date with the
(2017) agreed that cyberspace is the environment in which changing threat landscape as a result of the increasing
communication over networks of computers takes place, and frequency and sophistication of cyberattacks. The government
that the vast majority of people on the planet are connected to has improved cybersecurity in the nation by taking a number
and interact with every aspect of society, including the of actions. To operate as the primary point of contact for
government, courts, legislators, law enforcement, police cybersecurity issues in the nation, the government established
stations, banks, infrastructure, healthcare, and educational the National Kenya Computer Incident Response Team
institutions in addition to schools and students. Coordination Center (National KE-CIRT/CC) in 2014. The
center is in charge of organizing countermeasures to
Due to the increasing reliance of most areas of modern cyberattacks and giving impacted organizations support and
life on digital networks, cybercrime is becoming a greater information (Renatta, 2020).
threat to both individuals and enterprises. As a result, there is
an annual growth in the amount of data collected and kept At 1800 beds spread across 50 wards, Kenyatta National
electronically, which provides hackers with greater and greater Hospital (KNH) is the largest teaching and referral hospital in
motivation. Increased reliance on online platforms like social East and Central Africa. It also boasts 24 theaters, 22
media, e-commerce, and online banking greatly increases the outpatient clinics, and a sizable ER. It serves 70,000 inpatients
potential entry point into related technical networks, which and 520,000 outpatients annually on average with 4,600 staff
promotes an exponential increase in theft, bribery, and members. It was founded in 1901, and in 1987 it gained some
information fraud. According to GyunNo and Vasarhelyi degree of autonomy as a state corporation. The hospital has its
(2017), cyber security is the protection of systems, networks, own management, as well as medical and support personnel,
and technologies through the use of technology, policies, and and is overseen by a Board of Directors. According to the
processes. It is crucial to remember that information security 2018 Kenyatta National Hospital (KNH) annual report and
and information assurance should be considered when financial statement, the hospital is to be used as a teaching
conceptualizing cyber security. institution by the University of Nairobi under a Memorandum
of Understanding (MoU).
Renatta (2020) states that the idea of cyber security has
drawn interest from all societal stakeholders worldwide. The It was a major role in the regional health sector when it
United States has integrated electronic systems into its was founded in 1901. "To be a world class hospital in the
healthcare delivery system as a result of technological provision of innovative and specialized healthcare," states its
advancements. Patients now receive higher-quality care thanks mission. As stated in its mandate, it is essential to the
to the usage of electronic health records, telemedicine, and healthcare delivery systems in the nation, East Africa, and
other technical innovations. However, as technology has other African countries (Willis, 2015). Referral cases for
become more integrated, cyber threats to healthcare systems specialized healthcare are received by the hospital from both
have increased, raising the risk of data breaches, sensitive domestic and international sources, thanks to its very efficient
information loss, and patient injury. and successful referral system.

Cybersecurity lapses in healthcare systems may result in Alongside hospital specialists, the teaching staff is
the loss of private patient information, interruptions of medical responsible for referrals and consultations under that
care, monetary losses, and harm to the standing of healthcare memorandum of understanding. As the nation's premier
institutions. Cyberattacks can also jeopardize patient safety referral hospital, it accepts patients from all regions of the

IJISRT24SEP714 www.ijisrt.com 938

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

nation; however, the second national referral hospital, located This astounding rise has been attributed to developments
in Eldoret, almost 400 kilometers northwest of Nairobi, serves like the deregulation of markets in the African
the provinces of North Rift, Nyanza, and Western. telecommunications sector, the increased diversity of mobile
Additionally, KNH sees patients from abroad. telecommunications technology, and the increasing prevalence
of broadband bandwidth (Global System for Mobile
Individuals who believe they will receive the greatest Communications Association, 2013). This trend is anticipated
care due to the highest concentration of physicians and to continue in the future (Global System for Mobile
medical specialists as well as the availability of amenities not Communications Association, 2016). However, worries
present in lower-level health facilities are also admitted there; regarding the need to bolster cyber security laws and cyber
these individuals are not referred by other hospitals or integrity across the continent have been raised by the spread of
physicians. As a result, KNH sees so many patients that it is ICTs and Internet usage in Africa. Network and computer
unable to accommodate them all. It takes seven to nine hours system security is a technological consideration. The
on average for a patient who arrives at the casualty/emergency organizational viewpoint is concentrated on creating
unit to be admitted to the Private Wing. Patients passing away institutional capacity to support cyber security, including the
in the waiting room before receiving medical care is not formation of Computer Emergency Response Teams (CERTs)
shocking (Kenyatta National Hospital (KNH) strategic plan, and law enforcement institutions. Policies include laws that
2018–2023). prohibit actions that compromise data availability, integrity,
and protection as well as initiatives to promote international
Kenyatta National Hospital has six thousand workers. collaboration (Gercke, 2016).
The private wing has 209 bedrooms, out of a total of 1800
beds (Abdulla, 1985). Every day, Kenyatta National Hospital Healthcare institutions are scrambling to put in place the
sees between 2000 and 3000 patients. 1157 healthcare appropriate safeguards to protect their patients' data from
professionals work in the hospital, comprising 100 physicians, unauthorized access since the need to protect private
800 nurses, 130 pharmacists, 70 LT, 50 CO, and 5 dentists. information has become critical, particularly for
Two accountants serve in the administrative division (Willis, cybercriminals eyeing the data of medical patients. This is
2015). because there are several examples of cybercrimes in the
healthcare sector that have resulted in unheard-of losses and
Schlosberg (2021) defines cyber-security as a set of harm to reputations. Perhaps the biggest referral hospital in
procedures for protecting computer-related technologies, East Africa, Kenyatta National Hospital manages a lot of data
documents, and systems against unauthorized access, for its patients. There is no denying the necessity of a complex
modification, and destruction by employing tactics that either and efficient cyber security architecture. This is to stop data
lessen the effects of cybercrime or eventually eradicate it breaches, which are incredibly profitable for fraudsters.
completely. Undoubtedly, cybercrimes directed towards the
healthcare industry are on the rise. Numerous hospital records II. METHODOLOGY
are pilfered by hacking, ransomware, and insider threats,
among other techniques (Williams & Woodward, 2015). The present research adopted the use of a mixed method
research approach which brings out the mathematical
Africa has seen an exponential increase in internet inferences like percentages, means, and others as well as the
penetration and ICT affordances since the turn of the twenty- lived experiences of the respondents at the Kenyatta National
first century. Saaleh (2022) reports that Internet usage has Hospital. Furthermore, by using a mixed method, the
increased dramatically in Africa. Over 570 million people on researcher was able to incorporate in-depth interviews, a
the continent used the internet in 2022—a number that had quantitative survey, and both qualitative and quantitative data
more than doubled since 2015. Nigeria, the most populous collection techniques. "Drawing together multiple types of
nation in Africa, has the highest proportion of users. This adds evidence gathered from different sources using different
up to more than 100 million overall, of which 76 million are in methods of data collection" is how Barker (1999) describes a
Egypt and 41 million are in South Africa. Internet connectivity mixed approach (p. 483). Mixed methods improve the
has expanded across Africa in recent years due to "validity of research and its findings," as noted by Ezzy (2013)
advancements in telecommunications architecture and a (p. 38). The population for this study consisted of 6000
growing rate of smartphone usage. As a result of increased employee at Kenyatta National Hospital and a sample of 384
internet connectivity, digital operations and services such as employees were interviewed. A questionnaire was used for
social networking sites, e-commerce, and mobile banking have data collection. Both descriptive and inferential statistics was
grown in popularity. Yet, the continent has not yet fully applied for the research. Ethical approval was done by the
realized its digital capabilities. Despite the growing number of department of library science of the Kenya Methodist
users, the internet penetration rate was approximately 43 University as well as the National Commission for Science
percent. Technology and Innovation (NACOSTI) which is mandated
with the responsibility of protecting human subjects in
research will be sought. All respondents who voluntarily

IJISRT24SEP714 www.ijisrt.com 939

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

accepted to participate were informed of the reason for not handle patient data, suggesting their roles are less directly
conducting this research before being given the questionnaire involved with confidential information. Awareness of
to fill. All participants were also debriefed about the purposes cybersecurity policies is notably high, with 85% of
for the research and the benefits accruing thereof. The debrief respondents reporting that their hospital has established such
form contained information regarding confidentiality and the policies, demonstrating a commitment to formal cybersecurity
anonymity of the participants. measures. However, 12% are unsure whether their hospital has
these policies, indicating a potential gap in communication
III. RESULTS regarding the existence and importance of cybersecurity
protocols.
 Demography
The study achieved a high response rate of 94.8%, with  Impact of Kenya's Cybercrime Act on the Patient-
365 completed questionnaires out of 370 distributed. Healthcare System
Respondents spanned a diverse age range, with the largest A substantial majority of respondents (74%)
group being 41-50 years old (30%), followed by those aged demonstrated a strong awareness of computer security issues,
51-60 years (25%) and 31-40 years (23%). The youngest age knowing when their computers are hacked or infected and
group (21-30 years) accounted for 10%, while 12% were 61 whom to contact. This high level of preparedness indicates
years and older. In terms of gender distribution, 58% of effective training and awareness programs. However, 12% of
respondents were male (210 individuals) and 42% were female respondents knew how to report a hack but lacked recognition
(155 individuals). Educational backgrounds varied, with 47% skills, and 10% had partial understanding, while a small group
holding a Bachelor’s degree, 24% having vocational training, (4%) had neither awareness nor knowledge of response
21% possessing a Master’s degree, 6% having secondary procedures, highlighting a need for further education and
education, and 3% with a PhD. Respondents' positions within readiness enhancement.
their organizations were also diverse: nurses represented the
largest group at 33%, followed by doctors at 18%, Regarding virus or trojan infections, 79% of respondents
administrative personnel at 17%, auxiliary personnel at 13%, reported that their computers had never been infected,
lab personnel at 10%, technical personnel at 7%, and other suggesting robust security measures. However, 8%
roles at 3%. This demographic distribution provides a experienced malware infections, and 12% lacked basic
comprehensive view of the study's participants, highlighting understanding of malware, emphasizing the need for improved
their varied backgrounds and roles within the healthcare training on basic cyber security concepts. In terms of anti-
system. virus software, 78% of respondents had it installed, reflecting
a commitment to maintaining computer security. Yet, 15% did
 Threats and Counter Measures in Healthcare Cyber Risk not have anti-virus software, and 7% were unaware of its
The study on cybersecurity and data protection at status, indicating gaps in essential security measures and the
Kenyatta National Hospital reveals several crucial insights need for better communication.
into the hospital’s approach to managing cyber risks. A
significant majority of respondents (89%) confirmed that their When handling email attachments, 63% of respondents
organizations have either a dedicated cybersecurity department consistently ensured attachments were from known and
or utilize external cybersecurity services, indicating a strong expected sources, showing a cautious approach. However,
commitment to safeguarding digital assets. However, 10% 27% opened attachments from known sources without full
reported the absence of such resources, and 1% were unsure, scrutiny, and 10% exhibited less caution, revealing varying
suggesting potential vulnerabilities and gaps in cybersecurity levels of vigilance and a need for standardized procedures.
strategies. In terms of computer usage, 88% of respondents Awareness of social engineering attacks was low, with only
indicated that they work on computers regularly, reflecting the 18% of respondents understanding these threats. The majority
essential role of digital technology in their professional tasks. (82%) lacked knowledge about social engineering, indicating a
On the other hand, 12% do not use computers, which may be critical area for increased education. Regarding email scams,
indicative of varying job functions within the hospital. 29% of respondents knew what an email scam is and how to
identify one, while 21% understood what scams are but lacked
Regarding data protection training, a substantial 70% of identification skills. Over half (51%) were unfamiliar with
respondents have not received training on the General Data email scams, highlighting a significant knowledge gap that
Protection Regulation (GDPR), highlighting a significant gap needs addressing. Lastly, 85% of respondents believed their
in critical knowledge that could increase vulnerability to data computers were not valuable to hackers, reflecting a general
breaches and regulatory non-compliance. Conversely, 30% of sense of security. However, 15% recognized potential risks,
respondents have received GDPR training, pointing to some suggesting that while most felt secure, there is a need for
level of awareness but also emphasizing the need for broader ongoing education and awareness about the potential threats to
education. The study also found that 75% of respondents have ensure comprehensive cyber security.
access to sensitive patient data, underscoring the importance
of stringent data protection measures. The remaining 25% do

IJISRT24SEP714 www.ijisrt.com 940

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

IV. DISCUSSION cyber security landscape in Kenya and developing countries.

The literature discusses challenges in cyber security adoption
The results from the survey at Kenyatta National in small and medium-sized enterprises and underfunded
Hospital and the literature highlight the importance of cyber healthcare systems, which may not be as evident in the
security measures. The survey shows a strong emphasis on survey’s more focused context (Almutairi et al., 2020;
security with 89% confirming the presence of a dedicated Elshenawy et al., 2021).
cyber security department or external services. Similarly, the
literature emphasizes the importance of robust cyber security Past studies provides detailed insights into specific cyber
frameworks, laws, and standards like the Computer Misuse security threats, such as financial fraud, identity theft, and
and Cybercrimes Act, 2018 (CMCA), and the National Cyber risks to patient safety due to cyber-attacks. It also outlines
security Framework by the Communications Authority of specific measures like using shredders for private data disposal
Kenya (CA) (Communications Authority of Kenya, 2020). and network firewalls. The survey, however, does not provide
detailed information on the specific types of threats
Results also indicates that 70% of respondents have encountered or the particular measures in place at Kenyatta
received GDPR training, demonstrating strong awareness of National Hospital (Weerasinghe et al., 2020).
data protection regulations. This aligns with the literature’s
emphasis on cyber security capacity building, which involves A notable majority (74%) of respondents at Kenyatta
training, awareness-raising, and education programs to National Hospital reported being aware of computer hacks or
enhance cyber security skills and expertise (Choi, Johnson, & infections and knowing whom to contact in such situations.
Lee, 2020; Elshenawy et al., 2021). Both the survey findings This high level of awareness reflects the effectiveness of
and the literature discuss the presence of regulatory training and awareness programs, as emphasized in studies by
frameworks guiding cyber security measures. The survey Choi, Johnson, and Lee (2020) and Kaplan et al. (2019), which
notes established cyber security policies known by 85% of underscore the necessity of investing in cyber security
respondents, while the literature outlines various laws and education and infrastructure. However, the presence of a small
guidelines like KICA, CMCA, and the National ICT Policy proportion (4%) of respondents who lack awareness and
Guidelines, 2020, which aim to protect critical information procedural knowledge highlights a critical gap that can leave
infrastructure and sensitive information (Kenya Information individuals vulnerable during security breaches. This gap
and Communications (Amendment) Act, 2018). aligns with findings by Abdullah et al. (2020) that inadequate
cyber security measures increase the likelihood of data
While literature discusses the significant risks and breaches in developing nations.
financial implications of data breaches in healthcare, such as
financial fraud, information loss, and system intrusions. The The majority of respondents (79%) reported that their
survey underscores the critical role of digital tools in computers have never been infected by a virus or trojan,
healthcare work, with 88% of respondents using computers suggesting effective security measures are in place. This is
regularly, highlighting the necessity for stringent data consistent with the literature indicating that robust cyber
protection measures in healthcare settings (Perakslis, 2014; security practices can significantly reduce the incidence of
Ponemon, 2016). The results from the survey at Kenyatta malware infections (Perakslis, 2014; Kruse et al., 2017).
National Hospital shows a high level of cyber security However, the fact that 8% of respondents have experienced
implementation (89% having cyber security departments or malware infections and 12% are unaware of what a virus or
services), the literature suggests that many healthcare trojan is indicates a need for ongoing vigilance and enhanced
institutions, especially in developing nations, often lag behind education on basic cyber security concepts. These findings
in implementing robust cyber security measures. This mirror the concerns raised by Weerasinghe et al. (2020) about
discrepancy may highlight a specific success at Kenyatta the detrimental impact of compromised patient information on
National Hospital compared to broader trends (Kaplan, healthcare quality. A substantial majority (78%) of
Davidson, Demiris, Schreiber & Waldman, 2019; Kruse, respondents confirmed having anti-virus software installed on
Frederick, Jacobson & Monticone, 2017). their computers, reflecting a strong commitment to
maintaining computer security. This aligns with the
It was also revealed that 12% of respondents are unsure recommendations by Almutairi et al. (2020) on the necessity
about the presence of cyber security policies, and 30% have of implementing cybersecurity measures despite the high
not received GDPR training, suggesting gaps in costs. However, the 15% of respondents without anti-virus
communication and training. The literature, however, tends to software and the 7% who are unsure about its presence
emphasize the existence of comprehensive frameworks and highlight areas for improvement in communication and
guidelines without delving deeply into the gaps in enforcement of security protocols.
implementation or awareness within specific institutions
(Abdullah et al., 2020). This survey provides a focused view
of Kenyatta National Hospital, while the literature
encompasses a broader perspective, including the overall

IJISRT24SEP714 www.ijisrt.com 941

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

The survey revealed that 63% of respondents always REFERENCES

ensure an attachment is from a known and expected source
before opening it, demonstrating a cautious approach towards [1]. Abdullah, A., Alzahrani, A. I., Altameem, A., &
email security. This is crucial in avoiding potential threats Alelyani, S. (2020). Cybersecurity risks and data
such as phishing and malware, as discussed by Elshenawy et protection in healthcare sector: A systematic review.
al. (2021). However, the 10% of respondents who open Journal of Healthcare Engineering, 2020.
attachments without scrutiny and the 27% who rely solely on [2]. Almutairi, S. K., Alharbi, A. A., Aljohani, N. R.,
recognizing the sender indicate varying levels of risk Alharbi, R. M., Almutairi, A. R., & Alzahrani, N. A.
awareness. These findings highlight the need for continued (2020). Factors affecting the adoption of cybersecurity in
education on safe email practices to mitigate cybersecurity healthcare sector in Saudi Arabia. Journal of Healthcare
threats. Engineering, 2020
[3]. Barker, C. (1999). Television, globalization and cultural
The low awareness of social engineering attacks (18%) identities (pp. 84-93). Buckingham: Open University
and email scams (29%) among respondents underscores a Press.
critical gap in understanding these common cyber threats. This [4]. Choi, S. J., Johnson, M. E., & Lee, J. (2020). An event
is consistent with the literature, which points out the need for study of data breaches and hospital IT spending. Health
enhanced training and education on identifying and Policy and Technology, 9(3), 372-378.
responding to such attacks (Almutairi et al., 2020). The [5]. Elshenawy, R., Ahmed, A., Hassanien, A. E., &
significant majority (82% and 51%, respectively) of Elsalamony, H. A. (2021). Patients’ perception of health
respondents who lack awareness about these threats reflect the information privacy and security: An empirical study
broader challenges faced by healthcare institutions in from Egypt. Journal of Medical Systems, 45(1), 1-12.
developing nations, as described by Kaplan et al. (2019). The [6]. Ezzy, D. (2013). Qualitative analysis. London, UK:
belief among 85% of respondents that their computers have no Routledge.
value to hackers indicates a widespread misconception about [7]. Gercke, 2016). Understanding Cybercrime: A Guide For
the potential risks. This perception can lead to complacency Developing Countries. Retrieved from
and a lack of vigilance, as noted by Schmeelk, Dragos, and https://biblioteca.cejamericas.org/bitstream/handle/2015/
Debello (2021). The literature emphasizes that all digital 3697/Understanding_Cybercrime_Developing_Countries
systems, regardless of perceived value, can be targeted by .pdf?sequence=1&isAllowed=y
cybercriminals, necessitating comprehensive cybersecurity [8]. Kahyaoglu, B. & Caliyurt, K. (2018). Cyber security
measures (Ponemon, 2016). assurance process from the internal audit perspective.
Managerial auditing journal, 33(4), 360-376.
V. 5.0 CONCLUSION AND FUTURE [9]. Kaplan, B., Davidson, E. J., Demiris, G., Schreiber, R.,
& Waldman, A. E. (2019). Rethinking health data
The study identified significant threats to healthcare privacy. In Proceedings of the American Medical
cyber risk at Kenyatta National Hospital, including potential Informatics Association Annual Symposium, Washington,
vulnerabilities due to inadequate GDPR training and varying DC.
levels of awareness about social engineering attacks and email [10]. Kenya Information and Communications (Amendment)
scams. Despite having a dedicated cybersecurity department or Act (2018). The Kenya Information And
external services, the findings indicate that gaps in data Communications Act Chapter 411A. Retrieved June 24th
protection protocols and training need to be addressed. 2024 from https://infotradekenya.
Implementing comprehensive training and awareness go.ke/media/Kenya%20Information%20Communications
programs will enhance the hospital's ability to counter cyber %20ACT.pdf
threats effectively. [11]. Kruse, C. S., Frederick, B., Jacobson, T., & Monticone,
D. K. (2017). Cybersecurity in healthcare: A systematic
The Kenya Cybercrime Act has positively impacted the review of modern threats and trends. Technology and
hospital's cybersecurity by improving preparedness and Health Care, 25(1), 1-10.
understanding among staff. The majority of respondents were [12]. McKenna, S. (2017). "The Design Activity Framework:
aware of how to handle cyber incidents and reported effective Investigating the Data Visualization Design Process."
malware protection. However, low awareness of certain cyber PhD diss., The University of Utah, 2017.
threats and varied training effectiveness suggest that while the [13]. Perakslis, E. D. (2014). Cybersecurity in health care. N
Act provides a solid foundation, there is a need for continued Engl J Med, 371(5), 395-397.
efforts to strengthen staff knowledge and preparedness.

IJISRT24SEP714 www.ijisrt.com 942

Volume 9, Issue 9, September – 2024 International Journal of Innovative Science and Research Technology
ISSN No:-2456-2165 https://doi.org/10.38124/ijisrt/IJISRT24SEP714

[14]. Schmeelk, S., Dragos, D., & Debello, J. (2021). What

Can We Learn about Healthcare IT Risk from HITECH?
Risk Lessons Learned from the US HHS OCR Breach
Portal. Retrieved from
https://scholarspace.manoa.hawaii.edu/items/da525b5f-
ddda-4889-ac2f-8317bb8b965b
[15]. Woodward, A., & Williams, P. A. (2015). An
uncomfortable change: Shifting perceptions to establish
pragmatic cyber security. In Recent Advances in
Information and Communication Technology 2015:
Proceedings of the 11th International Conference on
Computing and Information Technology (IC2IT) (pp. 1-
8). Springer International Publishing.

IJISRT24SEP714 www.ijisrt.com 943