Hospital Medical Equipment Data Security Governance: A Grounded Theory Informed Data Lifecycle and Governance Matrix Protocol

Summary

This protocol presents a grounded theory-informed matrix workflow mapping six data lifecycle stages to six governance domains to audit and improve hospital medical equipment data security. Based on evidence, artifacts, and 48 stakeholder interviews across 14 hospitals, it generates heat maps and prioritized actions for iterative governance improvement.

Abstract

This article describes a reproducible governance protocol for hospital medical equipment data security grounded in qualitative evidence. From August to October 2024, we conducted semi-structured interviews with 48 stakeholders across 14 tertiary public hospitals in S City. Transcripts were analyzed using grounded theory procedures (Strauss and Corbin: open, axial, and selective coding), yielding 360 reference points, 149 initial concepts, 39 categories, 27 main categories, and 7 core categories. Building on the National Health Commission of the People's Republic of China's safety and quality management agenda and adopting the SQ (I SPORT) matrix logic as an organizing scaffold, we developed a Medical equipment data security audit and tracking protocol based on grounded theory (M-ATSSPD). The protocol operationalizes a matrix that maps six data lifecycle stages (Acquisition, Transmission, Storage, Sharing, Processing, and Disposal) to six governance domains (Organization and Personnel, Metadata, Compliance and Policies, Monitoring and Audit, Incident Response, and Technical Tooling). It specifies scoring anchors (0-3), evidence mapping rules, and heat map visualization to identify high-risk cells, prioritize corrective actions, and support iterative improvement without vendor dependence. The protocol further defines cell-level ownership and documentation requirements to strengthen cross-departmental coordination, compliance readiness, and incident preparedness, and provides guidance for transferability across public hospital settings.

Introduction

With the acceleration of hospital informatization and the rise of smart healthcare, medical equipment has become increasingly networked and interoperable, making equipment-generated data a core asset for clinical decision-making and hospital operations¹. These data may include personally identifiable information, device operational logs, and diagnostic outputs such as physiological parameters, imaging objects, and treatment records, which are closely linked to patient privacy and care quality². Security incidents involving such data can directly affect patient safety and trust in clinical services³.

Despite growing attention, multiple challenges persist. In Internet of Medical Things (IoMT) environments, external intrusions and unauthorized insider disclosures remain dominant breach patterns⁴. Data integrity can be fragile where devices lack robust validation mechanisms, leaving records vulnerable to tampering that may mislead diagnosis and treatment⁵. Heterogeneous vendor ecosystems and inconsistent security standards complicate secure data exchange across devices and systems⁶. Legacy equipment often operates beyond safe maintenance windows and cannot receive timely security patches⁷. Human factors, including limited security awareness and operational lapses, further elevate organizational vulnerability⁸. Default credentials, unencrypted communications, and weak access control increase the attack surface⁹. Hospitals may also prioritize functionality over security and lack dedicated governance and quality control systems¹⁰. Insufficient cybersecurity investment can further constrain the implementation of systematic safeguards¹¹. Environmental constraints, including electromagnetic interference and 24/7 availability requirements, can limit the feasibility of security interventions in practice¹². Uneven policy enforcement, third-party oversight gaps, insider misconduct, and external attacks may compound the threat landscape¹³.

Prior work proposes regulatory frameworks and technical defenses. Since 2014, the U.S. Food and Drug Administration has treated cybersecurity as a condition for medical-equipment approval, catalyzing security-by-design practices¹⁴. Methodological advances include multi-criteria evaluation using the Analytic Hierarchy Process-Technique for Order Preference by Similarity to an Ideal Solution (AHP-TOPSIS) for device and data risk¹⁵. Attack-probability-based management models have also been developed, building on the Fennigkoh-Smith approach¹⁶. Federated learning with blockchain has been explored to enable secure remote data sharing¹⁷. Lightweight cloud-edge security architectures have been proposed to improve confidentiality and computational efficiency in connected healthcare¹⁸. Optimized classifiers have further been used to enhance detection performance under resource constraints¹⁹. Blockchain-backed maintenance records can strengthen transparency and integrity for imaging devices²⁰. Organizational programs combining policy, continuous education, and awareness training can strengthen threat identification and mitigation²¹. Such programs are most effective when embedded in routine governance and accountability mechanisms rather than implemented as one-time initiatives²².

However, many existing approaches are either technology-centered (e.g., intrusion detection, cryptography, blockchain-enabled exchange) or compliance-centered (e.g., regulatory checklists), and therefore provide limited operational guidance for hospital teams on how to (i) assign cross-department ownership at the level of concrete governance tasks, (ii) anchor maturity judgments to auditable evidence artifacts, and (iii) connect assessment outputs to a repeatable corrective-action cycle²³. M-ATSSPD addresses this operational gap by offering a protocolized governance workflow with three practical advantages over common alternatives. First, instead of treating controls as an unstructured list, it operationalizes a task-by-task accountability structure by assigning ownership at the cell level of a lifecycle-by-domain matrix. Second, rather than relying on opinion-based maturity judgments, it requires each score to be justified by auditable evidence artifacts (e.g., policies, logs, configurations, incident tickets), thereby improving traceability and reproducibility. Third, it translates assessment results into an action-and-verification loop (score, prioritize, remediate, verify, and rescore), enabling governance improvement to be tracked over time rather than asserted as a one-off compliance outcome.

Grounded-theory analysis of semi-structured interviews with stakeholders across tertiary public hospitals synthesized 360 reference points into 149 initial concepts, 39 categories, 27 main categories, and 7 core categories. In line with the National Health Commission of the People's Republic of China's emphasis on strengthening hospital safety and quality management and monitoring²⁴, the protocol adopts an SQ (I-SPORT) safety and quality matrix logic as the organizing scaffold for structuring cross-lifecycle governance and evidence-backed improvement²⁵. On this basis, the M-ATSSPD protocol constructs a 6 × 6 matrix by coupling six data-lifecycle stages (Acquisition, Transmission, Storage, Sharing, Processing, and Disposal) with six governance domains (Organization & Personnel, Metadata, Compliance & Policies, Monitoring & Audit, Incident Response, and Technical Tooling). The protocol specifies an evidence-mapped scoring scheme with explicit 0-3 anchors, heat-map visualization for cell-level prioritization, and ownership/documentation rules to support cross-department coordination and iterative reassessment in public-hospital settings.

The protocol is intended for hospitals operating networked medical equipment and multi-vendor data flows, where relevant stakeholders and evidence artifacts can be accessed for scoring. Settings with limited artifact availability, highly outsourced data pathways, vendor-controlled data pathways, or governance responsibilities dispersed across external entities may require adapting evidence requirements and ownership assignments, and such constraints should be documented explicitly to preserve the interpretability of maturity scores.

Protocol

1. Ethical approval and informed consent procedures

1. Obtain approval from an institutional review board before recruitment.
2. Provide each participant with an information sheet describing study aims, recording procedures, confidentiality protections, and withdrawal rights, and obtain written informed consent before conducting any interview.
3. Record interviews only after receiving explicit permission.
4. Transcribe recordings verbatim and de-identify transcripts by removing names, phone numbers, and site-specific identifiers.
5. Store audio files, transcripts, and consent forms in an access-controlled repository with role-based permissions.
6. Do not collect patient-level clinical data, and conduct all procedures in accordance with the Declaration of Helsinki.

2. Preparation 1 - Scope, team, and evidence artifacts

1. Define the assessment scope by listing included equipment classes, connected systems, and participating departments.
2. Draw an equipment-to-system data flow overview showing data sources, transmission links, storage endpoints, processing nodes, sharing interfaces, and disposal routes.
3. Assemble a cross-functional team including clinical engineering, IT or security, compliance or legal, procurement or tendering, and representative clinical units.
4. Assign responsibilities using a Responsible, Accountable, Consulted, and Informed (RACI) table and record the owner for each governance domain and lifecycle stage.
5. Create an evidence artifact register and define required artifact types A to I: A policies and standard operating procedures; B access control lists and role definitions; C configuration baselines and security settings snapshots; D audit logs and monitoring reports; E network diagrams and data flow documentation; F vendor contracts and service level agreements; G training records and awareness documentation; H incident tickets and post incident reports; I verification reports for corrective actions.
6. Assign a unique ID to each artifact using a fixed format and record metadata. Use the format SITE YYYY ART ### for artifact IDs, and record artifact type, owner, creation date, last update date, and storage location for each ID.
7. Reference Figure 1 to align collection steps with the overall workflow.

3. Preparation 2 - Sources of information

1. Literature retrieval and screening
   1. Search a national academic literature database (see Table of Materials) and record the exact query string used; use the query ("medical equipment" OR "medical device") AND ("data security" OR "information security" OR "cybersecurity") AND ("hospital" OR "healthcare institution").
   2. Search an engineering/technology literature database (see Table of Materials) and record the exact query string used; use the query ("medical equipment" OR "medical device") AND ("data security" OR "cybersecurity" OR "information security") AND (hospital OR healthcare).
   3. Restrict the publication window to 2018-08-01 to 2024-08-01 and record the restriction in a search log.
   4. Specify language restrictions explicitly and record "none" if no restriction is applied.
   5. Include peer-reviewed journal articles and conference papers, and exclude editorials, news items, patents, and non-scholarly commentary.
   6. Export all retrieved records in a standard citation format and remove duplicates using reference-management software (see Table of Materials).
   7. Archive the search log, exported records, and the deduplication log in the audit repository.
   8. Screen titles and abstracts for relevance, then screen full texts using predefined inclusion criteria.
      1. Include studies that address hospital contexts, medical equipment or device data flows, and data-security governance, controls, or assessment approaches; exclude studies that do not address medical equipment or device data or do not provide actionable governance or control information.
   9. Perform screening independently by two reviewers and resolve disagreements by consensus discussion.
   10. Record inclusion decisions and reasons for exclusion in a screening table.
2. Methodological quality assessment during dual-review screening
   1. Apply the Mixed Methods Appraisal Tool (MMAT) to mixed-methods studies and apply the Critical Appraisal Skills Programme (CASP) qualitative checklist to qualitative-only studies; archive completed appraisal forms as screening evidence.
   2. Define an inclusion threshold before appraisal and document the threshold rule as meeting all critical items and at least 70% of total items.
   3. Appraise each eligible full text independently by two reviewers, record item-level judgments, and resolve appraisal disagreements by consensus or third-reviewer adjudication; archive the final appraisal table.

4. Recruitment and data collection

1. Recruit stakeholders from 14 tertiary Grade-A hospitals in S City during 2024-08 to 2024-10 and document inclusion criteria for each role group.
2. Begin recruitment with 36 participants and expand recruitment until 48 participants are reached or until saturation criteria are met.
3. Define target role composition and document achieved composition, including hospital administrators with governance responsibilities, clinical engineers responsible for device deployment and maintenance, information technology personnel responsible for systems and infrastructure, and cybersecurity or information-security personnel responsible for monitoring, audit, and incident response.
4. Index each participant with a unique participant ID and store a participant metadata table separately from transcript content.

5. Literature content analysis

1. Import included publications into qualitative analysis software (see Table of Materials) and create a project file with a predefined folder structure (e.g., separate folders for included studies, codebook, memos, and exports).
2. Create an initial codebook aligned to the study aim and define each code using four required elements: a code definition, inclusion criteria, exclusion criteria, and an exemplar quote or excerpt²⁶.
3. Code each document line-by-line by assigning codes to text segments and write an analytic memo after coding each document.
4. Export a codebook report, a coded-segments report, and a memo log using the software's export/report function, and archive exported files with version numbers.

6. Semi-structured interviews

1. Draft a semi-structured interview guide and ensure coverage of governance roles, data-lifecycle practices, evidence artifacts, incident handling, and vendor constraints.
2. Pilot the interview guide and revise ambiguous questions for clarity and coverage.
3. Conduct each interview for 30-60 min and record audio with permission.
4. Transcribe each interview verbatim within 72 h and de-identify sensitive information using standardized tags.
5. Assign each transcript a unique transcript ID and record metadata, including role, department, interview date, and interviewer ID.
6. Archive transcripts, field notes, and consent forms in the audit repository.

7. Grounded-theory coding (Strauss - Corbin)

1. Declare the analytic orientation before coding and document it in a coding memo; conduct primarily inductive coding, and record any sensitizing concepts used as prompts, including whether a concept influenced code naming or category grouping²⁷.
2. Calibrate coders and document disagreement resolution by having two coders independently code the same initial subset of transcripts, comparing codes unit-by-unit, and resolving disagreements using a documented rule that specifies retain, merge, or split actions; record all decisions in a decision log and update the codebook version after each adjudication cycle.
3. Perform open coding.
   1. Conduct line-by-line open coding and assign short labels to meaning units.
   2. Attach at least one coded excerpt and one memo entry to each emerging category.
4. Perform axial coding.
   1. Group open codes into categories by specifying conditions, actions or interactions, and consequences.
   2. Define properties and dimensions for each category and record them in a category table.
   3. Generate a relationship diagram linking categories and archive the diagram.
5. Perform selective coding.
   1. Identify a core category that integrates the category system.
   2. Write explicit relational statements linking subcategories to the core category.
   3. Compile an analytic trace package including coded excerpts, memos, diagrams, and the final version of the codebook.
6. Apply constant comparison and define the stopping rule by comparing new transcripts with previously coded transcripts to refine codes and categories; stop adding new categories when two consecutive coding cycles produce no materially new codes and no changes to category properties or dimensions.
7. Calculate inter-coder agreement.
   1. Export coder-by-coder coding comparison data for the calibration subset and format it as a binary agreement table by coding unit; define each coding unit as "agree = 1" when both coders assign the same code to the same unit and "disagree = 0" otherwise.
   2. Calculate Cohen's κ using statistical software (see Table of Materials), archive the script, software output, and the final agreement table in the audit repository, and calculate a 95% confidence interval for κ using a bootstrap procedure (e.g., 1,000 resamples of coding units); report κ with the unit of analysis, the number of coded units, and the confidence interval²⁸.

8. Theoretical saturation test

1. Sample nine senior directors for confirmatory interviews and record eligibility criteria, including directors from the Hospital Administration Office, Medical Engineering, and Information.
2. Re-code saturation-test transcripts against the stabilized codebook.
3. Judge saturation by the presence or absence of new codes or categories across all saturation-test transcripts.
4. Extend sampling and refine theory only if novel concepts appear; otherwise confirm saturation.

9. Construct the SQ (M-ATSSPD) matrix

1. Define six lifecycle stages as Acquisition, Transmission, Storage, Sharing, Processing, and Disposal.
2. Define six governance domains and record an operational definition for each domain²⁹.
3. Map observable indicators and required evidence artifacts to each 6 × 6 cell.
4. Anchor cell scoring at 0-3 and document maturity anchors in a scoring manual.
   1. Define score 0 as missing with no acceptable evidence.
   2. Define score 1 as partial with incomplete evidence or inconsistent execution.
   3. Define score 2 as adequate with complete evidence and routine execution.
   4. Define score 3 as optimized with complete evidence, continuous monitoring, and verified improvement.
5. Weight indicators where regulation or risk impact warrants and record rationales in a weighting table.

10. Heat-map visualization and prioritization

1. Aggregate indicator scores to a single cell score using a documented formula and record the formula in the matrix workbook.
2. Implement cell-score aggregation as a weighted mean of indicator scores using spreadsheet software (see Table of Materials) and store the formula in the score sheet.
3. Generate a red-yellow-green heat map using spreadsheet software (see Table of Materials) with conditional-formatting rules and record key settings.
   1. Set the threshold rule as red for scores from 0.0 to 1.0, yellow for scores greater than 1.0 and up to 2.0, and green for scores greater than 2.0 and up to 3.0; apply the same thresholds across all cells and disable per-row normalization to preserve absolute comparability.
   2. Record the exact conditional-formatting rule set by exporting the formatting configuration or by capturing a versioned screenshot and archiving it with the workbook.
4. Assign an owner, a deadline, a verification metric, and a closure-evidence requirement to each prioritized cell and record decisions in an action register.
5. Integrate the heat-map review into routine governance meetings and update the action register after each cycle.

11. Retrospective incident analysis and verification (Hospital S, 3-year window)

1. Extract information-security incident records for the previous 3 years and assign a unique incident ID to each record.
2. Code each incident against the matrix and record supporting evidence for each coded incident.
3. Quantify incident distribution by lifecycle stage and governance domain, and compute 95% confidence intervals using a prespecified method in statistical software (see Table of Materials).
   1. Compute confidence intervals for proportions using the Wilson method and archive the script and outputs.
4. Cross-check attributions using a layered Swiss-cheese analysis and classify contributing factors into operational, technical, and management layers.
5. Initiate a cross-department quality control circle project and define QCC as Quality Control Circle at first use.
6. Perform root-cause analysis on high-frequency vulnerabilities and standardize countermeasures for replication and scale-up.
7. Measure pre- and post-verification using predefined metrics, a defined timeframe, and a prespecified statistical comparison method.
   1. Define the pre-period as the baseline quarter immediately before implementation, and define the post-period as the quarter immediately after implementation.
   2. Measure outcome metric A as incident rate per quarter and compare pre versus post using a two-proportion test.
   3. Measure outcome metric B as median time to revoke access after staff offboarding and compare pre versus post using the Mann-Whitney U test.
   4. Measure outcome metric C as patch compliance within 30 days and compare pre versus post using a two-proportion test.
   5. Record metric definitions, data sources, comparison results, and supporting artifacts in the action register.
8. Collect stakeholder feedback on feasibility and usability during governance meetings and record protocol modifications triggered by feedback.

12. Translate matrix outputs into controls and priority rules

1. Build a matrix-based control tool sheet covering all 6 × 6 cells and score baseline status with attached evidence artifacts.
2. Compute priority using Priority = (3 − Cell Score) × Risk Weight × (1 + Incident Frequency), record the full formula in the control tool sheet, and lock the calculation cells to prevent accidental edits.
3. Apply boundary rules to prevent misleading rankings in the priority list.
   1. Set Priority = 0 when Cell Score = 3 regardless of Risk Weight or Incident Frequency.
   2. Cap Incident Frequency at a maximum value of 3 when incident counts are highly skewed, and record the cap rule and rationale in the control tool sheet.
4. Assign ownership to each prioritized cell and document execution authority.
   1. Assign a single owner when implementation falls within one department's authority and record the accountable role, deadline, and verification metric in the action register.
   2. Assign co-ownership only when remediation requires shared authority across departments and record a named escalation path, a decision deadline, and a conflict-resolution rule in the action register.
5. Enforce access minimization and role-based rules for the Sharing stage and record the permission model used.
   1. Define permitted roles, permitted data elements, permitted destinations, and time-bounded access conditions in an access rule table.
   2. Attach evidence artifacts supporting enforcement (e.g., access-control lists, approval records, or audit logs) to the relevant Sharing-related cells and record the evidence artifact IDs in the action register.
6. Formalize third-party agreements and lawful bases for data processing and document the compliance basis used.
   1. Record data-processing purposes, data categories, retention periods, and security obligations in third-party agreements.
   2. Attach signed agreements and compliance review records as evidence artifacts for relevant Sharing- and Processing-related cells and record the evidence artifact IDs in the action register.
7. Deploy behavior analytics for anomalous access and record detection rules and escalation criteria.
   1. Define at least three detection rules (e.g., abnormal access volume, access outside duty hours, repeated export attempts) and record alert thresholds and review frequency.
   2. Define an escalation workflow including notification roles, response timelines, and required evidence for closure (e.g., ticket record, log excerpt), and record closure criteria in the action register.
8. Apply DICOM de-identification for research or exchange workflows and define DICOM as Digital Imaging and Communications in Medicine at first use.
   1. Define de-identification fields and suppression rules in a de-identification checklist.
   2. Verify de-identification by sampling exported files and confirming that predefined identifiers are removed or replaced; archive verification outputs as evidence artifacts and record their IDs.
9. Record de-identification rules, verification evidence, and release approvals for each exchange event.
   1. Assign a unique exchange-event ID, record requester role, purpose, dataset scope, and destination, and attach the approval record.
   2. Attach the verification record and the release log to the corresponding Sharing cell in the action register and record the exchange-event ID.

13. Documentation and versioning

1. Archive transcripts, codebooks, matrices, heat maps, scripts, and action logs in a secure, access-controlled repository with role-based permissions.
2. Version all artifacts and maintain audit trails for code changes, weighting updates, and score revisions.
3. Schedule reassessment every 6-12 months or after significant system changes and report updates to governance committees.
4. End the protocol by issuing a versioned M-ATSSPD assessment package including the final matrix, heat map, action register, verification records, the expert-elicitation table (if used), and the analytic trace package.

Results

Guided by grounded theory, evidence from the screened literature and the interview corpus was synthesized to derive a model of factors influencing hospital medical-equipment data security. Three-level coding (open, axial, and selective) was performed, and the analytic workflow is summarized below³⁰.

Open coding
Source texts were examined line by line, retaining verbatim phrasing to preserve meaning and context. Meaning units were coded into sub-node...

Discussion

This protocol operationalizes hospital medical-equipment data-security governance as a traceable, evidence-based workflow linking grounded theory outputs to a 6 × 6 maturity matrix and an action-and-verification loop. The SQ (M-ATSSPD) matrix was derived by integrating interview and literature evidence into stable categories and translating them into lifecycle stages (Acquisition, Transmission, Storage, Sharing, Processing, and Disposal) and governance domains (Organization and Personnel, Metadata, Compliance and Po...

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
Qualitative analysis software (MAXQDA 24)	VERBI Software GmbH (Berlin, Germany)	N/A (License-based; order/serial in invoice)	Used for literature content analysis and coding; export codebook/coded segments/memos and archive with version numbers.
Statistical computing software (R v4.3.2)	R Foundation for Statistical Computing (Vienna, Austria)	N/A (Open-source)	Used for Cohen’s κ, Wilson CI, and statistical comparisons; archive scripts and outputs.
R package “irr” (κ calculation)	Comprehensive R Archive Network (CRAN)	N/A (Open-source)	Used for Cohen’s κ (e.g., kappa2); record package version used.
Spreadsheet software (Microsoft Excel / Microsoft 365 Excel)	Microsoft Corporation (Redmond, WA, USA)	N/A (License-based)	Used for weighted scoring formulas and conditional-format heat map; archive workbook and rule settings.
Reference-management software (choose one: EndNote or Zotero)	Clarivate (EndNote) / Zotero	N/A (License-based/Open-source)	Used for exporting citations and deduplication; archive deduplication log.
China National Knowledge Infrastructure (CNKI)	CNKI (Tsinghua Tongfang)	N/A (Online subscription)	Literature retrieval database; record exact query, filters, and export format in search log.
IEEE Xplore	IEEE	N/A (Online subscription)	Literature retrieval database; record exact query, filters, and export format in search log.
Mixed Methods Appraisal Tool (MMAT, 2018)	MMAT authors (Hong et al.)	N/A	Quality appraisal tool for mixed-methods studies; archive completed appraisal table.
CASP Qualitative Checklist (latest version used)	Critical Appraisal Skills Programme (CASP)	N/A	Quality appraisal checklist for qualitative-only studies; archive completed appraisal table.
Secure, access-controlled repository (encrypted storage)	Institutional IT / compliant cloud / on-prem	N/A	Store audio, transcripts, consent forms, scripts, matrices, heat maps, and audit trails with role-based permissions.
Audio recorder (digital recorder or smartphone)	Any equivalent	N/A	Record interviews with permission; model optional if a specific device was used.
Computer workstation	Any equivalent	N/A	Used for coding, scoring, analysis, and archiving.
Transcription tool/workflow	Any equivalent	N/A	Verbatim transcription + de-identification; keep workflow secure.
De-identification tag template	Self-prepared	N/A	Standard tags for removing identifiers in transcripts.
Participant information sheet + consent form	Self-prepared	N/A	Required for informed consent and confidentiality protections.
Screening table template	Self-prepared	N/A	Record inclusion/exclusion decisions and reasons.
Evidence artifact register	Self-prepared	N/A	Register artifacts (A–I) with IDs =, owners, dates, and locations.
Matrix workbook template (6 × 6)	Self-prepared (spreadsheet)	N/A	Contains indicators, weights, formulas, cell scores, and documentation fields.
Heat-map rule set documentation	Self-prepared (export/screenshot)	N/A	Store conditional-format thresholds and absolute comparability settings.
Action register template	Self-prepared	N/A	Record prioritized cells, owners, deadlines, verification metrics, and closure evidence.
Coding decision log + versioned codebook	Self-prepared / exported	N/A	Record retain/merge/split decisions and codebook versioning after adjudication.
Analytic trace package	Self-prepared / exported	N/A	Coded excerpts, memos, diagrams enabling traceable grounded-theory transparency.