Phishing Susceptibility Among Healthcare Employees in Remote and Digitally Mediated Work: A Structured Review of Human and Organizational Risk Factors

Abstract

Healthcare organizations increasingly depend on email, electronic health records, remote-access infrastructure, telemedicine, and distributed digital communication. Phishing exploits this dependence by targeting employee behaviour rather than technical vulnerabilities alone. Expansion of remote work during the COVID-19 period introduced additional risks through increased email traffic, dispersed working environments, personal devices, and reduced access to immediate organizational support. This review synthesized pre-2021 evidence concerning human and organizational determinants of phishing susceptibility relevant to healthcare employees, with particular emphasis on workload, cognitive processing, persuasive message characteristics, habitual email behaviour, security awareness, and organizational training. A structured evidence review was undertaken using peer-reviewed literature published no later than 31 December 2020. Only studies published in first-quartile journals within relevant medical informatics, information systems, cybersecurity, communication, or human-computer interaction categories were considered. Healthcare-specific empirical studies formed the primary evidence base, supplemented by workplace and human-factor studies where the investigated mechanism was directly transferable to healthcare environments. Purely technical phishing-detection studies were excluded. Healthcare evidence demonstrated substantial residual susceptibility. A multicentre analysis of nearly three million simulated emails reported that 14.2% were clicked, although repeated simulation was associated with lower subsequent susceptibility. A separate longitudinal healthcare study found that repeated exposure reduced click rates but additional mandatory training targeted at recurrent clickers produced limited incremental benefit. Behavioural evidence suggested that workload, email volume, automatic processing, authority and urgency cues, contextual relevance, and heuristic decision-making consistently increased vulnerability. Security knowledge alone did not reliably eliminate risky behaviour. Phishing susceptibility in healthcare is better understood as a multilevel socio-technical problem than as an individual knowledge deficit. Effective prevention should combine technical controls, repeated realistic simulation, low-friction reporting mechanisms, workload-sensitive security design, and interventions that disrupt automatic responses to persuasive messages.