Experts Rank IT Infrastructure and Multi-Factor Authentication as Top Healthcare Data Security Priorities

Healthcare organizations under pressure to secure sensitive patient data now have a ranked roadmap for where to spend their limited resources first. A new study in BMC Health Services Research applied fuzzy multi-criteria decision-making methods to prioritize data security strategies, and its results point clearly to technical infrastructure, multi-factor authentication, and dedicated legal regulation of health data as the leading interventions. The research team, led by Yaşar Gökalp, Serkan Eti, and Axel Kaehne, consulted ten experts drawn from hospital administration, academia, and information technology.

To qualify, each expert needed at least ten years of decision-making experience in health informatics, ensuring that the judgments fed into the model came from professionals with real authority over security investments. Methodologically, the study combined two decision-analysis techniques: the Simple Weight Calculation (SIWEC) method, used to establish the relative importance of criteria, and the Measurement of Alternatives and Ranking according to Compromise Solution (MARCOS) method, used to rank candidate strategies. According to the authors, this combination marks the first-ever integration of SIWEC, MARCOS, and Euclidean expert weighting within a Fermatean fuzzy environment, and the first application of that integration in the healthcare field.

The analysis produced a clear verdict on which factors matter most. IT infrastructure emerged as the single most critical determinant of healthcare data security, receiving a weighting score of 0.203 — ahead of all other criteria evaluated. Among the specific strategies assessed, multi-factor authentication ranked highest, with a weight of 0.8596.

For healthcare managers, the ranking implies that authentication upgrades should precede many other security expenditures. The second-ranked strategy was the scope of specific legal regulations for health data, weighted at 0.8004. The authors frame the study as practical guidance rather than abstract theory.

In healthcare organizations where resources are scarce and must be managed effectively, the prioritized ranking is intended to determine where available budgets should be directed first. The study's contribution is also methodological. As with any expert-based model, the rankings reflect the judgments of the ten participating professionals rather than measured breach outcomes, and the authors note the approach is designed to be context-sensitive.

Even so, the message for health systems is direct: strengthen the IT foundation, deploy multi-factor authentication, and push for health-specific legal protections — in that order.

Subject of Research: Prioritizing data security strategies in healthcare organizations using fuzzy multi-criteria decision-making

Article Title: Developing priority strategies for ensuring data security: the case of healthcare services

Article References: Gökalp, Y., Eti, S., & Kaehne, A. (2026). Developing priority strategies for ensuring data security: the case of healthcare services. BMC Health Services Research. https://doi.org/10.1186/s12913-026-15343-y

Image Credits: AI Generated

DOI: 10.1186/s12913-026-15343-y

Keywords: healthcare data security, multi-criteria decision-making, Fermatean fuzzy numbers, MARCOS, SIWEC, multi-factor authentication, IT infrastructure, health informatics, expert weighting, data governance, health data regulation, Developing