Abstract: The study of organisations’ information security
cultures has attracted scholars as well as healthcare services industry
to research the topic and find appropriate tools and approaches to
develop a positive culture. The vast majority of studies in Saudi
national health services are on the use of technology to protect and
secure health services information. On the other hand, there is a lack
of research on the role and impact of an organisation’s cultural
dimensions on information security. This research investigated and
analysed the role and impact of cultural dimensions on information
security in Saudi Arabia health service. Hypotheses were tested and
two surveys were carried out in order to collect data and information
from three major hospitals in Saudi Arabia (SA). The first survey
identified the main cultural-dimension problems in SA health
services and developed an initial information security culture
framework model. The second survey evaluated and tested the
developed framework model to test its usefulness, reliability and
applicability. The model is based on human behaviour theory, where
the individual’s attitude is the key element of the individual’s
intention to behave as well as of his or her actual behaviour. The
research identified a set of cultural and sub-cultural dimensions in SA
health information security and services.