Privacy disclosure [1] refers to the release, transfer, access, or disclosure of information in any way to an individual or group outside of the entity holding the information. According to a Verizon data disclosure survey, the medical industry is the only industry with an internal threat higher than an external threat, considering that a significant number of medical data leaks are associated with internal medical staff [2]. The high incidence of medical data [3-5] and patient information leakages may cause patient identity violations [6] and financial losses [7], alongside potentially more severe social effects. Currently, in China, organizations at all levels regulate the privacy protection behavior of medical staff by publishing relevant policies and setting privacy protection requirements for medical staff [8-10]. Generally, hospitals also have privacy disclosure restrictions medical practitioners must adhere to for patient privacy protection. However, even with multiple patient privacy protection requirements, the leakage of patient privacy remains frequent. Unfortunately, as those with direct contact with medical information, the negligence or improper behavior of doctors has become 1 of the primary reasons for this [11,12]. Therefore, it is vital to study doctors' privacy protection behavior in the hospital setting. Public medical institutions, which are government interventions in the medical market, are of universal significance worldwide. They provide inexpensive welfare services for the public rather than high-priced private medical services. Current studies focus on the primary influencing factors affecting doctors' motivation to comply with data protection [13], the influencing factors of electronic medical record (EMR) privacy protection by doctors [7], and the reaction mechanism of doctors toward patients' privacy protection requirements [14]. Furthermore, personal factors, including age, gender, educational background, professional title, working years, position, and understanding of laws and regulations [15,16], alongside environmental factors, such as a strict patient privacy protection system, systematic training, sufficient materials for patient privacy protection, and demonstrations by managers [17], all had an impact on doctors' privacy protection behavior toward patients. Currently, research into the privacy protection behavior of doctors, including the factors that influence behavior and intention, remains insufficient. Similarly, a theoretical basis and measurement scale of patient privacy protection behavior of doctors in public medical institutions in China are yet to be formed.

Consequently, this study aims to use the method of grounded theory to construct a theoretical model framework of the patient privacy protection behavior of doctors in public medical institutions in China. The measurement items of each variable were defined in combination with the results of coding analysis. The measurement scale was created, and the data were analyzed by exploratory factor analysis (EFA) and confirmatory factor analysis (CFA).

Noar [18] proposed that the selection of a theoretical framework requires comparisons of multiple theoretical frameworks. The theory of planned behavior [13,19], protection motivation theory (PMT) [20], and the Health Belief Model [7] are often included in the theoretical basis of privacy protection. Comparison of these 3 theories shows that for the privacy protection behavior of doctors, fear of negativity is an important motivation for behavior change. Threat appraisal (TA), coping appraisal (CA), social norms (SN), and ethical personal characteristics are supposed to influence the development of doctors' awareness of the protection of patient privacy, thus leading to modifications in the actual behavior of doctors. The criteria for designating the theoretical framework were the related behavioral theories adopted by the current studies on privacy protection, followed by domestic and international studies on the influence factors of health care workers’ privacy protection behavior, in which the main influence factors should be contained in the selected dimensions. Based on the fear of negativity, the privacy protection behavior of doctors in public medical institutions in China alters the motivation of protection behavior through obtaining relevant cognitive information and thus affects the individual’s protection behavior. Consequently, the framework of PMT is in line with the theoretical paradigm of this study. PMT was developed using Health Belief Model by Rogers et al [21] in 1975. The factors affecting health-related behavior include perceived severity (PSE), perceived susceptibility (PSU), self-efficacy (SE), and response cost (RC), in addition to the object's perceived intrinsic rewards (IRE) and extrinsic rewards (ERE) [22,23]. However, patients’ privacy protection by doctors in public medical institutions in China is the otherness behavior of non-right holders. The effect of social norms, attitudes, personal characteristics, and other factors on behavioral intentions are not considered in PMT. The mechanism of privacy protection by public medical institution doctors in China is yet to be fully explored. Exploratory research was required to construct a theoretical model of this study.

Considering the practical problem of how to promote the protection of patients' privacy in public medical institutions in China, we used the the theoretical paradigm of PMT. Through theoretical sampling, we selected representative interviewees and subsequently interviewed them using a semistructured interview. The interview period spanned from January 25 to February 25, 2022, which was a total of 32 days. The original data of grounded theory coding analysis was generated from the interviews. Subsequently, program-based grounded theory [24] was used to analyze the coding based on the original interview data and refine the scope of the study, alongside discussing the logical relationship between them and building the theoretical model framework [25-27].

Drawing on the methodology for scale development proposed by Churchill [28], a scale was designed based on the 3 principles of content, function, and overall uniformity. The process of scale construction is shown in Figure 1. Combined with the coding analysis results of the grounded theory method in the previous section, the key concept of interviews from the records of public medical institution doctors in China were extracted and the measurement items of the variables in this study were processed and separated. Regarding the initial scale, we had to make some adjustments to the items of the scale following the Delphi method [29] and a group discussion, including merging and deleting items with similar meanings in the scale, merging and adjusting items with an inclusion relationship, and adjusting the wording to ensure the semantic readability was concise and that the sentences were easy to understand to prevent misunderstandings.

The criteria for recruitment of doctors to be interviewed were as follows: (1) serving public medical institutions in China, (2) definition of “doctors” corresponding to the indicators of the China Health Statistical Yearbook, and (3) voluntary participation in this study. The survey adopted convenience and snowball sampling and was sent in the form of an electronic survey scale through WeChat. Data collection ran from April 1 to 25, 2022. In this study, the explicative items of threat, coping, support, and ethical appraisal were measured in the form of a 5-point Likert scale [30]: 1=completely disagree, 2=disagree, 3=uncertain, 4=agree, and 5=fully agree. In addition, IRE, ERE, and RC were inversely assigned. The explained variables, such as consciousness formation, body privacy, information privacy, and related privacy, were measured and assigned “yes” or “no” using binary variables, corresponding to 1 or 0, respectively.

First, we conducted EFA, including a reliability evaluation using Cronbach α, which was the optimum method to evaluate the reliability of internal consistency. It is generally accepted that a Cronbach α score above .8 indicates excellent internal consistency, .6-.8 implies good consistency, and below .6 suggests poor internal consistency [31,32]. To ensure that the items involved in the measurement comprehensively and accurately measured the corresponding variables, we used EFA to assess the content validity of the scale. Although EFA is not an accurate method to test theoretical assumptions, it allowed us to draw conclusions regarding the construct validity of the proposed scale [33,34]. Prior to EFA, the Kaiser-Meyer-Olkin (KMO) and Bartlett sphericity test was conducted on the scale to determine whether the scale is suitable for factor analysis. According to the judgment standard of KMO values, when the KMO value is above 0.6, the scale can be subject to factor analysis, while if it is above 0.8, the scale is suitable for factor analysis [35]. The variance maximization rotation for principal component analysis of the measurement scale and the Kaiser normalization maximum variance method for rotation were used in the EFA of this study. The rotation was confirmed to have converged following 7 iterations. In this study, SPSS 19.0 statistical analysis software was used for EFA of the sample data.

CFA was helpful to verify whether the subordinate relationship between the items in the scale and the extracted factors were correct or whether there were any wrong attributions to dimension problems [36,37]. Concerning the CFA result, if the standardized factor load of the item is greater than 0.5, it is accepted that the item can converge to its corresponding latent variable. The maximum likelihood was used in the model estimation. The χ² (df) value, the root-mean-square error of approximation (RMSEA), the standardized root-mean-square residual (SRMR), the Tucker-Lewis index (TLI), and the comparative fit index (CFI) were calculated to evaluate the model fit [38,39]. A model with good fit is achieved if χ² (df) is lower than 3 [40]. An RMSEA value below 0.05 indicates that the model is good [40]. SRMR values below 0.1 suggest that the model is acceptable [41]. The CFI and TLI values should be greater than 0.95 [42]. In addition, we evaluated the reliability of the scale by calculating the comprehensive reliability score [43,44] and analyzed both the convergence and discrimination effectiveness by comparing the average variance extracted (AVE) and the square correlation value [45,46]. If the variance of potential structure interpretation is greater than the variance according to measurement error (if the AVE value is higher than 0.5), the convergence effectiveness is clear [46]. If the AVE value is greater than the square correlation value, the discrimination effectiveness is obvious [46]. In conclusion, aggregate validity and discriminant validity are powerful indicators of structural validity [45,47]. Throughout this research, Amos 26.0 statistical analysis software was used for CFA of the samples.

Survey recipients were informed that participation was anonymous and voluntary, that all responses would be kept confidential, and that the collected data would be used for academic research only. The survey was approved by the Institutional Review Board at Huadong Sanatorium (approval no. (2022)13 of the Ethic Committee), and all participants provided written informed consent.

In total, 26 public medical institution doctors in China were selected, 10 (38.5%) of whom had personal, in-depth interviews, while the remaining 16 (61.5%) had 2 online focus group interviews according to their time arrangement. Finally, we obtained 12 interview records of over 50,000 words. Based on coding analysis and the theoretical saturation test, the results are detailed in Multimedia Appendix 1. According to the internal logic of PMT, the cognitive intermediary of doctors in public medical institutions in China regarding patient privacy protection would affect the doctors' behavior by altering the development of their awareness of the protection of patient privacy. The protection of patients’ privacy under the awareness of public medical institutions would lead to modifications in the actual behavior of doctors. Consequently, in this study, we considered doctors in public medical institutions in China to move through a process, from being unaware of patients' privacy to having privacy protection behavior. We regarded that this process affected doctors' cognitive intermediary and changed the development of their awareness of patients' privacy protection in public medical institutions in China in order to affect actual privacy protection behavior. According to the logical relationship of this “storyline,” we developed a novel theoretical framework, which is the theoretical model framework of the mechanism of doctors' protection of patients' privacy in public medical institutions in China, as illustrated in Figure 2.

The results of the initial scale are displayed in Multimedia Appendix 2. A total of 15 items were corrected. Following the aforementioned correction and adjustment of measurement items, an initial scale to measure 18 direct measurement variables in the theoretical model of doctors' behavior mechanism of protecting patients' privacy in public medical institutions in China was formed. This also included 63 measurement items, which were coded. Tables 1-5 illustrates the specific codes and corresponding measurement items.

The survey we issued was scanned a total of 278 times, and 208 valid questionnaires were identified following recovery; thus, the effective recovery rate was 74.8%. The gender ratio of men to women was relatively balanced, with 46.6% (n=97) of the participants being men. The majority of the respondents were 26-35 years old, accounting for 63.9% (n=133) of the total sample. The respondents were predominantly educated to the master’s degree level, accounting for 72.6% (n=151), which was consistent with the general education background of doctors. The department distribution was relatively balanced. Regarding urban distribution, Shanghai accounted for the highest proportion (n=131, 63.0%) due to convenience sampling. The detailed characteristics of the pretest samples are displayed in Table 6.

The Cronbach α of the whole scale was determined to be .768 by calculating the consistency coefficient of the scale, which was between 0.6 and 0.8, indicating that the scale possessed good internal consistency. According to the results illustrated in Table 7, the KMO value was greater than 0.6, indicating that the study is suitable for factor analysis, theoretically.

Following the factor analysis operation, 18 common factors were screened. The cumulative interpretation total variance of factor analysis was 71.49%, implying that this research had good explanatory ability. The contribution of single-factor variance was less than 40%, demonstrating that this scale could exclude any possible homologous deviation [48]. In general, this scale conformed to the preassumed theoretical structure and possessed good content validity. From the factor loading of each dimension, it was clear that the measurement items were independent of common factors, and the load was above 0.7, far greater than the standard of 0.4. Conversely, the absolute value of the load of the 18-factor measurement items on other factors was below 0.4. This indicates that the items of variables in this study could both effectively converge on their own common factors and effectively be different from other common factors. The minimum value of the Cronbach α for each study variable was .754; thus, the coefficients for each study variable were between 0.6 and 0.8, which met the internal consistency requirements of the scale. Consequently, the scale in this study could be considered to have good convergence validity and internal consistency [49]. The results are stated in Multimedia Appendix 3.

According to the fitting results of the model data in Table 8, most of the fitting indexes met the requirements of a critical value, indicating that the confirmatory factor model was well fit. According to the results of CFA in Table 9, the standard factor loading value of each potential measurement item in this study had scores greater than 0.5. The critical ratio (CR) values were greater than 7, and all had statistical significance levels within the range of P<.001. All the composite reliability (CPR) values were greater than 0.7, and the value of AVE scores were in excess of 0.5. These indexes were in accordance with the standards, which signified that all the items in the scale can effectively converge to the corresponding potential variables. The data displayed in Table 10 show that the value of the square root of the AVE of each variable was greater than 0.7. The score was significantly greater than the correlation value of the row and column in which it was located, namely the value below the diagonal. This demonstrated that there were significant differences among variables and confirmed that the scale in this study has good discriminative validity.

We ultimately designed a scale with high reliability and validity and a correct subordination structure between factors. The scale determined 63 measurement items around 18 direct measurement variables in the theoretical model of this study to create a formal scale for this study. The specific contents are illustrated in Table 11.

The results of both EFA and CFA revealed the development of awareness and the behavior of public medical institutions in China regarding patients’ privacy protection behavior, which could be measured by the scale proposed in this research. The scale consisted of 18 diverse dimensions, which were theoretically meaningful.

We suggest that the threat assessment process involves 4 dimensions: PSE, PSU, IRE, and ERE. Rogers [21] defines PSE as the judgment of the degree of harmfulness caused by a threat event. PSU refers to the probability of feeling as though a threat event will occur. IRE and ERE both represent the “benefits” introduced by considering hazard factors from the researcher’s own feelings and from the outside world, respectively [22,23]. In this study, PSE included the punishments faced by doctors who disclosed patients’ private information in line with laws and regulations, in addition to the punishment related to hospital norms and the threat of patients’ rights protection. PSU includes the possibility of introducing laws and regulations to punish doctors for disclosing patients’ private information, the possibility of hospitals penalizing doctors for disclosing patients’ private information, and the possibility of patients safeguarding their own rights. IRE includes obtaining financial returns and scientific research achievements, in addition to satisfying vanity by divulging patients’ private information. ERE refers to information doctors hear from the outside world. CA is the assessment of doctors’ ability to protect patients’ privacy, including SE, RE, and RC [22,23]. Throughout this study, SE refers to doctors’ cognition regarding whether they are capable of protecting patients’ privacy. RE refers to the judgment of whether the privacy protection measures undertaken by doctors can protect patient information to an effective degree. RC refers to the cost that doctors are required to pay when taking protective actions, spanning the impact on scientific research and clinical work, that is, doctors’ protection of patients’ privacy will hinder their scientific research work or clinical work.

PMT is used to explain the way in which individuals seek self-protection from a harmful or stressful life [50]. Doctors do not protect patients’ privacy of their own accord. Based on the results of grounded theory, 2 cognitive evaluation processes applicable to this study are summarized: support evaluation and ethical evaluation. Various doctors in the interview revealed that, “…for clinical work, doctors are too busy to notice so much, if possible, hospitals should improve information construction and better protect patient information. In fact, we can make a proposition on how to protect patient privacy in the data flow process...” Throughout this study, support evaluation was predominantly in the context of hospitals. All aspects of hospital support are greatly significant for doctors to successfully carry out patient privacy protection, which can be summarized as SS, IS, NS, and ES. SS means that the hospital must designate a department to perform full-time supervision of patients' privacy protection by doctors, as well as providing training and assessments on privacy protection laws and regulations. IS refers to the improvement in the overall information construction of the hospital and ensuring the privacy and safety of patients are protected. NS includes the establishment and development of a patient privacy protection system, determining the privacy protection process and a reasonable scientific research application system, and carrying out scientific research efficiently on the basis of legal and compliant patient privacy protection. ES refers to improving the medical environment, maintaining the medical order, and providing facilities to prevent patient privacy leakage, for example, curtains, and privacy processing of bedside card information. EA means to analyze and extract relevant factors that promote doctors’ privacy protection behavior according to medical ethics, including RS, PM, and EH. Previous studies have demonstrated that to protect medical privacy, all medical staff who protect others have the responsibility to protect medical privacy. Responsibility ethics is a form of moral thinking that includes other thinking. The lack of moral quality in data application subjects is 1 of the primary subjective factors of anomie of data privacy ethics [51,52]. The original interview stated that “...the main responsibility of doctors is to treat and save patients...” In this study, RS determined that protecting patients’ privacy is both the doctor’s job and social responsibility. The medical ethics of doctors is mentioned in the norms and implementation measures for medical ethics of medical personnel, according to the Ministry of Health [8] issued on December 15, 1988. It discusses the ideological qualities that medical personnel should possess and the sum of the relationship between medical personnel, patients, and society. The implication of medical ethics is to attempt to do everything within your means to be good for patients [53]. “Keeping medical secrets for patients and not divulging patients’ privacy and secrets” is 1 of the provisions mentioned in the code of medical ethics. Similarly, the international code of medical ethics stipulates that “due to the trust of patients, a doctor must absolutely keep patients' privacy” [54]. The original interview stated that “…for my own consideration of professional ethics, I try my best to protect patients’ privacy in clinical and scientific research work...” In this study, the protection of the privacy of patients is a requirement of the doctors’ PM. It is repeatedly emphasized that patients’ private information must be protected by doctors from the educational stage to the work stage. Empathy was first introduced to the field of psychology by the humanistic psychologist Rogers. This refers to an individual understanding of the experience and emotional state of others [55]. Empathetic doctors will convey their understanding to patients [56] and even map the patient’s experience, transforming the patient’s point of view to become a self-centered point of view [57]. According to the analysis of the interview data, a conclusion of this study on empathy was formed, including that doctors can consider the harm of disclosing private information from the perspective of patients and the experience of privacy information disclosure when doctors are patients. Referring to the original text “…imagine that your information will be leaked, commercial and public. Isn't it terrible...do multi-centre research, and I especially emphasize whether the information is desensitized...lack of empathy to protect the patient’s privacy. It's different after thinking about yourself...”

The motivation for protection in PMT has typical characteristics of motivation, which can cause, maintain, and guide activities. Generally, the results of cognitive assessment cause individuals to display greater intention of protective behavior [58]. The concept of protection motivation, in combination with various research scenarios, has evolved into individual intentions of protection behavior, for example, the intention of hot-spring tourists to revisit [59], the intention regarding self-care of elderly patients with chronic diseases [60], and the intention of self-management of diabetic retinopathy [61]. The original interview data discussed that “...the doctors’ work is too busy, and the awareness of patients’ privacy protection is not strong...” Throughout this study, the meaning of doctors’ motivation for patients’ privacy protection in public medical institutions in China is whether doctors develop an awareness of the importance of patient privacy protection.

According to the results of the coding analysis, the privacy protection behavior of doctors includes protecting the private space of patients (BP), protecting the patients’ data (IP), and protecting family members and other personal relations (RP). The protection of BP refers to the protection of the patient’s body privacy by the doctor. Meanwhile, the protection of patient IP refers to the doctor’s protection of the patient’s information privacy. Finally, the protection of patient RP refers to the doctor’s protection of the patient’s associated privacy, including not disclosing or promoting the family members and other personal relationship information about any patient.

Our interviews and scales were created with input from the expected target population, that is, Chinese medical institutions. EFA revealed a unified structure of factor loads without cross loads, allowing a clear interpretation of all potential configurations. CFA confirmed the structure of the scale, meaning the subordinate relationship between each item and the extracted factors was correct. The primary fitting indexes met the requirements of the critical value, and the fitting of CFA was acceptable. It is known that model fit assessment is challenging, considering a small sample size [42], and thus, we agree that further goodness-of-fit assessments with a larger sample size will be necessary in future studies.

This study was subject to various limitations. First, the sample size used was small. Although a general minimum sample size is yet to be defined [34], the authors recommended a sample size at least 5-10 times that of the items [30]. Another limitation was the poor representativeness of samples. In the process of selecting interviewees, the feasibility of obtaining interview samples was considered. Due to the full nature of doctors’ schedules, it was challenging to coordinate a time and place, especially when conducting focus group interviews. Thus, the overall sampling was concentrated in East China. The scale survey was also predominantly based on the principle of convenience sampling, and the regions from which samples were taken mainly included East and North China. Considering the understanding of doctors’ privacy protection behavior by interviewees and respondents, hospitals in different regions have different norms and requirements for doctors’ privacy protection behavior, which would lead to a certain selection bias. In addition, doctors’ privacy protection for patients was not merely a problem of doctors’ behavior but was also due to hospital management. Furthermore, when doctors were interviewed, they might have reservations regarding their true ideas.

First, we must sample public medical institutions across all 7 regions of China to further verify the reliability and validity of the scale and of doctors’ privacy protection behavior. Subsequently, under the influence of various cognitive mediating factors, doctors’ awareness of patient privacy protection will be affected, resulting in actual privacy protection behavior. The variables will be measured using the scale proposed in this research, and the key factors to promote doctors’ privacy protection behavior will be identified, with the aim of improving it from the perspective of management. In addition to the theoretical model factors, personal factors, including age, gender, educational background, professional title, religious belief, and working years, as well as the environmental policy factors of the region and department of hospitals, also affect doctors’ privacy protection behavior. Nevertheless, to gain additional insights into these relationships and the relative importance of different factors, further research including the scale is needed.

The theoretical framework and the scale of doctors’ protective behavior of patients’ privacy in public medical institutions fill a crucial gap in the literature and can be used to further the current knowledge of physicians' thought processes and decisions regarding patients’ privacy protection.