The Healthcare Internet of Things (H‑IoT) has expanded the volume, velocity and sensitivity of patient data in clinical settings. Although international standards and national laws mandate extensive safeguards, hospitals struggle to embed these requirements in daily practice. This thesis addresses the gap between formal privacy governance and the everyday privacy practices of clinicians, IT staff and cybersecurity specialists.

It develops, applies and appraises an integrated Soft Systems Methodology and Theory of Planned Behaviour (SSM‑TPB) framework, in which SSM structures the governance problem and TPB serves as an interpretive lens on the behavioural determinants of privacy practices at the level of individual activities. TPB constructs are used interpretively rather than measured or applied predictively, and the framework is presented as analytically useful and field‑informed rather than as a validated explanatory model. The study responds to the implementation of Saudi Arabia’s Personal Data Protection Law and the National Cybersecurity Authority’s Essential Cybersecurity Controls in data‑intensive clinical settings.

A qualitative, theory‑informed case study was conducted at King Salman Specialist Hospital (KSSH), Saudi Arabia. SSM structured the problem through rich pictures, root definitions and conceptual models; TPB then interpreted attitudinal, normative and perceived‑control barriers. Sixteen semi‑structured interviews with IT operations, cybersecurity and clinical management staff were analysed using reflexive thematic analysis.

The governance‑behaviour gap persists because formal requirements are not aligned with infrastructure constraints, authority structures, clinical urgency and staff behaviour. Three field‑informed refinements emerged: a monitoring‑output gap, ministry‑approval latency as an environmental constraint, and the absence of a post‑event consent pathway in urgent deployments.

The framework contributes theoretically, methodologically and practically. It is appraised, not validated: its analytical value is demonstrated through one case study, which also identifies the preconditions for operational use.