Introduction

Hospitals have become critically aware that electronic medical records (EMR) may bring about tangible/intangible benefits, which may include reduced medical errors, improved quality-of-care, curtailed costs, and allowed access to patient information by healthcare professionals without time/space limitations [1, 2]. However, increased institutional dependence on EMR has led to a corresponding increase in the deleterious impact of EMR breaches. These virtual incursions refer to unauthorized access to EMR by internal employees, or outsiders, akin to our study. Such violations may cause tangible/intangible damage to both organizations and individuals [3]. In particular, since the use of accessing EMR on mobile devices has increased almost exponentially, the real probability of EMR breaches has also been on the rise.

Recently, literature has pointed out the importance of employee compliance to organizational policies useful to model overall proper attitude or behavior concerning how organizational resources should be used [4,5,6]. To protect the inherent privacy of patients’ and institutional EMR, coercing hospital employees to comply with EMR privacy policy has become a necessity much in keeping with other organizations [7]. EMR privacy policy refers to a formal statement articulating the privacy rules of a hospital and how it concerns all employees who have access to EMR and related informational assets [8]. Further, several investigatory attempts have been made regarding how best to deter employees’ malicious behavior toward organizational digital assets or how to coerce employees to comply with organizational policy [4, 6, 9,10,11,12,13,14,15,16,17,18,19,20,21,22,23]. Among the abovementioned studies, several valid attempts have been made to focus specifically on how to motivate healthcare employees to comply with EMR privacy policy or data protection regulations [6, 20,21,22,23,24].

The previous studies may be said to have contributed to an overall understanding of these relative issues. In the named studies, scholars exploring these issues have centered upon a variety of theories in both healthcare and non-healthcare contexts, such as technology acceptance model [23], principal agents theory [13], protection motivation theory [14, 21, 24], health belief model [6], theory of planned behavior [5, 22], decomposed theory of planned behavior [20], theory of reasoned action [21], rational choice theory [19], or deterrence theory, which was most frequently employed [4, 5, 9,10,11,12,13, 15, 18, 19, 22, 25]. Deterrence theory, to the best of our knowledge in reviewing related studies, was however less adopted to investigate healthcare professional’s compliance behaviors. One is the study by Foth [22], he used variables taken from the theory of planned behavior and deterrence theory to explain how a hospital staff member’s intention to follow data protection regulations may come about. This study surely provided several important and insightful implications for academics and for practical applications. Deterrence theory primarily focuses upon the effect of sanctions useful to deter possible illicit acts [26]. The sanctions imposed are usually divided into formal sanctions (legally binding) and informal sanctions (non-legally binding). But, in his study, Foth [22] incorporated only formal sanctions (i.e., punishment severity and detection certainty). Without informal sanctions to draw some conclusions from, it may be insufficient to locate the correct determinants necessary to compare and then to accumulate subsequent findings. Our study aimed to address this gap in order to better understand the effects of deterrence in a privacy policy compliance context.

However, the effect of deterrence theory constructs on employees’ presumed violations or expected compliance with established organizational policy is usually a mixed bag at best. For example, the construct of formal sanctions (e.g., severity of penalty, punishment, and certainty of sanction) was found to provide several significant predictors of information systems security policy compliance in various studies [9, 13], but they were deemed insignificant in yet other studies [18, 19]. On the other hand, the construct of informal sanctions, such as subjective norm, also yielded inconsistent results [14, 17,18,19, 22]. Further, scarce studies have been conducted on the above-mentioned issues as they pertained to diverse healthcare industries, especially whenever they are focused on EMR privacy matters. One of the unique aspects that relates to the healthcare context is that there are greater risks whenever sensitive healthcare information is compromised than there are in other contexts [27]. Hence, it is not only essential, but it is also timely, to explore such issues since EMR is ubiquitous.

Despite it being well known that coercing employee’s compliance with privacy policy is institutionally important, there still remains a dearth of information that will aid practice administrators to confront this issue and then focus their efforts accordingly. Broadly speaking, hospital employees who gain access to EMR are potential threats to the patient privacy and institutional integrity, and they should be addressed directly. Nursing staff make up the largest portion of healthcare professionals located in hospitals, and they are the ones who interact most with EMR and patients due to the nature of their work [28]. The intentional or unintentional failure of nursing staff to safeguard patient privacy may erode nurse/patient relationships, jeopardize the quality of the treatment to be provided, and it may even cause serious personal harm to patients [29, 30]. However, scant incidence of study [20] has specifically been focused on nursing staff in hospitals and in the literature. Foth [22] also suggests research must be made to differentiate the effects in hospitals among different occupational groups regarding the protection of patient information against potential breaches. Hence, the primary purpose of this study was to explore those factors that best deter nurses and nurse practitioners from violating EMR privacy policy for any reason by drawing upon the literature of deterrence theory [26, 31].,

Theoretical Foundation, Research Model and Hypotheses

Theoretical Foundation – The Deterrence Theory

Deterrence theory, originating from the criminology discipline, presumes that individuals should make rational decisions toward committing any criminal activity based on a trade-off between inherent benefits and supposed costs [32]. As such, when the benefits are considered to be greater than the costs, individuals may choose to pursue crime [33]. The deterrence theory asserts that individuals’ illegal behaviors can be dissuaded via the imposition, with some degree of certainty, of severe and certain legal sanctions [26, 31]. It is supposed that the more severe an act of punishment, the more likelihood that a rational individual will not engage in criminal acts. Further, the certitude of sanctions refers to a punishment that is certain to occur whenever criminal behavior is committed, and the perpetrator is apprehended. More specifically, if a punishment is severe enough and certain enough, individuals will most likely assess the given gains and losses before undertaking in criminal acts. Therefore, it may be assumed that rational individuals will be deterred from illegal conduct if the loss outweighs the gains [34, 35]. Later deterrence studies [13, 14, 17, 36] have further proposed the construct of detection certainty (referring to an individual’s perception of the probability of being caught due to the commission of unlawful behaviors) since organizational rules will be considered as useless if these rules are not enforced. Employees will thus seek to comply with the stated organizational rules if they perceive a greater chance of being caught for some non-adherence of those rules.

Further, classic deterrence theory primarily focuses on how the effect of legal sanctions deters illicit acts [26]. Recent studies have noted that informal sanctions such as social disapproval (e.g., subjective norm), self-disapproval (e.g., shame), and moral inhibition can also serve as a deterrent to deviant behaviors [32, 33] or, as a motivator to engage in lawful behaviors [17]. It should be noted that an individual may perceive an unlawful act to be morally offensive [32]. For example, Piquero and Tibbetts [37] incorporated a battery of moral beliefs (i.e., individual judgment of right and wrong about the intended act) and situational shame (i.e., losing self-esteem or a feeling of sin about the intended act) to better understand their putative influence on individuals’ intentions to shoplift or to drive while intoxicated. They found both moral beliefs and situational shame significantly reduced respondents’ intentions to engage in the above behaviors. Consequently, both formal and informal sanctions may pose threats which individuals will not necessarily take into consideration when deciding on whether or not to participate in unlawful behaviors [33].

Research Model and Hypothesis Formulation

To explore the factors that inhibit nursing professionals from violating stated privacy policy, the researchers used the deterrence theory as a theoretical underpinning. The deterrence theory postulates that formal and informal sanctions can be used as effective deterrents of individuals’ illicit acts [32, 33].

Fig. 1 shows the proposed research model, as based upon the deterrence theory. The dependent variable in our study is an intention to violate privacy policy, referring to the subjective probability that a member of the nursing staff will fail to comply with privacy policy in the future. We argue that the imposition of appropriate sanctions based on deterrence theory will diminish nursing staff’s illicit intention towards EMR privacy policy. Following the suggestion of Herath and Rao [13], we included three constructs for formal sanctions (i.e., punishment severity, punishment certainty, and detection certainty). As the severity and the certainty of formal sanctions increase, the level of incidence for the illicit act decreases [13]. In our study context, hospitals are obligated to formulate rigorous EMR privacy policies that will regulate employees in order to protect patient privacy and institutional integrity, and when staff violate such policy statements, they will receive severe punishment if culpable for any EMR breaches. Further, Taiwanese hospitals that have adopted EMR policy must assiduously monitor employees’ EMR access logs according to proscribed governmental regulation [38]. In words, hospitals must detect suspicious activities to secure the inherent privacy of EMR, and then see to it that violators are sanctioned. This notion is also supported by set standards of information security management, such as the International Standard Organizations (ISO) 17799 (now referred to as the ISO 27002), which suggest that organizations monitor employees’ system access and usage to enable enforcement of sanctions and also to achieve certainty / surety of some form of sanctions being imposed [39]. Concerning informal sanctions, we included subjective norm to represent informal sanctions according to the deterrence theory and related studies [32, 33, 36]. Most nurses may perceive it to be morally wrong and morally unacceptable if they do not adhere to established privacy policies since nursing is a highly regulated healthcare industry [40].

Fig. 1
figure 1

Research model

Full size image

Finally, in order to prevent the unexpected influence of some demographic variables to rest on the analysis results, we followed suggested procedures [41] which included demographic variables used as control variables in our proposed model. No hypotheses were required to make up for the control variables [41]. In their study of deterrence across cultures, Hovav and D’Arcy [15] found that age have a significant relationship with IS misuse intention in the U.S. sample. Gender was excluded from as a control variable due to the small male ration (3.82%) found in our sample, which is in line with the fact that most nursing staff are female in Taiwan. Further, educational level and working experiences may be related to nursing staff’s knowledge of and familiarity with privacy policies, and it may further influence one’s tendency to violate the policies in organizations as well [14, 17]. The justification of the model, along with the research constructs and their associations in the proposed model, was demonstrated as follows.

In this study, punishment severity refers to the nursing staff’s perceived degree of punishment [10]. According to the deterrence theory [26], if the level of a punishment increases, a given individual is less likely to undertake unlawful behaviors. In other words, when the nursing staff perceives a stringent degree of punishment for violating privacy policy is possible, they will be less likely to engage in such illegal behavior. Otherwise, there is every likelihood that the nursing staff will be punished by severe civil penalties, criminal penalties, or both if they are caught violating stated privacy policy. Prior studies of information security also lend support to this notion [1, 10, 13, 15, 22, 36].

Punishment severity and punishment certainty have the potential to regulate individuals’ behaviors [26, 31]. In this case, punishment certainty means that a nursing staff’s perceived probability of being punished is related to non-compliance with stated EMR privacy policy [10]. On the other hand, deterrence theory assumes that potential perpetrators are made aware of prior efforts, including the imposition of rules and punishment to prevent deviant behaviors [13]. Rules for regulating employees, however, will not work if the rules are not enforced with some degree of regularity [42]. According to the theory, if the nursing staff’s misbehaviors are caught and they know they will be punished for such misbehavior, the nursing staff will then be more likely not to violate stated privacy policy. Prior studies of information security also support this notion [15, 25, 43].

Detection certainty in this case is considered to be the nursing staff’s perception of any probability of being caught if they do not choose to adhere to privacy policy [17]. As discussed in a previous hypothesis, the deterrence theory assumes that potential perpetrators are pre-informed of the punishments meted for unlawful behaviors such as the violation of organizational rules [13]. Enforcing organizational rules and expected punishment is however possible only if organizations are capable of detecting employees’ mis-behaviors [13, 42]. Hence, a nursing staff’s non-adherence to following privacy policy can be deterred through inspection and auditing their EMR usage patterns of behavior in order to monitor non-compliance [22].

For this study, subjective norm refers to the nursing staff’s subjective beliefs regarding their degree of disapproval for non-adherence to EMR privacy policy among those who are important to the nursing staff [17]. The deterrence theory posits that an individual who holds a behavior to be morally offensive will be less likely to commit such reprehensible unlawful behaviors [32, 33]. Similarly, in order to meet the expectations of important others, the nursing staff will be less likely to violate EMR privacy policy on their own, which will be regarded as an act morally offensive by others who are important to the nursing staff. Previous studies have found that an employee’s attitude related to IS security policy compliance can be affected by significant others [4, 7, 13, 17, 22, 44].

Based upon the previous discussion, the proposed hypotheses and supportive literature are summarized in Table 1.

Table 1 Proposed relationships among key constructs and supportive literature
Full size table

Method

Measures

The questionnaire used in this study is comprised of two parts. The first section gathers the respondents’ demographic information, and the second part deals with respondents’ perceptions concerning the five constructs investigated (punishment severity, punishment certainty, detection certainty, subjective norm, and intention to violate privacy policy). Our study constructs were measured by utilizing previously validated instruments [7, 13, 14, 19, 45, 46], and all items were measured on a seven-point Likert scale (e.g., one for strongly disagree, and seven for strongly agree). Regarding the detailed sources of items, punishment severity was measured using two items adapted from Herath and Rao [13]. Punishment certainty was measured using two items in accordance with Siponen, Pahnila and Mahmood [45] and Siponen and Vance [19]. Detection certainty was measured using three items adapted from Herath and Rao [13] and Li, Zhang and Sarathy [17]. Subjective norm was measured using three items based on Ifinedo [7]. Intention to violate privacy policy was measured using three items adapted from Chan, Woon and Kankanhalli [46].

The draft questionnaire was then reviewed by experts, including two healthcare information management researchers and two experienced nursing management practitioners. The experts were encouraged to provide feedback about the clarity and validity of the scale that was used. Opinions were compiled as a modification reference for the final version of the questionnaire. Afterwards, a pilot test was conducted to establish the scales via a sampling 20 nursing staff members employed at a single medical center. Slight alterations of words and phrases were made to given items which resulted in a final instrument justified for further validating.

Sampling

We obtained approval from the institutional review board of a large hospital prior to proceeding with the investigation. The subject hospital, a 740-bed Taiwanese hospital employing about 474 registered nurses, was chosen due to the consideration that it is rather active in using EMR in Taiwan in terms of both volume of internal EMR utilization and the amount of EMR exchanged with other hospitals [47]. Prior to the delivery of the questionnaires, we successfully contacted the relevant nursing department to secure their collaboration. We assigned a coordinator for those units of the nursing department that were willing to help with the distribution and collection of the questionnaires per se. Totally, we distributed 300 questionnaires to those units. Subjects were invited to voluntarily and anonymously complete the paper-and-pencil survey. In all, 280 responses were collected, indicating a response rate of 93.33%. Excluding 18 incomplete survey responses due to partial answers, we were left with 262 responses useful for later analysis.

Results

Demographics Analysis

Of the 262 responses, most respondents were female (96.18%). Nearly 96% of the respondents were aged between 20 and 49 years-old. Further, the majority of respondents have a college- or university-level diploma (91.22%). Non-managerial level nurses are the largest group of the respondents (93.51%) and over 66% of respondents have more than 4 years of working experience in the healthcare industry. All respondents are required to use EMR during patient care procedures, indicating the respondents are qualified for participation in our study. Details of the respondents are shown in Table 2.

Table 2 Descriptive statistics of respondents’ characteristics
Full size table

Data Analysis

Measurement Model Estimates

The proposed model and hypotheses were empirically validated by utilizing partial least square (PLS). We assessed the PLS measurement model by use of three tests: reliability, convergent validity, and discriminant validity [48, 49]. Composite reliability (CR) is used to assess the reliability [48, 49]. The CR of all constructs in our study (See Table 3) were higher than the threshold of 0.7 (See Table 2) [49]. For convergent validity, the average variance extracted (AVE) of the constructs investigated were larger than the suggested criterion of 0.5 [48]. Moreover, the inter-construct correlations matrix (See Table 4) reveals that the square root of AVE for each construct was higher than the correlation of the specific construct with any other constructs in the model [48]. Based on the results, our study demonstrated sufficient reliability and validity for the constructs investigated.

Table 3 Reliability and validity
Full size table
Table 4 Inter-correlations among constructs
Full size table

Structural Model

We used a bootstrapping procedure to test the structural model and the significance of each path coefficient. Fig. 2 depicts the structural model results with path coefficient and p values, and Table 5 summarizes the results of hypotheses testing. According the analysis results, we did not find evidence to support hypothesis H1. That is, punishment severity was not significantly associated with the nursing staff’s intention of violating EMR privacy policy (β = −0.00, p > .05). Regarding hypothesis H2, the results supported that punishment certainty is a significant and negative predictor of the nursing staff’s intention to violate privacy policy (β = −0.27, p < .001). Further, we found support of hypothesis H3. That is, detection certainty can significantly reduce the nursing staff’s intention of violating privacy policy. Finally, we confirmed that subjective norm negatively contributed to the nursing staff’s intention to violate privacy policy (β = −0.41, p < .001), thus supporting hypothesis H4.

Fig. 2
figure 2

Structural model results

Full size image
Table 5 Summary of hypothesis testing results
Full size table

Overall, our model explained about 65% of the determined variance in the nursing staff’s intention to violate EMR privacy policy. Moreover, the influence of three control variables (i.e., age, experience, and education) revealed that none of the control variables had a significant influence on intention. The results concerning the hypotheses remain unchanged with or without these control variables being present, which means the effects of age, experience, and education are controlled in our model. Further, the global fit index of our study is 0.76 which suggested that our model was in fact valid [50]. Finally, our sample size of 280 is higher than the minimum suggested sample size 166 used to achieve the acceptable 80% statistical power for detecting R 2 values of at least 0.1 (with a 5% probability of error) in terms of our model [49].

Discussion

Key Findings

Protecting the privacy of electronic medical records is an imperative managerial issue given the proliferation and institutional nature of EMR among regular healthcare facility operations. Based upon this understanding, our study aimed to investigate those factors which may prohibit a nursing staff from violating EMR privacy policy based on a foundation of deterrence theory.

The main finding of this study was that both formal and informal sanctions may become effective tools for deterring nursing staff from violating EMR privacy policy. Specifically, formal sanctions including punishment certainty and detection certainty were significantly and negatively related with nursing staff’s violating intention while informal sanction including subjective norm can also reduce the nursing staff’s intention of violating privacy policy.

Based on the findings, punishment certainty plays an important role in prohibiting the nursing staff from violating privacy policy since they will be less likely involved in violating behaviors if they feel they are found to be responsible for their actions. The results match those observed in earlier studies [15, 42]. Hovav and D’Arcy [15] found that perceived certainty of sanctions can significantly lower an individual’s intention to mis-use information systems in the Korean MBA student samples. Second, detection certainty associated negatively with the nursing staff’s violating behaviors. The result supports that detection certainty is also an important determinant for preventing nursing staff from violating privacy policy. Increasing the possibility of being caught apparently may lower the nursing staff’s perceived ability to violate privacy policy. The significant and negative relationship between detection certainty and intention to violate privacy policy is consistent with prior studies [13, 14, 17] which reported that detection certainty can regulate an individual to compliance with stated organizational policies.

Regarding the construct of subjective norm, there was evidence that informal sanctions such as subjective norm was also effective in deterring the nursing staff from violating privacy policy. This suggests that subjective norm concerning the expectations of important others seem to have an influence on the behavioral intention of the nursing staff. This finding is in agreement with prior studies [14, 15] which showed social influences such as subjective norm or moral beliefs can deter an individual’s mis-behaviors. We, however, didn’t find a significant association between punishment severity and nursing staff’s intention to violate privacy policy. This result differed from the assertion of the deterrence theory [33]. The deterrence theory, however, has been found to produce paradoxical effects in some prior studies [9, 13, 18, 19]. A plausible reason for the insignificant results in our study may be that rigorous punishments may weaken the nursing staff’s trust or loyalty toward hospitals and, thus, exerting a counterproductive influence on their compliance intention of the stated privacy policy.

Significant deterrents of intention to violate privacy policy are likely to include punishment certainty, detection certainty, and subjective norm. They are ranked in order of importance, as follows: subjective norm, punishment certainty, and detection certainty. The results may indicate that informal sanctions (i.e., subjective norm) have a larger effect than formal sanctions (i.e., punishment certainty and detection certainty), which supports Pratt, Cullen, Blevins, Daigle and Madensen [33]‘s notion that the threat of non-legal cost sanctions were among the most robust of the deterrence theory predictors. Our findings are also in keeping with previous studies, which found that the effects of informal sanctions are stronger than formal sanctions [12, 13, 15].

Last but not least, with an increasing dependence on mobile devices, the protection of EMR privacy has also become even more complex and multi-dimensional. More and more hospitals are allowing their employees to access EMR via mobile devices such as smartphones, tablets, or laptops in order to perform real-time patient-care tasks inside or outside the hospitals without delay. These mobile devices can even be employees’ own devices adding issues related to storage, sharing, and insured confidentiality to the mix. In other words, the concept and application of bringing your own devices (BYOD), referring the practice whereby organizations permit their employees to use their own devices during worktime [51], should not be overlooked when designing and formulating strategies for the protection of EMR privacy.

Contributions

The results of this study add to the literature in several ways. First, our study contributes to the literature of EMR privacy policy by utilizing the deterrence theory, which provides a feasible theoretical basis, to examine deterrents for privacy policy violation intentions. Specifically, our study empirically validated that both formal and informal sanctions can predict the nursing staff’s violating intention. Besides, the findings of this study further provided suggestions for health administrators in their planning and designing of effective strategies necessary for inhibiting the nursing staff from violating policy which is in keeping with the overall expected privacy of EMR.

Academic Implications

For academics, our study helps in the accumulation of knowledge related to the issue of organizational privacy policy adherence/violation. More specifically, this study empirically validated the appropriateness of utilizing the deterrence theory originated from the criminal domain to address how to deter the nursing staff from violating a given privacy policy. By including both formal and informal sanctions, our study found that both kinds of sanctions may be used to deter a nursing staff from violating privacy. Further, the effect of informal sanctions on illicit intention is larger than that of formal sanctions. The result seems to be consistent with Pratt, Cullen, Blevins, Daigle and Madensen [33] assertion that including informal sanctions in a deterrence model will decrease the effect of formal sanctions. Based on the discussions, studies focusing only on formal sanctions may show misleading or inconsistent results.

Practical Implications

There are also several practical implications that can be derived from our study. First, since punishment certainty was a significant deterrent for the nursing staff’s violation of privacy policy, we hold that formal and proscribed sanctions must be required for hospital administrative practices. The primary reason is that these formal sanctions serve as the legal basis for hospitals to take subsequent action against employees who violate stated privacy policy and exist as prior knowledge to exhibit violators’ intent. Especially, the design and formulation of these formal sanctions can be considered from the standpoint of different contexts suggested in the literature [51] such as mobile device ownership (how to access EMR), location (where to access EMR), time (when to access EMR), activity (whether as a personal task or patient-care task), and the overall sensitivity of EMR information processed in the era of ubiquitous mobile devices. Second, the support of detection certainty may imply that hospitals should keep good track of the nursing staff’s usage of and access to EMR. When they inquire into or update EMR, these actions should be recorded comprehensively for purposes of later auditing. Hence, hospitals should clearly inform their employees that their EMR usage is being monitored anytime and anywhere. Due to the evident characteristics of encrypting or protecting mobile device usage, the detection of EMR intrusion can be a rather challenging task. It is therefore suggested that these monitoring activities should be carefully designed and reviewed in order to ensure that all the EMR access activities are fully logged with whatever devices health professionals have chosen to adopt. Finally, our results further demonstrate that subjective norm deters the nursing staff from violating privacy policy. Hence, managers can improve the nursing staff’s compliance intention by enhancing the privacy climate in hospitals and through encouraging colleagues to advocate the negative consequences of violating privacy policy, as the nursing staff’s non-compliance intention can be further altered by the opinions of superiors and colleagues. Of course, the negative consequences of violating stated privacy policy, when building the correct privacy-protection climate / domain, cannot be overemphasized. This is especially true since mobile devices are so commonly used to access EMR.

Limitations

Several common limitations may exist in this study. First, the sample is drawn from only one hospital located in Taiwan. Consequently, inferences to the larger population cannot be safely made. In other words, the external validity of the present findings may therefore be confined to a greater or lesser extent due to the adequacy of sample size. Further, the survey conducted in this study was based on self-report rather than observation or the recording of participants’ routine behavioral patterns. Future research can thus investigate the issue in order to further understand the relationships among these constructs.

Conclusions

Employees are assumed to be the weakest link in security management [17]. The nursing staff composes the largest portion of healthcare professionals, and they are the ones who interact most with EMRs due to the nature of their work [28]. The chance of EMR being breached will be reduced if the nursing staff are well-regulated to comply with the stated privacy policy of EMR. This is important to hospital administrators because privacy policy compliance means hospitals can better protect the privacy of EMR. By utilizing the deterrence theory, our study proposed and then empirically validated a model in order to explore the deterrent to non-compliance of EMR privacy policy among the nursing staff. The result also demonstrates that our proposed model can explain a sufficient amount of variance (65%) of intention to violate privacy policy. Regarding the constructs for formal sanctions, punishment certainty and detection certainty significantly explains the nursing staff’s intention to violate privacy policy. Further, the constructs of informal sanctions, namely subjective norm, also significantly predict the nursing staff’s intention to violate privacy policy.

Funding

This work has been supported by the Ministry of Science and Technology (Grant no. MOST-103-2410-H-214-007), Taiwan, R.O.C.