Chapter 32 — Network and communications security: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Clinical priorities"]
N2["32.2 Legal and regulatory views"]
N3["32.3 Management and budget"]
N4["32.4 Translating between groups"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Clinical priorities"]
N2["32.2 Legal and regulatory views"]
N3["32.3 Management and budget"]
N4["32.4 Translating between groups"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Clinical priorities]
|
v
[32.2 Legal and regulatory views]
|
v
[32.3 Management and budget]
|
v
[32.4 Translating between groups]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) work with clinical, legal and management perspectives; (2) communicate risk; (3) align security with care.
32.1 Clinical priorities
In a clinic, patient care comes first, and security that delays care will be bypassed or rejected. Priya meets a nurse manager who explains that clinical carts must work immediately at the start of each session and that a login screen appearing mid-procedure is unacceptable. This shapes the design: carts use device certificates rather than staff logins, and changes are scheduled outside clinic hours. Listening to clinical staff early prevents designs that look secure on paper but fail in the reality of patient care.
32.2 Legal and regulatory views
Health data are subject to data protection law, and the clinics must be able to show that they protect it appropriately. The clinics' data protection officer is interested in evidence: what controls exist, who checks them and how incidents would be handled. Priya's requirement list, test results and logging specification become useful evidence. She learns that framing technical work in terms of obligations and evidence helps legal colleagues, who do not need to understand firewall rules to see that risks are being managed.
32.3 Management and budget
Managers decide what is funded, and they compare security against other needs such as staff and equipment. Priya presents costs, benefits and risks in plain language: new access points and a firewall per clinic cost a stated amount, reduce the risk of an infection spreading to clinical devices, and support legal obligations. She avoids frightening language and exaggerated claims, which damage trust. Managers respond well to clear options with costs, including a cheaper first phase that delivers guest separation alone.
32.4 Translating between groups
Each group uses different language: clinicians talk about patients and sessions, lawyers about obligations and evidence, managers about cost and risk, and technical staff about rules and protocols. Priya acts as a translator, writing a one-page summary for each audience from the same design. The facts are identical; the emphasis changes. This skill is often more valuable than deep technical knowledge in small organisations, where the security practitioner must win support from people who will never read a configuration. She checks each summary with someone from that group.
Worked example
Priya produces three one-page summaries of the same design for clinical, legal and management readers.
Synthetic case. Meetings are synthetic.
Errors and limits
Presenting technical detail to non-technical decision makers usually delays decisions.
Exercises
- EX094 — Clinical constraint. How did clinical needs shape authentication for carts? Rubric: 3 = device certificates, no staff login mid-procedure;; 2 = certificates;; 1 = vague;; 0 = none.
- EX095 — Legal value of evidence. Why are test results useful to the data protection officer? Rubric: 3 = evidence that risks are managed;; 2 = evidence;; 1 = vague;; 0 = none.
- EX096 — Phased option. What cheaper first phase was offered to managers? Rubric: 3 = guest separation alone;; 2 = guest network;; 1 = vague;; 0 = none.
Synthesis
Security succeeds in organisations when it fits clinical work, legal duties and management priorities.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →