Chapter 6 — Identity and access
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Roles"]
N2["6.2 Emergency access"]
N3["6.3 Access reviews"]
N4["6.4 Privileged and remote access"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Roles"]
N2["6.2 Emergency access"]
N3["6.3 Access reviews"]
N4["6.4 Privileged and remote access"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 Roles]
|
v
[6.2 Emergency access]
|
v
[6.3 Access reviews]
|
v
[6.4 Privileged and remote access]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) design role-based access for clinical systems; (2) review access across sites; (3) protect privileged and remote access.
6.1 Roles
Elena designs roles for the patient record system: dentist, hygienist, dental nurse, receptionist, clinic manager and central administrator. Each role has defined permissions. Receptionists see appointments and contact details but not clinical notes; nurses see clinical notes for patients at their clinic. Previously, many staff had broad access copied from colleagues. Dr. Qureshi notes that clinical environments need quick access in emergencies, so roles must be designed with clinicians, not imposed on them. She runs two workshops with clinicians to test the roles.
6.2 Emergency access
Clinicians sometimes need records from another clinic, for example when a patient attends an unfamiliar site. Elena designs break-glass access: staff can open such a record after stating a reason, the action is logged and the clinical lead reviews a weekly report. Most uses are legitimate. Dr. Qureshi explains that break-glass access balances patient care with privacy, provided reviews actually happen and staff know they do. The clinical lead reviews the first month's report and finds every use explained, which reassures staff and patients' representatives. Elena records the review in the security committee minutes.
6.3 Access reviews
Elena runs quarterly reviews comparing system accounts with the staff list from human resources. The first review finds former staff with active accounts, mostly locum dentists whose contracts ended. She adds locum end dates to the human resources system so accounts expire automatically. She learns that temporary staff are a common source of leftover access in clinical settings. The first review takes two days; she expects later reviews to be faster as leftover accounts are cleared. The second review, three months later, finds only one former staff account, which belonged to a locum whose end date had been entered incorrectly.
6.4 Privileged and remote access
Central administrators and suppliers hold powerful access. Elena requires separate administrator accounts with hardware security keys, and supplier access only through a managed gateway with multi-factor authentication and recorded sessions. She removes shared administrator passwords. She notes that Saltzer and Schroeder's principle of least privilege and NIST SP 800-53 Revision 5 access control guidance both support these measures. Dr. Qureshi asks her to measure enrolment. Within a month, all central administrators use hardware keys, and the three suppliers with remote access use the gateway. She reports the enrolment figures to the security committee.
Worked example
Elena designs six clinical roles with clinicians, adds logged break-glass access, links locum end dates to account expiry and protects privileged and supplier access.
Synthetic case. Systems are synthetic.
Errors and limits
Copying colleagues' access spreads excess rights across clinics.
Exercises
- EX026 — Receptionist view. What can receptionists see? Rubric: 3 = appointments and contact details;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX027 — Break-glass review. Who reviews break-glass use? Rubric: 3 = the clinical lead weekly;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX028 — Leftover access. Which staff most often kept access? Rubric: 3 = locum dentists;; 2 = partly correct;; 1 = other;; 0 = none.
- EX029 — Admin factor. What protects administrator accounts? Rubric: 3 = hardware security keys;; 2 = partly correct;; 1 = other;; 0 = none.
- EX030 — Supplier gateway. How do suppliers connect? Rubric: 3 = managed gateway with MFA and recorded sessions;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 06 (chapter 06 of 12)
← Chapter 05 · Course chapter index · Chapter 07 →
Continue to the next authored lesson.