◇ OpenCyber Academy
Professional · Chapter 2 · English

Chapter 2 — Patient safety, contingency and authority

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Patient safety, contingency and authority

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Clinical safety first"]
  N2["2.2 Contingency already exists"]
  N3["2.3 Authority"]
  N4["2.4 Permits in hospitals"]
  N5["2.5 Talking to clinicians"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Clinical safety first"]
  N2["2.2 Contingency already exists"]
  N3["2.3 Authority"]
  N4["2.4 Permits in hospitals"]
  N5["2.5 Talking to clinicians"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Clinical safety first]
    |
    v
[2.2 Contingency already exists]
    |
    v
[2.3 Authority]
    |
    v
[2.4 Permits in hospitals]
    |
    v
[2.5 Talking to clinicians]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) explain why clinical safety outranks security convenience; (2) describe hospital contingency arrangements for building systems; and (3) identify who may authorise changes in clinical areas.

2.1 Clinical safety first

A security fix that switches off a theatre's ventilation during surgery is worse than the risk it fixes. Every security task in clinical areas is planned with the people responsible for patients, and timed around them.

In practice this means asking the theatre manager when lists run before booking any work on AHU-OT1 or AHU-OT2, and choosing a time when no patient depends on the system. A delay of a few days to reach a safe slot is normally acceptable. A security change made in a hurry during surgery is not.

2.2 Contingency already exists

Hospitals prepare for building failures independent of cyber attacks: cylinder oxygen when piped supply fails, portable cooling, manual door keys, elevator rescue procedures. These are also the fall-back when a networked system is untrusted. Knowing them lets security staff suggest isolating a system without leaving patients unsupported.

Ask estates when each fall-back was last exercised and who would start it at night. A cylinder supply that nobody has checked, or manual keys that cannot be found, is not a fall-back. Writing these arrangements beside each system in the inventory lets security staff propose isolation in an incident knowing what will keep patients safe meanwhile.

2.3 Authority

Estates managers authorise work on building plant; theatre managers decide when a theatre is available; the medical gas authorised person controls gas systems; IT security advises. Contractors work under an estates permit. Analysts never instruct a contractor to change a clinical system directly.

For Aisha this means every request goes through the person with authority. If she finds a weak password on a controller, she reports it to the estates manager, who arranges for the contractor to change it under a permit. Instructing the contractor directly, even with good intent, bypasses the checks that protect patients and leaves no record of who approved the change.

2.4 Permits in hospitals

Work in clinical areas often needs infection-control approval as well as an estates permit: a technician opening a ceiling panel in a theatre can release dust. Even a non-invasive check may need a booking slot.

Ask early what approvals a task needs, because a booking slot for a theatre plant room can take days to agree. Aisha's firmware check needed an estates permit, the theatre manager's confirmation and a contractor escort. Note each approval in the work record, and close the permit when the work ends, even when nothing was changed.

2.5 Talking to clinicians

Explain security work in the language of patient risk and theatre time. "We need one hour on Saturday so nobody can change theatre air from outside" gets agreement faster than a list of protocols.

Ask clinicians what would worry them, such as an unplanned temperature change during an operation, and connect the security work to that worry. Keep requests short and concrete: which theatre, which hour, what will happen and how it will be checked. Report back after the work, so the next request is easier to agree.

Worked example (synthetic Millbrook)

Aisha wants to read firmware labels on the theatre air-handling controllers in the roof plant room. The estates manager issues a permit for Saturday 07:00–08:00 when no theatre lists run; the theatre manager confirms; a contractor accompanies her; no settings are touched. She photographs the labels and the permit is closed at 07:40.

Synthetic case — Millbrook. The permit and times are invented.

Errors and limits

Local roles have different titles; learn your hospital's list. Contingency plans may be untested; ask when they were last exercised.

Exercises

Synthesis

Clinical safety sets the timing; contingency plans make security actions possible; named roles authorise them.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →