Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 The contained lab"]
  N2["12.2 Lab results"]
  N3["12.3 Interpreting the pattern"]
  N4["Lab — Record views outside the staff member's clinic"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 The contained lab"]
  N2["12.2 Lab results"]
  N3["12.3 Interpreting the pattern"]
  N4["Lab — Record views outside the staff member's clinic"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 The contained lab]
    |
    v
[12.2 Lab results]
    |
    v
[12.3 Interpreting the pattern]
    |
    v
[Lab — Record views outside the staff member's clinic]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) run a contained audit-log analysis; (2) interpret unusual access; (3) handle findings fairly.

12.1 The contained lab

Leila's first contained laboratory uses a synthetic copy of the practice-management audit log, prepared by the vendor's test tools and approved under her scope. The log records which staff account viewed which patient record and at which clinic. No real patients or staff appear. Mr. Okafor sets the rules: the lab runs on an isolated computer, results are shared only with the data protection officer and the instructor, and any names in conclusions refer to synthetic accounts only. Results never leave the isolated computer.

12.2 Lab results

The lab analyses 5,060 record views and finds 179 views, 3.5%, of patients registered at a clinic other than the staff member's own. Most staff have a handful of such views, which is expected because patients sometimes visit another clinic. One synthetic account, S07, has 53 outside views spread across several clinics, far more than anyone else; the next highest are S13 with 9 and S27 with 7. The pattern is unusual enough to justify a closer look, but it is not proof of misuse. Context decides what follows.

12.3 Interpreting the pattern

Leila lists possible explanations for S07: a role that covers several clinics, such as a regional nurse or a manager, a temporary assignment, a shared account, or curiosity about patients without a reason. She checks the synthetic staff list and finds S07 is a receptionist at one clinic. She does not conclude wrongdoing. Instead, she prepares a factual summary for the data protection officer, who in a real case would follow Marlow's investigation procedure, including speaking with the person and their manager.

12.4 Fairness and limits

Mr. Okafor emphasises that audit-log analysis affects staff, who also have privacy rights and a right to fair treatment. Staff must be told in their privacy notice that access is logged and reviewed. Thresholds must be applied consistently, and findings must be checked before any action. Leila notes the limits of her lab: the synthetic log has no information about legitimate cross-clinic tasks, so a real review would combine the log with rota and job information before drawing conclusions. Context protects staff from unfair suspicion.

Lab — Record views outside the staff member's clinic

"""Flag record views outside a staff member's own clinic in a synthetic audit log (stdlib only)."""
import random, collections
random.seed(5)
staff = {f"S{i:02d}": random.randint(1, 8) for i in range(40)}
log = []
for _ in range(5000):
    s = random.choice(list(staff)); home = staff[s]
    clinic = home if random.random() < 0.97 else random.randint(1, 8)
    log.append((s, clinic))
log += [("S07", c) for c in (2, 3, 4, 5, 6, 7, 8, 2, 3, 4, 5, 6) * 5]
out = [(s, c) for s, c in log if c != staff[s]]
per = collections.Counter(s for s, _ in out)
print(f"record views {len(log)}; outside own clinic {len(out)} ({100*len(out)/len(log):.1f}%)")
top = per.most_common(3)
print("top staff by outside views:", ", ".join(f"{s} {n}" for s, n in top))

Run with python3 lab_access.py. Verified output:

record views 5060; outside own clinic 179 (3.5%)
top staff by outside views: S07 53, S13 9, S27 7

Worked example

Leila finds 179 of 5,060 views (3.5%) outside staff members' clinics, identifies S07 with 53 outside views, lists explanations, and prepares a factual summary without concluding misuse.

Synthetic case. The audit log is synthetic.

Errors and limits

Unusual access is a signal, not proof; follow a fair procedure.

Exercises

• EX045 — Outside views. What share of views were outside the staff member's clinic?
  Show marking criteria

  Rubric: 3 = 179 of 5,060, 3.5%;; 2 = approximate;; 1 = wrong;; 0 = none.
• EX046 — Outlier. Which account stood out and with how many outside views?
  Show marking criteria

  Rubric: 3 = S07 with 53;; 2 = both;; 1 = one;; 0 = none.
• EX047 — Explanations. Name two possible explanations for S07's pattern.
  Show marking criteria

  Rubric: 3 = regional role, temporary assignment, shared account, curiosity;; 2 = two;; 1 = one;; 0 = none.
• EX048 — Staff rights. What must staff be told about audit logs?
  Show marking criteria

  Rubric: 3 = access is logged and reviewed;; 2 = partly correct;; 1 = vague;; 0 = none.