Chapter 3 — Operating systems and identities | Technical Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Accounts on clinic computers"]
  N2["3.2 Least privilege"]
  N3["3.3 Administrator rights"]
  N4["3.4 Joiners and leavers"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Accounts on clinic computers"]
  N2["3.2 Least privilege"]
  N3["3.3 Administrator rights"]
  N4["3.4 Joiners and leavers"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Accounts on clinic computers]
    |
    v
[3.2 Least privilege]
    |
    v
[3.3 Administrator rights]
    |
    v
[3.4 Joiners and leavers]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) configure accounts on clinic computers; (2) apply least privilege; (3) manage shared and departing accounts.

3.1 Accounts on clinic computers

Reception computers at Marlow were set up years ago with one shared login per clinic. Leila explains to the practice managers that shared accounts make it impossible to tell who opened a patient record, which undermines both security and accountability under Article 5(2). With the IT contractor, she plans individual accounts for each staff member, linked to the central directory, with automatic screen locking after five minutes. She tests the change with synthetic patients at one clinic before the contractor rolls it out elsewhere.

3.2 Least privilege

Leila reviews roles in the practice-management system. Receptionists need appointments, contact details and payment status, but not treatment notes. Dental nurses need notes for the patients they assist. Dentists need full clinical records for their patients. Managers need reports. She finds that all receptionists currently have clinical access because a default role was copied years ago. She proposes narrower roles, and the practice manager approves them after Leila shows that reception tasks still work with synthetic records. Nurses keep access only to their own clinic's patients.

3.3 Administrator rights

On clinic computers, staff accounts had local administrator rights so that they could install printer drivers. Leila explains that administrator rights let malware spread and let users install unapproved software that might send data elsewhere. She removes the rights in the pilot clinic and creates a short procedure for printer installation by the contractor. The change reduces the number of administrator accounts from twenty-three to four, and she records each remaining account with its owner and justification. The contractor now installs drivers remotely.

3.4 Joiners and leavers

Dental clinics use locum staff for short periods. Leila finds accounts for locums who left months ago still active. She links account creation and removal to the rota system, so each locum account has an end date and is disabled automatically. For permanent staff, removal is triggered by the HR leaver form. She runs a monthly report comparing active accounts with current staff and sends differences to practice managers, keeping the reports as evidence that the control operates. The first report finds six expired locum accounts.

Worked example

Leila replaces shared logins with individual accounts, narrows reception roles away from clinical notes, removes local administrator rights and links locum accounts to rota end dates.

Synthetic case. Accounts and roles are synthetic; GDPR Article 5(2) is real.

Errors and limits

Narrow roles can block urgent tasks; define a recorded emergency access route.

Exercises

EX009 — Shared login problem. Why are shared logins a privacy problem?
Show marking criteria
Rubric: 3 = nobody can tell who opened a record;; 2 = mentions accountability;; 1 = vague;; 0 = none.
EX010 — Reception access. What does reception need in the practice system?
Show marking criteria
Rubric: 3 = appointments, contact details, payment status;; 2 = most;; 1 = notes;; 0 = none.
EX011 — Admin count. How many administrator accounts remained?
Show marking criteria
Rubric: 3 = four of twenty-three;; 2 = partly correct;; 1 = wrong;; 0 = none.
EX012 — Locum control. How are locum accounts controlled now?
Show marking criteria
Rubric: 3 = end dates linked to the rota;; 2 = mentions end date;; 1 = vague;; 0 = none.