Chapter 12 — Human factors and cyber policy: data flows

Chapter 12 — Human factors and cyber policy: data flows

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Mapping flows"]
  N2["12.2 Pressure points"]
  N3["12.3 Safer flows"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Mapping flows"]
  N2["12.2 Pressure points"]
  N3["12.3 Safer flows"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Mapping flows]
    |
    v
[12.2 Pressure points]
    |
    v
[12.3 Safer flows]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) map how patient and payment data flow between people and systems; (2) find points where people handle data under pressure; (3) propose safer flows.

12.1 Mapping flows

Lucas maps data flows at Brightwell. Patient details flow from booking forms to the practice system, then to clinicians and to insurers for claims. Payment data flow from patients to card terminals and from invoices to the bank. Lucas draws each flow with the people involved at each step. He finds that some patient letters are emailed to external specialists from personal email accounts when the practice system is slow, which bypasses protections and leaves copies outside Brightwell's control. He shares the map with the practice manager.

12.2 Pressure points

Lucas marks steps where people handle data under pressure. Receptionists copy details between systems during busy periods. Managers process supplier invoices at month-end. Clinicians send referrals at the end of sessions. At each point, an error or deception is more likely because attention is divided. He notes that the personal email workaround happens because the official method takes several minutes, while personal email takes seconds, showing again that convenience drives behaviour when security adds too much effort. He marks each point in red on the map.

12.3 Safer flows

Lucas proposes safer flows. A secure referral template inside the practice system that sends to registered specialists with one click replaces personal email. Invoices with changed bank details are held automatically for callback. Copying between systems is reduced by linking the booking and practice systems. Each change makes the safe route also the quickest route. He presents the proposals with estimated time savings, which persuades the practice manager more than security arguments alone. The practice manager asks the vendor to quote for the integration work and schedules it for the next quarter.

Worked example

Lucas maps patient and payment flows, identifies pressure points and the personal email workaround and proposes faster safe routes.

Synthetic case. Flows are synthetic.

Errors and limits

System integration may be costly. Specialists must be registered.

Exercises

• EX034 — Workaround cause. Why do staff use personal email for letters? Rubric: 3 = the official method takes minutes and personal email seconds;; 2 = speed;; 1 = vague;; 0 = none.
• EX035 — Referral fix. What replaces the personal email workaround? Rubric: 3 = a one-click secure referral template;; 2 = template;; 1 = vague;; 0 = none.
• EX036 — Persuasive argument. What persuaded the practice manager most? Rubric: 3 = estimated time savings;; 2 = time;; 1 = security;; 0 = none.

Synthesis

Safer flows make the secure route the quickest route.

Continue studying — chapter 12 of 30

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →