Chapter 12 — Security governance, risk and compliance: data flows

Chapter 12 — Security governance, risk and compliance: data flows

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Mapping flows"]
  N2["12.2 Third parties"]
  N3["12.3 Flow risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Mapping flows"]
  N2["12.2 Third parties"]
  N3["12.3 Flow risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Mapping flows]
    |
    v
[12.2 Third parties]
    |
    v
[12.3 Flow risks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) map flows of patient data; (2) identify third parties receiving data; (3) assess risks in each flow.

12.1 Mapping flows

Priya maps how patient data move: from patients via the booking site to the practice system, from clinics to the image archive, from dentists to laboratories, from reception to insurers for claims and from the practice system to backups. For each flow she records the data involved, the method and the recipient. The map shows eleven flows, three of which involve external parties beyond the practice system provider. The three external flows to laboratories, insurers and the booking site provider are examined in the next section.

12.2 Third parties

Laboratories, insurers and the booking site provider receive patient data. Priya checks whether each has a contract with data protection terms. Two laboratories have no written agreement. She recommends standard terms covering confidentiality, security and breach notification. She learns that third parties are often the weakest link in data flows because organisations assume suppliers protect data without checking. Standard terms for the two laboratories without agreements would also give Riverton a contractual right to be told of breaches. She also asks the booking site provider to confirm its own breach notification terms.

12.3 Flow risks

For each flow, Priya notes risks: misdirected laboratory emails, insurers receiving more data than needed and the booking site collecting medical history it does not need. She recommends reducing data at each step, using secure messaging and reviewing what the booking form asks. She learns that data flow analysis reveals risks invisible in an asset list, since harm often occurs while data move between systems and organisations. The booking form collecting medical history it does not need, for instance, can be fixed simply by removing fields.

Worked example

Priya maps eleven patient data flows, finds two laboratories without agreements and recommends data reduction at each step.

Synthetic case. Flows and parties are synthetic.

Errors and limits

Maps miss informal flows such as phone photos. Contracts do not guarantee practice.

Exercises

• EX034 — Flow count. How many data flows did Priya map? Rubric: 3 = eleven;; 2 = 11;; 1 = vague;; 0 = none.
• EX035 — Missing agreements. Which parties lacked written agreements? Rubric: 3 = two laboratories;; 2 = labs;; 1 = insurers;; 0 = none.
• EX036 — Booking form issue. What was wrong with the booking site? Rubric: 3 = it collected medical history it did not need;; 2 = excess data;; 1 = vague;; 0 = none.

Synthesis

Data flow maps reveal third-party and minimisation risks that asset lists miss.

Continue studying — chapter 12 of 30

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →