Human and organisational factors in cybersecurity: applying STAMP to explore vulnerabilities

The human and organisational factors contributing to information security are still poorly understood, primarily due to a lack of research and absence of suitable techniques to assess complex digital systems. This paper presents the application of the System-Theoretic Accident Models and Process (STAMP) technique to the 2013/2014 Target Corporation data breach. The aims of the study are to investigate the causal factors using a systemic approach, and to demonstrate the benefits of the technique to information security applications. A number of critical control flaws were identified through the STAMP analysis include: i) poor external and internal communication/co-ordination of new threats and vulnerabilities; ii) inadequate learning from past events, internally and externally; iii) a lack of proactive security management to understand and learn from system successes and good practices as well as system failures; iv) ineffective management and co-ordination with the supply chain and their security systems

More converts into Rasmussen? Impact of a story-based animation on systems safety

More converts into Rasmussen? Impact of a story-based animation on systems safet

Noticing errors in blood transfusion prevents harm to patients

Errors in blood transfusion can lead to serious patient harm, including death or major morbidity, especially as a result of ABO incompatibility. The transfusion process is a complex sociotechnical system and relies on multidisciplinary teams (MDT) of healthcare professionals, hence there are many opportunities for error. Serious Hazards of Transfusion (SHOT) is the United Kingdom (UK) independent, professionally-led haemovigilance scheme, which has collected and analysed anonymised information on adverse events and reactions in blood transfusion since 1996. The emphasis has been to learn from what goes wrong in these incidents, but the recent development of the safety II concept helped to see the importance of learning from what goes right. Investigation of near miss errors (what eventually goes right) can show where resilience/recovery within the transfusion process could be enhanced. Therefore, SHOT near miss incidents in calendar years 2014 and 2015 were analysed for how noticing actions prevented harm to patients, including what was noticed, by whom and what action they took. To do this, the near miss reports were searched for the words notice/noticed/noticing and various synonyms of these words. A total of 778/2410 (32.3%) near miss incident reports showed noticing actions had prevented patent harm. Of these, 552/778 (71.0%) were noticed by clinical staff and 226/778 (29.0%) by laboratory staff. Clinical staff performing the final ‘bedside check’ before administering the transfusion are the largest group to notice errors 327/552 (59.2%), showing the final check is crucial to patient safety. Noticing actions can prevent transfusion-related patient harm and demonstrate the value of situation awareness throughout the complex transfusion process

Safety I and Safety II for suicide prevention – Lessons from how things go wrong and how things go right in community-based mental health services [Abstract]

Safety I and Safety II for suicide prevention – Lessons from how things go wrong and how things go right in community-based mental health services [Abstract

Ethical issues in designing interventions for behavioural change

This paper reflects on fundamental ethical issues concerning designing for behavioural change, in order to raise questions about the factors that should be considered by design practitioners when developing interventions. It draws on existing literature on philosophical ethics, moral psychology and design. It proposes a list of ethical questions and considerations to be made throughout the design process. A case study addressing behavioural changes in antibiotics prescriptions (for Urinary Tract Infections) was carried out to demonstrate how the ethical questions identified are asked and considered. We provide a framework for addressing these issues with the hope that it will help minimise the risk of problematic and unethical intervention design processes

Participatory design for behaviour change: An integrative approach to healthcare quality improvement

Behaviour insights have been extensively applied to public policy and service design. The potential for an expanded use of behaviour change to healthcare quality improvement has been underlined in the England’s National Health Service Five-Year Forward View report, in which staff behaviour is connected to the quality of care delivered to patients and better clinical practice (NHS, 2014). Improving the quality of healthcare service delivery involves adopting improvement cycles that are conducted by multiple agents through systematic processes of change and evaluation (Scoville et al., 2016). Despite the recognition that some of the recurring challenges to improve healthcare services are behavioural in essence, there is insufficient evidence about how behavioural insights can be successfully applied to quality improvement in healthcare. Simultaneously, the discussion on how to better engage participants in intervention design, and how to better enable participation are not seen as fundamental components of behaviour change frameworks. This paper presents an integrative approach, stemming from comprehensive literature review and an ongoing case study, in which participatory design is used as the conduit to activate stakeholder engagement in the application of a behaviour change framework, aiming to improve the processes of diagnosing and managing urinary tract infection in the emergency department of a hospital in England. Preliminary findings show positive results regarding the combined use of participatory design and behaviour change tools in the development of a shared-vision of the challenges in question, and the collaborative establishment of priorities of action, potential solution routes and evaluation strategies

“Tough Love”: Unpacking the dynamics of Turner’s stage 6 (cultural readjustment)

This study examines the perceptions and attitudes of RAF personnel following the 2006 fatal loss of Nimrod XV230 and subsequent Public Inquiry. The main focus was “cultural readjustment” and organisational learning. Phase 1 was carried out in 2010-2011 (18-month aftermath following the Haddon-Cave report) and Phase 2 in 2016 using follow up interviews, focus groups, observations and document analysis. The results point to a number of barriers to change in the early days post-inquiry, including fear of litigation and risk aversion, a military culture of ‘can-do’, normalized rule-breaking and insufficient safety expertise. Facilitators include leadership and followership, publicity and training and an enhanced regulatory framework. Ongoing disrupting factors were identified that may make the organisation vulnerable e.g. churn of critical personnel. The study suggests that organisations settle into a new quasi-stationary equilibrium following disaster, which may provide the ‘illusion’ of safety through increased safety bureaucracy

Towards effective and efficient participatory systems approaches to healthcare work system design

Context: The study is focused on patient and public involvement in the regional service development process in one county in the UK, with a wider scope provided through review of literature. Objectives: The research has two main objectives: firstly to investigate the current state of service user and staff participation in the regional health service development process in the UK; and secondly to critically analyse the level of participation and systems awareness in the participatory methods used. Methodology: A single case descriptive case study is used alongside a scoping review of relevant literature that follows a systematic approach. Main results: The case study explored a complex service development process with the main findings being: i) varied levels of collaboration between multiple organisations of commissioners, providers and user representatives; ii) incomplete information loops with an unclear structure of information flow from service user/staff into the development process and a lack of feedback on changes made to service users; iii) difficulties in representing the views of a diverse population of service users, compounded by some single issue focus amongst service development participants; iv) an engagement gap with staff for service development events. The literature review uncovered practical issues in the application of participatory approaches and a lack of application of systems methods and models in the most widely used participatory approaches. Conclusion: The review of literature and description of practice found a gap between the practical application of participatory approaches in healthcare system design and theory on systems approaches to healthcare. We propose it would be beneficial to bridge the gap between structured systems approaches to healthcare system design and the current efforts of participatory design occurring in practice

Critical care outreach: impacts of electronic observations and alerting technology

Information technology is an increasingly pervasive aspect of the healthcare environment, but introduction of new technology into complex systems like healthcare can create new opportunities for failure. Whilst literature on the unintended consequences of technology is extensive, less is known about the impacts it has on clinical work and patient safety. This paper reports the findings of a case study conducted at a large National Health Service trust in England, where electronic observations and alerting technology was introduced to replace paper charts. Using a qualitative approach, the study aimed to explore the impacts of this technology on a critical care outreach team’s performance and patient safety. Data from observation and 10 semi-structured interviews with critical care outreach nurses were thematically analysed. The new technology has not only changed the way that patient observations data is recorded, displayed and viewed, it has also introduced a new mode of communication between groups of clinical staff: electronic alerts. Four main themes emerged that characterise the main changes brought about by the technology: communication, situation awareness, professional issues and workload. The relationship between aspects of these themes and patient safety was not perceived to be straightforward

Can we enhance transfusion incident reporters’ awareness of human and organisational factors?

The importance of considering human/organisational factors when reporting transfusion incidents has been highlighted recently. The UK haemovigilance scheme, Serious Hazards of Transfusion (SHOT), has established over the past two decades that most incidents are caused by human errors in the transfusion process. In order to enhance reporter’s awareness of human and organisational factors, we implemented two interventions and evaluated the effects. First, we created and incorporated a bespoke human factors investigation tool (HFIT) explicitly asking the level of contribution of individual staff member(s), the local environment or workspace, organisational or management and government or regulation. Second, we created and incorporated a self-learning package with good examples of human and organisational factors reporting within the UK national haemovigilance reporting database. Data from this tool have been analysed to investigate whether increased learning is possible. The main conclusion after one year’s use of the HFIT, was that incident reporters tended to attribute culpability mostly to individuals (62.6%). It is possible this result is due to lack of system awareness amongst incident reportersSix month initial data analysis after the inclusion of the self-learning package shows that if the incident reporter has studied the self-learning package before scoring the level of contribution associated with an incident , there is a slightly lower tendency to attribute most responsibility to individuals