Human and organisational factors in cybersecurity: applying STAMP to explore vulnerabilities

The human and organisational factors contributing to information security are still poorly understood, primarily due to a lack of research and absence of suitable techniques to assess complex digital systems. This paper presents the application of the System-Theoretic Accident Models and Process (STAMP) technique to the 2013/2014 Target Corporation data breach. The aims of the study are to investigate the causal factors using a systemic approach, and to demonstrate the benefits of the technique to information security applications. A number of critical control flaws were identified through the STAMP analysis include: i) poor external and internal communication/co-ordination of new threats and vulnerabilities; ii) inadequate learning from past events, internally and externally; iii) a lack of proactive security management to understand and learn from system successes and good practices as well as system failures; iv) ineffective management and co-ordination with the supply chain and their security systems

More converts into Rasmussen? Impact of a story-based animation on systems safety

More converts into Rasmussen? Impact of a story-based animation on systems safet

Safety I and Safety II for suicide prevention – Lessons from how things go wrong and how things go right in community-based mental health services [Abstract]

Safety I and Safety II for suicide prevention – Lessons from how things go wrong and how things go right in community-based mental health services [Abstract

Noticing errors in blood transfusion prevents harm to patients

Errors in blood transfusion can lead to serious patient harm, including death or major morbidity, especially as a result of ABO incompatibility. The transfusion process is a complex sociotechnical system and relies on multidisciplinary teams (MDT) of healthcare professionals, hence there are many opportunities for error. Serious Hazards of Transfusion (SHOT) is the United Kingdom (UK) independent, professionally-led haemovigilance scheme, which has collected and analysed anonymised information on adverse events and reactions in blood transfusion since 1996. The emphasis has been to learn from what goes wrong in these incidents, but the recent development of the safety II concept helped to see the importance of learning from what goes right. Investigation of near miss errors (what eventually goes right) can show where resilience/recovery within the transfusion process could be enhanced. Therefore, SHOT near miss incidents in calendar years 2014 and 2015 were analysed for how noticing actions prevented harm to patients, including what was noticed, by whom and what action they took. To do this, the near miss reports were searched for the words notice/noticed/noticing and various synonyms of these words. A total of 778/2410 (32.3%) near miss incident reports showed noticing actions had prevented patent harm. Of these, 552/778 (71.0%) were noticed by clinical staff and 226/778 (29.0%) by laboratory staff. Clinical staff performing the final ‘bedside check’ before administering the transfusion are the largest group to notice errors 327/552 (59.2%), showing the final check is crucial to patient safety. Noticing actions can prevent transfusion-related patient harm and demonstrate the value of situation awareness throughout the complex transfusion process

Can we enhance transfusion incident reporters’ awareness of human and organisational factors?

The importance of considering human/organisational factors when reporting transfusion incidents has been highlighted recently. The UK haemovigilance scheme, Serious Hazards of Transfusion (SHOT), has established over the past two decades that most incidents are caused by human errors in the transfusion process. In order to enhance reporter’s awareness of human and organisational factors, we implemented two interventions and evaluated the effects. First, we created and incorporated a bespoke human factors investigation tool (HFIT) explicitly asking the level of contribution of individual staff member(s), the local environment or workspace, organisational or management and government or regulation. Second, we created and incorporated a self-learning package with good examples of human and organisational factors reporting within the UK national haemovigilance reporting database. Data from this tool have been analysed to investigate whether increased learning is possible. The main conclusion after one year’s use of the HFIT, was that incident reporters tended to attribute culpability mostly to individuals (62.6%). It is possible this result is due to lack of system awareness amongst incident reportersSix month initial data analysis after the inclusion of the self-learning package shows that if the incident reporter has studied the self-learning package before scoring the level of contribution associated with an incident , there is a slightly lower tendency to attribute most responsibility to individuals

Participatory design for behaviour change: An integrative approach to healthcare quality improvement

Behaviour insights have been extensively applied to public policy and service design. The potential for an expanded use of behaviour change to healthcare quality improvement has been underlined in the England’s National Health Service Five-Year Forward View report, in which staff behaviour is connected to the quality of care delivered to patients and better clinical practice (NHS, 2014). Improving the quality of healthcare service delivery involves adopting improvement cycles that are conducted by multiple agents through systematic processes of change and evaluation (Scoville et al., 2016). Despite the recognition that some of the recurring challenges to improve healthcare services are behavioural in essence, there is insufficient evidence about how behavioural insights can be successfully applied to quality improvement in healthcare. Simultaneously, the discussion on how to better engage participants in intervention design, and how to better enable participation are not seen as fundamental components of behaviour change frameworks. This paper presents an integrative approach, stemming from comprehensive literature review and an ongoing case study, in which participatory design is used as the conduit to activate stakeholder engagement in the application of a behaviour change framework, aiming to improve the processes of diagnosing and managing urinary tract infection in the emergency department of a hospital in England. Preliminary findings show positive results regarding the combined use of participatory design and behaviour change tools in the development of a shared-vision of the challenges in question, and the collaborative establishment of priorities of action, potential solution routes and evaluation strategies

“Tough Love”: Unpacking the dynamics of Turner’s stage 6 (cultural readjustment)

This study examines the perceptions and attitudes of RAF personnel following the 2006 fatal loss of Nimrod XV230 and subsequent Public Inquiry. The main focus was “cultural readjustment” and organisational learning. Phase 1 was carried out in 2010-2011 (18-month aftermath following the Haddon-Cave report) and Phase 2 in 2016 using follow up interviews, focus groups, observations and document analysis. The results point to a number of barriers to change in the early days post-inquiry, including fear of litigation and risk aversion, a military culture of ‘can-do’, normalized rule-breaking and insufficient safety expertise. Facilitators include leadership and followership, publicity and training and an enhanced regulatory framework. Ongoing disrupting factors were identified that may make the organisation vulnerable e.g. churn of critical personnel. The study suggests that organisations settle into a new quasi-stationary equilibrium following disaster, which may provide the ‘illusion’ of safety through increased safety bureaucracy

Ethical issues in designing interventions for behavioural change

This paper reflects on fundamental ethical issues concerning designing for behavioural change, in order to raise questions about the factors that should be considered by design practitioners when developing interventions. It draws on existing literature on philosophical ethics, moral psychology and design. It proposes a list of ethical questions and considerations to be made throughout the design process. A case study addressing behavioural changes in antibiotics prescriptions (for Urinary Tract Infections) was carried out to demonstrate how the ethical questions identified are asked and considered. We provide a framework for addressing these issues with the hope that it will help minimise the risk of problematic and unethical intervention design processes

Can we learn about human and organisation factors from past transfusion errors?

Seven human factors models were evaluated using a small number of historical transfusion error reports to explore learning from human and organisation factors and decide the best model for a planned larger retrospective study. Insufficient information given in many reports led to subjectivity in categorisation, but the conclusion was that systems engineering initiative for patient safety 2.0 may be the best single system to use. Analysing the human factors effectively in transfusion incidents could provide some insights into process improvement

Collisions at sea: A systems analysis of casual factors and countermeasures

Despite established and proven prescriptive safety legislation, accidents regularly occur across all sectors of shipping. Of particular concern is the number of collisions that continue to occur, even when experienced and trained officers are on board and modern navigation aids are in use. Using a systems approach, this paper will highlight common contributory factors, which can lead to collisions and then propose a set of countermeasures which can be used to reduce these types of shipping accidents