Case Study: Critiquing & Drafting a Policy

Clear: Section 3.1, “Staff must only use company-issued devices to access clinic systems.” Anyone can understand what is required: use the clinic’s devices, not your own.

Not clear: Section 3.3, “Remote connections must utilize a VPN client compliant with IPsec/IKEv2 protocols and an AES-256-GCM cipher suite.” It is mandatory, but it is written in technical jargon. A receptionist or nurse cannot tell what they must do (install a particular app? press a button?). It breaks Clear to Non-Technical Staff; that detail belongs in an IT standard or procedure, while staff should be told something like “Always connect to the clinic VPN app before opening clinic systems from outside the office.”

The Purpose and Scope are also vague: “help protect clinic information” names no specific risk, and “staff who use clinic technology” does not say whether contractors, volunteers or vendors are included, or which systems are covered.

Clear: 3.1. Unclear: 3.3 (jargon), plus a vague Purpose and Scope.

They are not equally strict. Sorting by wording:

Only two of six rules are actually mandatory.

Checking one rule, 3.6 (“Lost or stolen devices should be reported as soon as possible”): it cannot realistically be enforced. “Should” makes reporting optional, and “as soon as possible” has no deadline, so a staff member who reports a stolen laptop three days later can claim they reported it as soon as was possible for them. An auditor has no measurable bar to check against.

Fix: “Staff must report a lost or stolen device to IT within 1 hour of discovering the loss.” The report time can then be compared with the time of discovery.

(By contrast, 3.1 can be checked: IT can review login records to see whether any non-clinic device has connected to clinic systems.)

The rules are inconsistently strict; 3.6 is unenforceable as written because “should” and “as soon as possible” set no checkable requirement.

The two rules contradict each other:

• 3.1: staff must only use company-issued devices to access clinic systems.
• 3.4: personal devices may be used to check clinic email.

Clinic email is a clinic system, so 3.4 allows exactly what 3.1 forbids. A staff member cannot obey both, and when rules conflict, people tend to follow the more convenient one. The exception in 3.4 is also vague: “with prior approval from IT, as necessary” does not say who in IT approves, on what criteria, or what security a personal device must have.

3.1 and 3.4 contradict each other (only company devices vs. personal devices allowed for email), leaving a loophole and making both rules unenforceable.

Ownership is not clear. The header says “Owner: Information Technology”, which is a department, not a role; no named person (e.g. an IT Manager or Security Officer) is accountable. Section 4 says IT is “responsible for supporting” the policy and staff are “expected to cooperate”, which does not say who approves it, who enforces it or who checks compliance. There is also no approver signature.

Six-part check:

Accountability is unclear (owner is a department, not a role), and the policy has only five of the six parts: the Review Date is missing.

Fix first: the contradiction between 3.1 and 3.4.

Why this one: every other weakness makes a rule weaker; the contradiction makes the policy impossible to obey as a whole and opens a direct loophole: patient information can flow through email onto unmanaged personal phones, which is exactly the remote-work risk the policy exists to control. It also undermines enforcement: a staff member disciplined under 3.1 can point to 3.4.

The fix: make 3.4 an explicit, controlled exception to 3.1 rather than a contradiction.

3.1. Staff must only use clinic-issued devices to access clinic systems, except as permitted in 3.4.

3.4. Staff may access clinic email (and no other clinic system) on a personal phone only after the IT Manager has approved the device in writing and enrolled it in the clinic’s device-management app, which requires a screen lock and allows IT to remotely erase clinic data if the phone is lost.

Checking the fix against the principles: Mandatory (“must”, “only after”), Specific (email only; named approver; named conditions), Enforceable (IT can check the approval record and the enrolment list), Clear (no jargon), Practical (staff can still read email on their phones).

Other defensible first fixes, if well argued: replacing every “should” with “must” plus a deadline (e.g. report lost devices within 1 hour), naming an accountable role as owner, or adding the missing Review Date.

Model answer: resolve the 3.1/3.4 contradiction by turning 3.4 into a narrow, approved, checkable exception.

Model choice: Standard.

1. MediCare Plus already has the top-level policy: “MediCare Plus Hospital shall protect the confidentiality, integrity, and availability of all patient health information” (approved by the Board). The broad intent already exists.
2. What is missing is a specific, measurable, mandatory requirement for this one situation: how printed results must be collected and how long they may sit on a printer. That is the definition of a standard (see 4.1).
3. A standard sets the same bar for everyone, everywhere in scope, so every ward and every hallway printer follows the same rule, and compliance can be measured (time on printer, release logs, spot checks).
4. A standard is set by IT Management and applies hospital-wide, so it can be issued quickly without a Board meeting.

A Policy is also a defensible choice if it is written as broad intent (e.g. “Printed patient information must be protected from unauthorized viewing at all times”) and the group explains that measurable detail would follow in a standard. The key is that the choice matches what is written: a policy without numbers, or a standard with them.

Standard: the broad policy already exists, and this risk needs a specific, measurable rule that applies the same way at every printer.

PRINTED PATIENT INFORMATION STANDARD: MediCare Plus Hospital

Owner: IT Manager · Approved by: CISO · Version 1.0

1. Purpose. Printed patient lab results are being left unattended on shared hallway printers, sometimes for over an hour, where any passerby can read them (Risk Level: High). This standard ensures that printed patient information is seen only by the authorized staff member who printed it, protecting patient confidentiality as required by the hospital’s Information Security Policy and the PDPA.

2. Scope. Applies to all MediCare Plus employees, contractors, students and agency staff who print documents containing patient information (including lab results), and to every shared printer and multifunction device located in hallways, wards and other areas accessible to patients or visitors.

3. Standard Statement.

3.1. All shared printers in scope must be set to secure release: a print job containing patient information is held and only prints when the staff member taps their staff ID badge (or enters their personal PIN) at the printer.

3.2. Staff must collect printed patient documents immediately when they are released and must never leave them unattended on or near a printer.

3.3. Print jobs that are not released within 4 hours must be deleted automatically from the printer queue.

3.4. Any staff member who finds a patient document unattended on a printer must take it to the nurses’ station of that area immediately and hand it to the Ward Charge Nurse, who places it in the locked confidential-waste bin and records it in the ward incident log.

3.5. The Ward Charge Nurse must check each shared printer in their area for uncollected documents at the start of every shift.

4. Roles & Responsibilities.

• IT Manager (owner): configures and maintains secure release on all in-scope printers; reviews printer release logs monthly.
• Ward Charge Nurses / Department Heads (enforcement): carry out the start-of-shift printer checks and keep the ward incident log.
• CISO: approves this standard and audits compliance quarterly using release logs and incident logs.
• All staff in scope: comply with sections 3.2 and 3.4.

5. Compliance & Enforcement. Each unattended patient document is recorded against the staff member who printed it (identified from the release log). A first violation results in a documented reminder and retraining by the Department Head. A second violation within 12 months is reported to the CISO and HR and results in disciplinary action under HR policy.

6. Review Date. This standard is reviewed annually (next review: one year from the effective date), or immediately after any incident in which printed patient information is exposed.

Why the statement works: it uses must throughout; every requirement is measurable (badge release, 4-hour deletion, start-of-shift checks); compliance can be checked from release logs and incident logs; it is written in plain language a nurse understands (“tap your staff ID badge”); and it is practical, because staff still use the nearby hallway printers and simply release jobs when they are standing at them.

All five checks pass. A draft that says, for example, “staff should collect printouts promptly” would fail Mandatory and Specific, and one that requires “a staff member guarding each printer at all times” would fail Practical.

Confidentiality means information is disclosed only to people authorized to see it. With secure release, a patient’s lab results are printed only when the authorized staff member who requested them is physically at the printer, and any document that does slip through is collected and logged rather than left for an hour in a public hallway, so patients, visitors and unauthorized staff passing by can no longer read them. Because every release is logged to an individual, any exposure that still happens can be traced and corrected, which also supports the hospital’s legal duty to keep patient health information confidential.