Interne toegang ruimer dan de functie
Iedereen met een account kan elk dossier openen, omdat de toegang het systeem volgt en niet de taak.
- Familie
- Gegevens
- Status
- actief
- Geldt voor
- backend
Wat er gebeurt
Accounts are created with a role that grants the whole set: every patient, every client, every case. The system supports narrower roles, and configuring them requires knowing who needs what, so the broad role is granted and stays. Access logging is switched on, and nobody reads it unless something has already gone wrong.
Waarom het ertoe doet
Whether a record is opened then depends on the curiosity of whoever holds an account rather than on whether they have anything to do with it. That is the mechanism behind most incidents involving people who are known locally, and behind the silence of people who would rather not tell their care provider something. The person cannot see who opened their file and usually learns of it only because somebody talked.
Veelvoorkomende oorzaken
- role model taken from the supplier's default and never narrowed
- emergency access granted permanently instead of per case
- temporary staff added to an existing broad role because that is quicker
- access logging switched on without anyone reviewing it
Dit is het níet
Data reaching a party outside the organisation is covered by the entries for that recipient; this one stays inside. Keeping records longer than the term is a retention question. The fault here is that the number of people who can reach a record follows the system's default rather than what each of them does.
Hoe je het vaststelt
Indicator
The authorisation configuration exported from the system shows a role that can reach records beyond the ones its task requires, and the access log over the same period shows records opened by accounts with no recorded relationship to the person concerned. Both are the operator's own sources, and the finding is the difference between what the role needs and what it can reach, expressed as the number of accounts that can open one record.
Methode
document-comparison
Kwaliteit van de detectie
95 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The broad role exists but is held by a small named group whose task requires it.met de hand te toetsende bevinding wordt zwakkerThen the question moves to the size of that group and to what happens when someone leaves it.
- Access is technically possible but every opening requires a reason that is recorded and reviewed.met de hand te toetsende bevinding krijgt een ander patroonA control that runs afterwards is weaker than one that runs before, but it is a control. State which of the two was found.
- The wide access follows from a statutory duty that names it.niet uit de meting af te leidende bevinding krijgt een ander patroon
- The document supplied describes intended roles rather than the configuration in the system.met de hand te toetsende bevinding vervaltThe most common measurement error here. The document names roles the system does not have; ask for the export from the system itself.
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Bepalingen
Veelgehoorde tegenwerpingen
Everyone here has a duty of confidentiality.
Confidentiality binds what someone may do with what they saw. It does not decide who should have been able to see it, and it cannot be enforced in advance.
We log every access.
A log establishes what happened; it does not limit what can happen. Ask who reads it, how often, and what followed the last time something was found.
Narrowing the roles would get in the way of the work.
That claim has a testable form. Name the situations in which someone needs a record outside their own work, and grant those per case with a reason recorded at the moment of access.
Geldt wanneer
to-processing