SELinux policy management framework for HIS

Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

Inter-agency working : good intentions and interaction dynamics

This paper explores inter-agency working and examines the implications of inter-agency operations for delivering multi-domain service outcomes. Cross-agency collaborative approaches to service delivery are suggested to provide the vehicle for achieving integrated service and policy goals. However, it is argued these need to be crafted ‘fit’ for purpose’ and may not be the requisite approach for all joint purposes. Moreover, some commentators suggest that the optimism about these partnership arrangements and cross-agency actions to resolve complex multi-dimensional problems may be misplaced and propose that further research into the actual rather than desired consequences of these arrangements may find that, at times, partnership working creates negative effects. While collaboration and partnerships are often framed as the way to achieve real breakthroughs in service delivery across agencies, there remain key challenges to interagency working. As more and insistent calls for agencies and other community actors to work together in resolving complex social problems are heeded, the implications of working across organizational boundaries need to be further investigated. This paper investigates cases of inter-agency programmes to understand the dimensions and limitations of inter-agency working. The paper concludes by offering a framework for better inter-agency working that has applicability across all sectors.

On feasibility of regional frequency-based emergency control plans

Decentralized and regional load-frequency control of power systems operating in normal and near-normal conditions has been well studied; and several analysis/synthesis approaches have been developed during the last few decades. However in contingency and off-normal conditions, the existing emergency control plans, such as under-frequency load shedding, are usually applied in a centralized structure using a different analysis model. This paper discusses the feasibility of using frequency-based emergency control schemes based on tie-line measurements and local information available within a control area. The conventional load-frequency control model is generalized by considering the dynamics of emergency control/protection schemes and an analytic approach to analyze the regional frequency response under normal and emergency conditions is presented.

Creativity, design and entrepreneurship : management education and development for innovation

Creativity, design and entrepreneurship, have been recognized as important contributors to a firm’s innovation and to the nation’s economic growth. Creativity and design play important roles in the fuzzy front end of a firm’s innovation process and also in corporate venturing processes, but the relationship between creativity, design and entrepreneurship to a large extent has not explicitly been examined. This exploratory conceptual paper briefly reviews the separate bodies of research on creativity, design and entrepreneurship, identifying similarities and differences in constructs and applications and identifying implications for business and for management education.

How does ambulance service utilisation impact demand for Emergency Departments in Queensland, Australia?

Background: There are indications that pre-hospital emergency care and management of patients can help reduce the demand for hospital emergency departments (EDs). Ambulance services play a significant role at this stage of care. In 2003, the Queensland Government introduced a Community Ambulance Cover (CAC) levy in return for a free ambulance service at the point of access to all Queenslanders. This may have led to the impression in consumers of an entitlement to free ambulance services under any circumstances regardless of the urgency of the matter which may have in turn contributed to the crowding of EDs in Queensland. Objectives: This paper aims to answer the following questions: - How many patients arrive at hospital EDs by ambulance in Queensland, compared to other modes of arrival? - How has this changed over time, particularly after the CAC introduction in 2003? What percentage of ambulance arrivals are urgent ED patients? - Has the perceived free ambulance services created extra demand for EDs in Queensland, compared with other Australian jurisdictions that charge patients for ambulance services? Methods: We will secondary analyse the data from sources such as Queensland Ambulance Services, Department of Health and Australian Bureau of Statistics to answer the research questions. Findings and Conclusions Queensland has the highest utilization rate of ambulance services (about 18% in 2007-08) and the highest annual growth rate in demand for these services (7.7% on average since 2000-01), well above the population growth. On the other hand, the proportion of ED patients arriving by ambulance in Queensland has increased by about 4% annually. However, when compared with other states and territories with charge at the point of access, it seems that the growth in demand for EDs cannot be explained solely or mainly by CAC or ambulance utilisation in Queensland.

Emergency department triage revisited

Triage is a process that is critical to the effective management of modern emergency departments. Triage systems aim, not only to ensure clinical justice for the patient, but also to provide an effective tool for departmental organisation, monitoring and evaluation. Over the last 20 years, triage systems have been standardised in a number of countries and efforts made to ensure consistency of application. However, the ongoing crowding of emergency departments resulting from access block and increased demand has led to calls for a review of systems of triage. In addition, international variance in triage systems limits the capacity for benchmarking. The aim of this paper is to provide a critical review of the literature pertaining to emergency department triage in order to inform the direction for future research. While education, guidelines and algorithms have been shown to reduce triage variation, there remains significant inconsistency in triage assessment arising from the diversity of factors determining the urgency of any individual patient. It is timely to accept this diversity, what is agreed, and what may be agreeable. It is time to develop and test an International Triage Scale (ITS) which is supported by an international collaborative approach towards a triage research agenda. This agenda would seek to further develop application and moderating tools and to utilise the scales for international benchmarking and research programmes.

Emergency department surge capacity : Recommendations of the Australasian surge strategy working group

Background For more than a decade emergency medicine organizations have produced guidelines, training and leadership for disaster management. However to date, there have been limited guidelines for emergency physicians needing to provide a rapid response to a surge in demand. The aim of this study is to identify strategies which may guide surge management in the Emergency Department. Method A working group of individuals experienced in disaster medicine from the Australasian College for Emergency Medicine Disaster Medicine Subcommittee (the Australasian Surge Strategy Working Group) was established to undertake this work. The Working Group used a modified Delphi technique to examine response actions in surge situations. The Working Group identified underlying assumptions from epidemiological and empirical understanding and then identified remedial strategies from literature and from personal experience and collated these within domains of space, staff, supplies, and system operation. Findings These recommendations detail 22 potential actions available to an emergency physician working in the context of surge. The Working Group also provides detailed guidance on surge recognition, triage, patient flow through the emergency department and clinical goals and practices. Discussion These strategies provide guidance to emergency physicians confronting the challenges of a surge in demand. The paper also identifies areas that merit future research including the measurement of surge capacity, constraints to strategy implementation, validation of surge strategies and measurement of strategy impacts on throughput, cost, and quality of care.

High impact training : achieving synergies between program management education and workplace practice

This paper addresses the challenges of transfer of training back to the workplace for programme and project managers who are being groomed for the leadership of large and complex projects. The paper draws on the experience of the development and delivery of Queensland University of Technology (QUT) education programs: an Executive Masters of Complex Project Management and a series of Continuing Professional Development (CPD) events for an Australian government agency, Defence Materiel Organisation (DMO). Drawing on notions of ‘far transfer’ (Laker 1990; Noe, 1986) and ‘transfer climate’ (Kozlowski & Salas, 1993; Yamnill & McLean, 2001), the paper describes the steps undertaken to achieve a design that ensures that programme and project leadership skills developed through these corporate education programs become successfully embedded back in the organisation. Further, the paper reports on a small qualitative study where the programme success was evaluated by the organisational sponsor, senior leaders and program participants. Nine interviews were conducted and analysed to identify the success of far transfer and transfer climate four months after the return of program participants from cohort 1 2008 to the workplace.

Future developments in chest pain diagnosis and management

Much of the focus of research on patients with chest pain is directed at technological advances in the diagnosis and management of acute coronary syndrome (ACS), pulmonary embolism (PE), and acute aortic dissection (AAD), despite there being no significant difference at 4 years as regards mortality, ongoing chest pain, and quality of life between patients presenting to the emergency department with noncardiac chest pain and those with cardiac chest pain. This article examines future developments in the diagnosis and management of patients with suspected ACS, PE, AAD, gastrointestinal disease, and musculoskeletal chest pain.

Implementing an emergency department patient admission predictive tool : insights from practice

Purpose: This paper aims to show that identification of expectations and software functional requirements via consultation with potential users is an integral component of the development of an emergency department patient admissions prediction tool. ---------- Design/methodology/approach: Thematic analysis of semi-structured interviews with 14 key health staff delivered rich data regarding existing practice and future needs. Participants included emergency department staff, bed managers, nurse unit managers, directors of nursing, and personnel from health administration. ---------- Findings: Participants contributed contextual insights on the current system of admissions, revealing a culture of crisis, imbued with misplayed communication. Their expectations and requirements of a potential predictive tool provided strategic data that moderated the development of the Emergency Department Patient Admissions Prediction Tool, based on their insistence that it feature availability, reliability and relevance. In order to deliver these stipulations, participants stressed that it should be incorporated, validated, defined and timely. ---------- Research limitations/implications: Participants were envisaging a concept and use of a tool that was somewhat hypothetical. However, further research will evaluate the tool in practice. ---------- Practical implications: Participants' unsolicited recommendations regarding implementation will not only inform a subsequent phase of the tool evaluation, but are eminently applicable to any process of implementation in a healthcare setting. ---------- Originality/value: The consultative process engaged clinicians and the paper delivers an insider view of an overburdened system, rather than an outsider's observations.

Using digital rights management for securing data in a medical research environment

We propose a digital rights management approach for sharing electronic health records in a health research facility and argue advantages of the approach. We also give an outline of the system under development and our implementation of the security features and discuss challenges that we faced and future directions.