All organisations must take active steps to maintain the security and integrity of their information resources, and nowhere is this strategy more critical than in hospitals where issues of information accuracy and patient confidentiality are paramount. Of all the tools at the information security manager's disposal, none is more widely valued and used than the information security policy. Much research therefore concentrates on the way in which information security policies contribute to the protection of systems from internal and external threats. Such work is legitimate and important, but it often fails to explore alternative views of security and related policies. Against this backdrop, this paper seeks to provide novel insights into the role and purpose of information security policies by reviewing them through a critical theoretical lens. It presents the results of a critical discourse analysis which looked for evidence of ideology and hegemony within a sample of information security policies from the UK's National Health Service. The findings support the contention that an alternative description of information security policies from a critical perspective provides better insights into existing problems than most mainstream work. The paper concludes by discussing the implications of the findings and future research avenues.

Personal Health Monitoring (PHM) uses electronic devices which monitor and record health

Information security can be of high moral value. It can equally be used for immoral purposes and have undesirable consequences. In this paper we suggest that critical theory can facilitate a better understanding of possible ethical issues and can provide support when finding ways of addressing them. The paper argues that critical theory has intrinsic links to ethics and that it is possible to identify concepts frequently used in critical theory to pinpoint ethical concerns. Using the example of UK electronic medical records the paper demonstrates that a critical lens can highlight issues that traditional ethical theories tend to overlook. These are often linked to collective issues such as social and organisational structures, which philosophical ethics with its typical focus on the individual does not tend to emphasise. The paper suggests that this insight can help in developing ways of researching and innovating responsibly in the area of information security.

A District Diabetes Register has been created using the Family Health Services Computer Unit system, DIALOG, linked to the Family Health Services Authority (FHSA) population register. Initial informal discussions between the Diabetes Centre, Public Health, and the FHSA led to a formal proposal being accepted by the Local Diabetes Services Advisory Group to pilot the DIALOG software. Following installation of DIALOG on a separate computer, electronically linked to the main FHSA system, the register was compiled. This was approached in three ways. The existing Diabetes Centre Register was downloaded into DIALOG and patients matched with the FHSA register. A ‘diabetes roadshow’ was mounted, with Postgraduate Education Allowance approval, to individually visit every general practice in the district to explain the aims and objectives of creating a diabetes register and to enlist the support of these practices. Where practices already held their own diabetes register this was similarly transferred, if not, assistance was provided to identify their patients with diabetes. All patients were notified in writing that their names were being placed upon a diabetes register and that clinical data would be held against their entry. This notification included an opportunity to opt out. Additionally, a self registration scheme was introduced whereby all retail pharmacists dispensing any diabetes related product and all optometrists seeing a person with diabetes, gave the patient a leaflet, describing the register and its purposes and inviting them to register themselves. A ‘Data Ownership Committee’ was established to control the use and interpretation of all clinical data held upon the register. The process of diabetes annual review is now being prompted across both primary and secondary care and clinical data is being returned to the register.

No abstract