The Clinic's Shared Patient Spreadsheet
A small physiotherapy clinic with four practitioners keeps appointment notes in a single spreadsheet on a shared drive. Each practitioner has a folder, but in practice all four open the same file. Last week two practitioners edited the file at the same time and one set of notes was overwritten; the lost notes were reconstructed from memory. The spreadsheet also contains client names, dates of birth and brief clinical notes. Files are copied to personal USB sticks for home visits, and one stick was left in a treatment room. The clinic has no IT staff and a limited budget, but must handle client information responsibly.
1. Identify the two most serious risks in this setup and explain why each is serious, distinguishing between data integrity and data security.
Read the worked answer
Risk 1 - data integrity: concurrent editing destroys records. The overwrite incident is a loss of accuracy and completeness. In a clinical setting, missing notes can affect treatment decisions and may be legally required records. The cause is a single shared file with no version control or locking, combined with a workflow that assumes exclusive access. This is an integrity failure: the data exists but is wrong or incomplete.
Risk 2 - data security: uncontrolled copies on removable media. The USB stick left in a treatment room is a confidentiality and availability breach waiting to happen. Personal and clinical information has left the controlled environment with no encryption, no inventory and no way to revoke access. This is a security failure: unauthorised parties may access data they should not see.
The distinction matters because the fixes differ. Integrity is addressed by changing how the file is edited (locking, versioning, or a proper record system). Security is addressed by controlling where copies go (encryption, policy, or removing the need for removable media). Treating both as 'the spreadsheet problem' would lead to a single inadequate fix.
2. Propose a practical solution set for a clinic with no IT staff and a small budget, ranked by priority.
Read the worked answer
Rank by risk reduction per dollar and per hour of effort.
- Stop concurrent editing (highest priority, near zero cost). Move to one file per practitioner per day, or use a system with check-out or revision history. Agree a rule that only one person edits a given file and that changes are recorded with initials and time. This directly prevents recurrence of the overwrite.
- Add version history. Keep dated copies or use a service with revision history so an overwrite can be reversed rather than reconstructed from memory.
- Control removable media. Issue clinic-owned, encrypted USB sticks, number and log them, require sign-out and return, and ban personal sticks. Encryption means a lost stick does not become a disclosure.
- Minimise data on portable devices. For home visits, export only the clients needed for that day, not the whole file, and delete the export on return.
- Review access. Ensure only the four practitioners can open the shared folder, and remove access for anyone who leaves.
Longer term, a proper record system with audit trails would be better, but the clinic should not wait for it. Steps 1 and 2 cost almost nothing and remove the failure that has already caused harm.
3. The clinic wants to keep using USB sticks for home visits. What conditions would make that acceptable, and what would you advise if those conditions cannot be met?
Read the worked answer
Removable media is acceptable when the risk is contained rather than eliminated. Conditions:
- Encryption on every stick, so loss does not equal disclosure.
- Ownership and inventory: clinic-owned, numbered, logged out and in, with a named holder.
- Data minimisation: only the records needed for that day's visits, never the full client file.
- Prompt deletion of the export once the notes are synced back, and a check that the sync happened.
- Physical control: a signed-for pouch or lanyard so a stick is not left on a bench.
- A reported-loss procedure so a missing stick triggers a response rather than silence.
If encryption or logging cannot be implemented, the honest advice is to stop using removable media for client data. The alternative is remote access to the clinic system, or printing only the minimum schedule with no clinical detail and recording notes on return. Neither is as convenient, but convenience is not a sufficient reason to carry unencrypted clinical records in a bag. The clinic should decide explicitly rather than drift into the current practice.