eAIS case studies
eAIS · Put your knowledge to work in context.
The eAIS (eHealth Association Information Security) certification is a vendor-neutral credential aimed at professionals who secure health information systems: security officers and analysts in hospitals and clinics, health IT administrators, privacy and compliance staff, and consultants serving healthcare clients. It tests whether you can apply security principles in a clinical context, where patient safety, uptime, and privacy obligations shape every technical decision. The eAIS case studies are 5 cases and about 4,274 words.
1Budget-Constrained Risk Treatment After a Damning Internal Audit
Meridian Health Network runs six hospitals and 210 outpatient clinics across two EU member states, with 38,000 staff and a legacy EHR that will not be replaced for at least three years. Last month's internal audit found that 41% of 2,900 networked medical devices run end-of-support operating systems, 63% of privileged accounts have no phishing-resistant MFA, and that in a tabletop exercise the incident team took nine hours to decide whether a breach was notifiable against a 72-hour regulatory deadline.
873 words, about 4 min2Three Conflicting Data Requests in One Week
Aldric's Children's Hospital receives three requests in the same week. First, the parent of a 15-year-old patient demands full access to the teenager's portal record, including mental-health notes and a confidential contraception consultation; the teenager objects.
823 words, about 4 min3Shared Clinical Logins and 1,100 Orphaned Accounts
Calder Regional Health employs 12,400 staff and 3,100 contractors across 14 sites. Clinical staff use shared ward and theatre workstations, where an average login takes 47 seconds and nurses report logging in up to 30 times per shift.
900 words, about 5 min4Ransomware at 02:14: Containment Versus the Troponin Interface
At 02:14 on a Saturday, the EDR console flags a ransomware note on 60 endpoints at a 180-bed hospital. The malware has already encrypted the PACS image store and the file server holding scanned referrals; the EHR itself is vendor-hosted and still available.
809 words, about 4 min5Flood Warning, a Warm Standby, and Keys in the Wrong HSM
Lakeshore Health runs a 320-bed hospital and 22 clinics on a single EHR hosted in a primary data centre in a river floodplain, with a warm-standby site 40 km downstream. The DR plan, last tested in 2022, claims an RTO of 8 hours for the EHR and 24 hours for PACS.
869 words, about 4 min