Hospital Service Desk: Minimal ITIL in Six Months
Valewood Hospital's IT unit has 25 staff supporting 1,200 users. The service desk has 300 open tickets, 40% password resets; average first response 2.5 days. Change requests are approved by email, and two unapproved changes caused outages in the last quarter: one patched a clinical records server during clinic hours, another changed firewall rules without rollback. The CIO has a small training budget and wants ITIL 'in six months'. The clinical director will support only changes that reduce clinician downtime. The service desk manager wants self-service password reset but the security team refuses until identity proofing is defined. There is no CMDB. Staff are skeptical of 'process overhead' and have seen two failed tool projects. The hospital has 24/7 operations and a 99.9% availability target for clinical systems.
1. The CIO asks for ITIL in six months. What should be prioritized in the first 60 days, and what should be explicitly deferred? Justify against the clinical director's condition.
Read the worked answer
Prioritize incident management and change management quick wins that reduce clinician downtime: self-service password reset with a defined identity-proofing step, a standard-change template for low-risk changes, an emergency-change path with rollback, and a clinical-impact field on every change. These are process and configuration changes, not a CMDB or tool purchase. Defer CMDB, full problem management, and service catalog until the first 60 days show results. The clinical director will support only downtime reduction, and password resets are 40% of 300 tickets-the largest visible pain. Building credibility also addresses staff skepticism from two failed tool projects. ITIL 'in six months' should mean a minimal viable process, not full adoption.
2. Design a minimal change-control record that would have prevented the two outages. List fields and the approval rule.
Read the worked answer
A minimal change record should include: change ID; system and service; description; clinical or business impact; risk level; proposed window; test evidence; rollback plan and owner; peer reviewer; approver; and post-implementation result. Approval rule: any change to a clinical system requires clinical sign-off and a maintenance window; firewall changes require a second engineer to review the rule and rollback; low-risk standard changes can be pre-approved. Emergency changes may proceed with verbal approval from the duty manager but must be recorded within 24 hours. The two outages would have been caught by the clinical-impact field and the firewall peer review.
3. How should the team measure whether the first 60 days worked? Give two metrics with baselines and targets.
Read the worked answer
Metrics with baselines: password-reset tickets at 40% of 300 open tickets; target below 20% within 60 days after self-service. Unapproved changes: two in the last quarter; target zero unapproved clinical or firewall changes, measured by audit of change records. First response: 2.5 days; target under 1 day for clinical users. Also track clinician downtime minutes per month and percentage of changes with rollback plans. The first two are leading indicators; downtime is the outcome the clinical director cares about.