“Underneath every simple, obvious story about ‘human error,’ there is a deeper, more complex story about the organization.”
— Sidney Dekker
The Long Tail
Picture this: it’s 06:45 on a Saturday, the end of an overnight shift. A support coordinator has one incident report open in one tab and a client’s medical history in another. They’re sipping coffee while they write the shift notes when the RN walks in to start their shift. Peering over the shoulder onto the screen, they talk about the client and move through the file containing a Medicare number, psychiatric history and case notes dating back four years.
The coordinator’s data security training was completed eleven months ago during onboarding, with a quiz you couldn’t fail.
This is where care-sector data lives. It’s not in a server room – it’s the tabs and folders open on the shared computer in the staff office.
Photo by Ricardo Gomez Angel on Unsplash
Trained to Capture, Not Protect
When health care security makes the news, it looks like WannaCry: a hospital, a ransom note, surgeries cancelled. Or the Medibank breach: millions of health records exposed to threat actors. But huge insurers and hospitals are the visible head of a much larger sector. Behind them sits a long tail of allied health practices, disability providers, and community clinics – holding equally sensitive data, often with a fraction of the security maturity.
In many of these environments, security is shaped by operational reality, shared systems, competing priorities, and responsibility falling to whoever has time that day. The result is a security function that is distributed, but owned by no one.
Care sectors constantly handle sensitive information, typically referred to as electronic health records (EHRs). EHRs can comprise anything from intake notes to client files, doctor referrals and confidential medical histories. Globally, the reliance sits across a mix of human discretion and responsibility, combined with varied technological systems – sometimes layered and integrated, sometimes inadequate or absent entirely.
Frontline teams handling this data day-to-day do so as a secondary task; their primary responsibility is care. They are not trained to protect information; they are trained to capture and apply it.
Unpacking the Risk
Compliance frameworks demand security, but governance decisions often reduce security to a procurement problem. Small providers, already stretched, respond the only way they can: they delegate it outward. A managed IT contract, an annual audit, a short mandatory training course. On paper, the obligation is met.
Look at what that training actually is. The pattern is consistent across the sector. It teaches staff that data protection is something that happens elsewhere, done by someone else. The training doesn’t just fail to equip; it actively disempowers. Ransomware and phishing campaigns are common in the health care sector, and the conditions for insider threats emerge when the absence of participation becomes a vulnerability: a disengaged employee has access, operational knowledge, and an understanding that security sits with someone else.
The result is a quiet inversion. Operational staff who understand relationships, care patterns, behavioural changes and what ‘normal’ looks like on a Tuesday in the clinic – have no mandate to protect. Nobody who understands the data owns its defence.
The risk compounds beyond a single workplace. Cyber hygiene is a behavioural pattern, not a site-specific control. Habits developed in one workplace are carried into the next and into personal life, making this less an organisational weakness than a systemic one.
From IT to AI
An IT contractor is charged with managing and monitoring the in-house system for a residential care facility. Around one hundred clients, thirty staff rotating across shifts, allied health workers uploading notes from iPads between sessions. When the contractor breaks something during an update, the failure is visible – logins stop working, files won’t open. It’s legible and can be traced; there are logs, a cause, a fix, and a person answering the phone at 2 am who owns the problem until it’s resolved.
Now swap the contractor’s monitoring for an AI security tool. The vendor still exists: the support line still answers, but the accountability gap has widened. When a model quietly mis-triages an alert, or fails to identify a threat, the question is no longer who fixes the problem, it’s who understands the real-world impact of the decision, and who can confidently say why it happened.
Judgement has moved further from those who understand what normal looks like:the people who recognise when something doesn’t fit – a change in behaviour, an unusual request, or information that doesn’t align with operational reality. AI can be a powerful instrument in their hands, improving efficiency, reducing burnout and supporting better care. The failure is deploying it as their replacement: treating it as an authority rather than an instrument.
The Human Layer
Most security discussions begin from the same assumption: people are the weakest link. Aren’t undertrained staff the attack surface? They click the links. They hold the door for a stranger with a lanyard. They leave the client file open while they go to ask the kitchen staff about a newly added dietary requirement.
As things stand – yes, sometimes. But notice what that concedes: the sector’s largest attack surface is also its largest untapped detection system, and the current structure has chosen to largely ignore it. The staff member who knows that a client has recently begun seeing a psychiatrist as well as a psychologist may be the only person who can distinguish legitimate access from suspicious activity. It’s not information a contractor has, and it’s certainly not information a model has. Institutional knowledge can’t be outsourced; it can be equipped or wasted.
The current system doesn’t just waste or ignore the intelligence and defensive capabilities of the humans, it punishes it. When a breach happens, liability often lands on the individual who made the ‘human error’ – a person given a twenty-minute module, no visibility into the systems they are blamed for, and no authority to change them.
Calling staff the weakest link isn’t a diagnosis, it’s a description of a design that separated access from agency.
None of this advocates for care workers becoming security analysts – they have enough overwork to not take on an additional responsibility. Rather, the claim is narrower: baseline skills plus contextual judgement catch what tools and contractors both miss. This moves beyond implementing MFA and PoLp however, and into activation of the existing intelligence available.
Defence in Depth: What Activation Looks Like
The issue is not empowerment for its own sake. It is recognising that contextual judgement already exists and deliberately integrating it into security governance. Organisations need to activate the human layer of security-not by turning care workers into security analysts, but by recognising the security value they already hold.
Activation means integrating operational judgement into security architecture, treating it as a security signal. Those working inside the workflow can interpret anomalies that technical controls can detect, but cannot explain. Combined with technical detection, this turns isolated alerts into meaningful intelligence for threat detection, investigation and response.
This is the human layer of defence, and it does not sit only with frontline workers. Administrative teams often touch systems and sensitive information more frequently than any other role, and their observations are equally valuable. Security needs to be built with the people who understand the workflows, not applied to them externally.
Improvement doesn’t begin with another layer of compliance activity. Activation begins with leadership recognising operational judgement as a security capability worth designing around. Instead, it can begin with better conversations during handovers, security observations built into existing processes, clearer reporting pathways, and involving frontline teams when systems and tools are introduced.
The opportunity is not creating a new security resource or more modules to tick boxes. It is recognising that security capability already exists in the people closest to the data.
Technical controls can detect anomalies. Human judgement and organisational knowledge determine whether those anomalies matter.
Defence-in-depth was never only about adding more tools. It is about ensuring every available layer of detection, judgement and response is connected.
Security culture is not cultivated by awareness training. It is created via governance decisions that determine who is expected- and trusted- to participate in defence.
Leave a Reply