RUNNING CASE STUDIES

Community Board of Realtors

The Community Board of Realtors Multiple Listing Service (MLS) will be a Web-based application with extensions to allow wireless smartphone interaction between the agents and their customers. Review the functional and nonfunctional requirements you have developed for previous chapters. Then, for each of the six design activities discussed in this chapter, list some specific tasks to design the environment, application architecture and software, user interfaces, system interfaces, database, and system controls and security. You may want to refer back to the Tradeshow System discussed in Chapter 1 for some design specifics. The Spring Breaks ‘R’ Us Travel Service Let us say that the SBRU information system includes four subsystems: Resort relations, Student booking, Accounting and finance, and Social networking. The first three are purely Web applications, so access to those will be through an Internet connection to a Web server at the SBRU home office. The Social networking subsystem has built-in chat capabilities. It relies on Internet access for the students, as students compare notes before they book their travel reservations and as they chat while traveling. To function properly, the system obviously requires a wireless network at each resort during the trip. SBRU isn’t responsible for installing or maintaining the resort wireless network; they only plan to provide some design specifications and guidelines to each resort. The resort will be responsible for connecting to the Internet and for providing a secure wireless environment for the students.

1. Design the environment for the SBRU information system by drawing a network diagram. Include what might be necessary to support online chatting capabilities.

2. Considering that everything is designed to operate through the Internet with browsers or smart phones, how simple does this architecture appear to be? Can you see why Web and smart phone applications are so appealing?

3. What aspect of design becomes extremely important to protect the integrity of the system? On the Spot Courier Services In previous chapters, we have described the technological capabilities that Bill Wiley wants for servicing his customers. One of the problems that Bill has is that his company is very small, so he cannot afford to develop any special-purpose equipment or even sophisticated software. Given this limitation, Bill’s request for advanced technological capabilities is coming at an opportune time. Equipment manufacturers are developing equipment with advanced telecommunications capabilities. And freelance software developers are producing software applications—many of which provide the capabilities that Bill needs. The one caveat is that since this will be a live production system, it needs to be reliable, stable, error-free, dependable, and maintainable Let us review some of the required capabilities of the new system, which has been described in previous chapters: Customers

■ Customers can request package pickup online via the Internet.

■ Customers can check the status of packages online via the Internet.

■ Customers can print mailing labels at their offices. Drivers

■ Drivers can view their schedules via a portable digital device while on their routes.

■ Drivers can update the status of packages while on their routes.

■ Drivers can allow customers to “sign” for packages that are delivered.

■ The system “knows” where the driver is on his route and can send updates in real time.

■ Drivers can accept payments and record them on the system. Bill Wiley (management)

■ Bill can record package pickups from the warehouse.

■ Bill can schedule delivery/pickup runs.

■ Bill can do accounting, billing, etc.

■ Bill can access the company network from his home. Given these requirements, do the following:

1. Make a list of the equipment that Bill should purchase to support his new system. Include all equipment that will be needed for the home office, the drivers, and at Bill’s residence. Identify and describe actual equipment that can be purchased today. Estimate the cost of the equipment.

2. Describe any special software that may be needed. The software engineer is developing the application software (package scheduling and processing, accounting, etc.), but no special software is required for connecting the devices or communications between them.

3. Develop a network diagram showing how all the equipment will be connected. Identify Internet connections, VPNs, and telephony links as appropriate. Sandia Medical Devices As described in previous chapters, the Real-Time Glucose Monitoring (RTGM) system will include processing components on servers and on mobile devices, such as smartphones, with data exchange via 3G and 4G phone networks. Users will include such patient and health care personnel as physicians, nurses, and physician assistants. In the United States, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates certain responsibilities regarding the privacy and security of electronic protected health information (ePHI). The law applies to what are collectively called covered entities—that is, health plans, health care clearinghouses, and any health care providers who transmit health information in electronic form. More information can be obtained from the U.S. Department of Health & Human Services Web site (www.hhs.gov). In general, covered entities should:

■ Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.

■ Identify and protect against reasonably anticipated threats to the security or integrity of the information.

■ Protect against reasonably anticipated, impermissible uses or disclosures of the information.

■ Ensure compliance by their workforces. Specifically, covered entities should implement policies, procedures, and technologies that:

■ Specify the proper use of and access to workstations and electronic media.

■ Regard the transfer, removal, disposal, and reuse of electronic media to ensure appropriate protection of ePHI.

■ Allow only authorized persons to access ePHI.

■ Record and examine access and other activity in information systems that contain or use ePHI.

■ Ensure ePHI isn’t improperly altered or destroyed.

■ Guard against unauthorized access to ePHI that is being transmitted over an electronic network. Answer these questions in light of HIPPA requirements:

1. Does HIPAA apply to the RTGM system? Why or why not?

2. How should the system ensure data security during transmission between a patient’s mobile device(s) and servers?

3. Consider the data storage issues related to a patient’s mobile device and the possible ramifications if the device is lost or stolen. What measures should be taken to protect the data against unauthorized access?

4. Consider the issues related to health care professionals accessing server data by using workstations and mobile devices within a health care facility. How will the system meet its duty to record and examine access to ePHI? If a health care professional uses a mobile device outside a health care facility, what protections must be applied to the device and/or any data stored within it or transmitted to it?

5. Consider the issues related to wired and wireless data transmission between servers and workstations within a health care facility. What security duties, if any, apply to transmissions containing ePHI? Does your answer change if the servers are hosted by a third-party provider?