Abstract Information Systems (IS) analysts are tasked with analyzing customer needs and designing the requisite information system, commonly using models. Ensuring the high quality of these models is crucial for the success of workflow-oriented IS. This study investigates how process thinking influences the ability of novices to produce high-quality process models in IS education, focusing on quality metrics such as completeness, correctness, and irredundancy. We conducted a detailed examination of 181 students enrolled in an IS Analysis and Design course (130 students in the final sample), employing a unique three-task methodology to assess their initial process thinking levels and subsequent model quality throughout the course. Our findings reveal that students with high initial process thinking proficiency continued to excel in subsequent modeling tasks, while those with lower initial proficiency narrowed the gap and improved the quality of their models in subsequent tasks due to learning. Additionally, we found a moderate positive correlation (r = 0.233, p = 0.008) between creativity and success in modeling tasks, suggesting that fostering creativity could enhance the quality of process models. Based on these insights, we recommend that IS training include targeted error correction, preliminary workshops for foundational skill enhancement including training in process thinking, and the integration of creativity into the curriculum. These recommendations aim to better prepare students for the complexities of IS planning and design, contributing to the development of proficient IS analysts capable of producing high-quality process models, thereby directly impacting the overall quality of software development processes.

Situation-Based Access Control (SitBAC) is a conceptual model for representing access control policies of healthcare organizations by characterizing situations of access to patient data. The SitBAC model enables formal representation of access situations as an ontology of concepts (Patient, Data Requestor, EHR, Task, and Response) along with their attributes and relationships. A competing access control model is the Contextual Role-Based Access Control (Context) model. The Context model uses logical expressions (rules) that specify contextual authorizations (i.e., characteristics of access requests that are available at access time). Open questions that relate to formal representation of scenarios involving access to patient data are: 1) which of the two models yields a formal representation that is easier to comprehend; 2) which of the two models facilitates the synthesis of correct models, and how does the task complexity affect the performance of comprehension and synthesis. In this study, we address these questions through a controlled experiment. The results of the experiment suggest that while there are no differences between the two models when it comes to comprehending or synthesizing simple scenarios of data access, for complex scenarios, there is a significant advantage to the SitBAC model in terms of both comprehension and synthesis.

Access control is a central problem in privacy management. A common practice in controlling access to sensitive data, such as electronic health records (EHRs), is Role-Based Access Control (RBAC). RBAC is limited as it does not account for the circumstances under which access to sensitive data is requested. Following a qualitative study that elicited access scenarios, we used Object-Process Methodology to structure the scenarios and conceive a Situation-Based Access Control (SitBAC) model. SitBAC is a conceptual model, which defines scenarios where patient's data access is permitted or denied. The main concept underlying this model is the Situation Schema, which is a pattern consisting of the entities Data-Requestor, Patient, EHR, Access Task, Legal-Authorization, and Response, along with their properties and relations. The various data access scenarios are expressed via Situation Instances. While we focus on the medical domain, the model is generic and can be adapted to other domains.