Title: Building a Case Tracking System: 5 Design Rules for Software That Holds Sensitive Records

Title: Building a Case Tracking System: 5 Design Rules for Software That Holds Sensitive Records I’m working on the Computerised Criminal Investigation Tracking System (CCIS), a prototype that follows a case from registration to final report. It runs on sample data only. Records like these can’t be treated like a to-do list. These five rules shaped the design, and they apply to any system with sensitive data, such as a hospital, a school, or HR. 1. Control who sees what. Use roles, not one shared login. An officer, a supervisor, and an admin should each see only what their job needs. 2. Lock the front door properly. A password plus a second step. Sensitive records deserve more than a username. 3. Leave a trail. Record who changed what, and when. If you can’t answer “who edited this?”, you can’t trust the record. 4. Tie everything to one case. Suspects, evidence, and notes should all attach to a single case ID, so nothing floats around loose. 5. Make reports one click. If printing a case summary is hard, people go back to paper. A note on honesty: this is a prototype with sample data. A real deployment would need proper security testing and official approval. What rule would you add for systems that hold sensitive records? Made by Kasper