And as a former service desk tech working in the NHS for 20+ years, sometimes bending or even ignoring policies completely is the only way to keep people alive.
One thing I did take issue with however was when the medical director of a hospital trust demanded that service desk staff create ad-hoc accounts (with full access to clinical systems and information) out of hours for agency staff who were brought into A&E at zero notice to cover sickness etc. This was to be done without question and without any checks being made or the usual required paperwork being supplied.
When it was mentioned that these agency staff could be anyone, such as potentially a journalist or someone nefarious attempting to gain access to said clinical systems, the demand from the medical director was that under no circumstances should the Information Governance manager be made aware of these actions.
Still feel safe, your lives in their hands etc?
Biting the hand that feeds IT
