A system, comprising: at least one data processor; and at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising: identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician, that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems, the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device (330a, 330b) and/or isolating a medication accessed by the first clinician. at least one data processor; and at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising: identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician, that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems, the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device (330a, 330b) and/or isolating a medication accessed by the first clinician. identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician, that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems, the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device (330a, 330b) and/or isolating a medication accessed by the first clinician.