A system, comprising: at least one data processor ; and at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising: identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician ; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician , that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems , the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device and/or isolating a medication accessed by the first clinician . at least one data processor ; and at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising: identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician ; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician , that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems , the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device and/or isolating a medication accessed by the first clinician . identifying a first peer community in a peer network by at least applying a machine-learning model trained to identify one or more peer communities present in the peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician from the plurality of clinicians based at least on the first clinician and the second clinician sharing at least one common attribute; comparing a first activity pattern of the first clinician to a second activity pattern of the second clinician ; determining, based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician , that the first clinician exhibits anomalous behavior; characterised in that the operations further comprise: in response to determining that the first clinician exhibits anomalous behavior, triggering an investigative workflow at one or more data systems , the investigative workflow including activating one or more surveillance devices in response to the first clinician interacting with a medical device and/or isolating a medication accessed by the first clinician . <EOS>