Imagine a small clinic where the whole team shares one login to the patient system. The receptionist, the nurse, the doctor and the part-time bookkeeper all open the same screens and see the same records. It is convenient. It also means nobody can answer a simple question: who looked at this patient's file last Tuesday?
Health information is among the most sensitive data a business can hold. Getting access right is not only a technology matter; it is a decision about who needs to know what, written down and then enforced by the software.
Start with roles, not people
Instead of deciding access person by person, a well-built system defines roles based on the job, and then assigns people to roles. A typical practice might have:
- Reception: sees the agenda, contact details and billing status, but not clinical notes.
- Nursing or assistants: sees what is needed for the visit in progress.
- Clinician: sees the clinical history of their patients.
- Billing: sees invoices and insurance data, not diagnoses.
- Administrator: manages users and settings, but doesn't need to read clinical content to do it.
When someone changes position, you change their role and everything follows. It is also much easier to explain and review than a spreadsheet of individual exceptions.
The "minimum necessary" idea
The principle behind this has a name in US health privacy law. HHS describes the HIPAA Privacy Rule's minimum necessary standard as requiring covered entities to make reasonable efforts to limit the use or disclosure of protected health information to the minimum needed for the purpose. HHS also says that for workforce access, policies should identify who needs access and which information they need, and it notes exceptions, such as disclosures for treatment.
You don't need to be a US entity to borrow the idea. Many data protection rules around the world rest on similar thinking, though the details differ and a legal professional should confirm what applies to you. As a design principle it is simple: if a job doesn't need to see something, the screen shouldn't show it.
Your own login, always
HIPAA's Security Rule also gives technical hints worth borrowing. Among its requirements, it calls for assigning "a unique name and/or number for identifying and tracking user identity" (45 CFR 164.312(a)(2)(i)). Shared logins undermine every other control, because the record of who did what points to "reception" instead of a person.
Access logs: knowing who looked
The same rule asks for mechanisms that "record and examine activity in information systems that contain or use electronic protected health information" (164.312(b)), and, elsewhere, for procedures to regularly review records of system activity "such as audit logs" (164.308(a)(1)(ii)(D)).
In plain terms, a good system keeps a log of who opened which patient record, when, and what they changed. That log is only useful if someone reads it, so it helps when the system can answer questions like "show me everyone who opened this record" and can flag unusual patterns, such as one user opening dozens of files outside their normal patients.
Emergency access, sometimes called "break-glass"
Rules are never perfect. Sometimes a clinician needs a record they normally can't see, urgently, and waiting for an administrator would be worse than the risk. A common approach is break-glass access: the person can override the restriction, but must state a reason, the action is clearly logged, and a manager reviews it afterwards.
The Security Rule does require an "emergency access procedure" for obtaining necessary health information during an emergency (164.312(a)(2)(ii)). It doesn't prescribe how; break-glass is one practical way to do it, and the review afterwards is what keeps it from becoming a back door.
Offboarding: the door that stays open
Accounts of former employees that stay active are a well-known weak point. The Security Rule lists termination procedures among its (addressable) implementation specifications for ending access when a workforce member's employment ends (164.308(a)(3)(ii)(C)).
In software terms, that means disabling the account the same day, not deleting it, so past entries in the log still show who did what. It also helps to review the list of active users every few months, and to remove access for people who change roles.
What this costs and what it buys
None of this requires exotic technology. It requires someone to decide the roles, a system built to enforce them, and the habit of reading the log occasionally. In return you can answer questions from patients, partners or regulators, you limit the damage if a login is stolen, and your team learns that access is a responsibility.
A first step
List every person who uses your patient system and write beside each one the three things they actually need to do. Then check what they can currently see. The gap between the two lists is your first requirement.