The short answer
Role alone is too coarse. A clinician should generally see the records of patients they are involved with, not every record in the system, and that relationship changes over time.
Combine role with relationship, provide a deliberate override for emergencies, and audit both.
The layers
| Layer | Question it answers |
|---|---|
| Authentication | Who is this person |
| Role | What kind of access could they have |
| Relationship | Are they involved with this patient |
| Purpose | Why are they looking right now |
| Audit | What did they actually do |
The relationship layer is the one most commonly missing, and it is what stops an entire role from having blanket access to every record.
Emergency access needs to exist
- Make the override available, because the alternative is a shared login.
- Require a stated reason at the point of use.
- Log it prominently and separately from normal access.
- Review those events routinely, not only after an incident.
- Make clear at the time that the access is recorded.
An override that is reviewed and known to be reviewed is a control. One that exists and is never looked at is a gap.
Over-restriction backfires
Access that blocks legitimate work produces workarounds: shared accounts, borrowed credentials, information copied somewhere less controlled. Each is worse than the access that was denied.
When staff are repeatedly blocked doing their jobs, that is a design problem rather than a compliance success.
Audit that gets used
- Record who, what record, when, and from where
- Keep it for the retention period that applies
- Make it searchable by patient and by user
- Alert on patterns worth a look, such as access to a colleague's record
- Have someone whose job includes reviewing it
The last point is what makes the rest worth having. An audit log nobody reviews only helps after a complaint.