A small practice sets up its EMR with one login that everyone uses. It is faster, nobody forgets a password, and the team trusts one another.

Then a patient asks who accessed their record, or a staff member leaves under difficult circumstances, or a note is altered and nobody can say by whom. At that point the shared login has removed your ability to answer a question you are obliged to answer.

One account per person, without exception

This is the foundation and it is not negotiable. Every person who touches the system has their own account with their own password. It costs nothing, most systems do not charge per named user in the way practices fear, and it is what makes every other control meaningful.

Accounts are removed the day someone leaves, not eventually.

Levels that reflect actual jobs

Access should follow what the role genuinely requires:

  • Reception: demographics, appointments, billing. Not clinical notes.
  • Nursing: clinical record, observations, medication administration.
  • Clinicians: full clinical access for their patients, prescribing.
  • Pharmacy: prescriptions and stock, not the full clinical history.
  • Accounts: financial records and HMO claims, minimal clinical detail.
  • Administrator: user management and configuration, which should be a small number of people and ideally not the same person who uses the system all day.

The principle is that people see what they need to do their job. Not less, which makes work impossible and drives workarounds, and not everything, which is the current default in most small practices.

Sensitive records need more

Some categories deserve tighter handling: mental health, sexual health, HIV status, and the records of staff members and their families, which are a genuine and under-discussed risk in a small practice where colleagues are also patients.

Where the system supports restricting a record or flagging access to it, use that for these categories.

The audit trail is the real control

Technical restrictions can be worked around by anyone determined. What actually changes behaviour is people knowing that access is logged against their name.

Confirm your system logs who viewed and who changed each record, that the log cannot be edited, and that somebody knows how to produce it. Then tell staff it exists, in training, as a matter of course rather than as a threat.

Screens and sessions

The most common breach in a small clinic is not hacking. It is a record left open on a screen a waiting patient can see. Automatic lock after a short idle period, screens angled away from public areas, and a habit of locking when stepping away handle most of it.

Write it down

A single page stating who has which level, who grants access, and what happens when someone leaves. It takes an hour, and it is the difference between having a policy and believing you have one.