Who Opened That File? Getting Clinical Access Right When Staff Rotate
A patient asks who viewed their file - the practice manager checks the audit log - it shows a login that half the staff use.
That's the moment the when the problem of shared logins becomes real. Not a breach, necessarily, but the inability to answer a fair and reasonable question.
Healthcare has a specific access challenge. Clinicians share rooms and workstations. Registrars and students rotate through every few months. Locums arrive for a week or two. Everyone needs fast access to the same record, often from the same device, often mid-shift, or on a call-out.
Speed wins as the patient is RIGHT THERE - Accountability finishes a distant second.
Why healthcare access control is different
Most industries have one person, one desk, one login. Clinical environments simply don't work that way.
Consider what happens on a normal shift:
- A nurse logs into a shared workstation, checks a patient, and moves on before the next clinician needs the screen.
- A locum arrives and is given the credentials the previous locum used, because setting up a new account takes two days.
- A registrar rotates to a new department and keeps the access from the old one, in case it's useful.
- Allied health staff access records from three sites with slightly different permission rules.
- Administrative staff can see clinical notes they don't need, because nobody separated the roles.
Each decision makes sense in the moment and in isolation. Together, they erode the ability to say with any degree of authority: who exactly did what, when and why.
This matters way beyond just IT security. An accurate trail affects privacy obligations, clinical governance, complaint handling, and the confidence a patient that their information is handled properly and only accessed by those with authorisation.
The symptoms worth watching for
Access problems rarely announce themselves. We find that they show up as small irritations across many staff members:
- Staff log out and back in constantly, so they stop logging out at all
- One account is used by several people because it's faster.
- Onboarding a temp takes days, so shifts start short-handed.
- Departed or rotated staff retain access nobody remembers granting.
- Audit requests take weeks because records are incomplete.
- Different sites apply different rules to the same role.
None of this (generally) appears on a risk register. But each one individually weakens the link between a person and their actions in the record.
Why buying a new system won't fix it
This is one of these situations born from the "cultural" desire to help and the paradox between security and accessibility. Hence, alignment starts with a question that isn't technical:
what should each role be able to see and do, and how will we prove it?
From there, the practical work follows.
Build a role map before touching technology
Define access by role, not by individual. A registered nurse, a registrar, an allied health clinician, a practice manager, and a receptionist each need different things.
Keep it simple. For each role, record what they need, what they must not see, and how often the access should be reviewed.
| Role | Needs Access to | Should not Access | Review Cycle |
| Registered Nurse | Clinical notes, observations, medication charts | Billing and payroll | Quarterly |
| Registrar, Temp or locum | Assigned patient records, clinical notes | Historical records outside placement | Automatic expiry |
| Allied Health | Referrals, treatment notes, appointments | Acute clinical records unless referred | Quarterly |
| Practice Manager | Reporting, staff records, system settings | Clinical detail beyond role needs | Monthly |
| Reception | Appointments, demographics, billing | Clinical notes | Quarterly |
(These are examples, provided for illustration and not designed to be representative of any particular practice!)
Make sessions fast and attributable
Shared workstations are not going away. Accept it and design for them - there are great tech solutions for this!
That means individual logins with quick switching between users, short automatic lock periods, and single sign-on so speed doesn't come at the cost of identity. If logging in properly takes longer than the workaround, people will choose the workaround every time.
The goal is a session that is easy to start and easy to end, with a clear record of who was there - have a "time" target, measure for it and publish it.
Treat temps, locums and rotating staff as a designed process
Short-term clinical staff need same-day access. That's a legitimate requirement, not an exception - make the start to their day a joyful experience and not a slog through forms and calls!
Build a standard path: verify identity, assign a role, set an expiry date, remove access automatically. A temp should arrive to a working login, not a shared one.
This is one place where a small amount of automation saves a lot of awkward conversations and wasted time, money and patience frustration.
Separate clinical access from administrative access
Many access problems come from bundled permissions. A rostering coordinator shouldn't see clinical notes. An administrator shouldn't see medication charts.
Separating these reduces exposure and makes audits much simpler. It also reduces the temptation to grant broad access because splitting it seems too hard.
Make the audit log meaningful
An audit log is only useful if it points to a (real!) person.
Test it occasionally. Pick a record at random and try to establish who accessed it and why. If the answer is "someone on the ward login," the access model needs work.
What this looks like in practice
A multi-site clinic group had grown through acquisitions. Each site managed its own accounts. Locums were given the previous locum's credentials. When a patient complaint required a record access review, the group couldn't produce a reliable answer.
The alignment work wasn't a platform replacement. It started with a role map, then moved to individual accounts, time-bound locum credentials, fast session switching on shared devices, and a monthly review owned by the practice manager.
The change was noticeable in two places. Locums started on time. And the next access query took an hour rather than a week.
Where Microsolve helps
Clinical access sits across identity, architecture, security, and governance. That's rarely one team's job.
Our consulting services include virtual CIO and virtual CISO engagements, cyber security advisory, and technology architecture to provide useful insights when you need an independent assessment of who can access what, and a plan sequenced around clinical risk rather than vendor preferences.
Managed support keeps the underlying environment reliable: identity management, endpoint control, patching, and monitoring. Fixed-price contracts and clear accountability make it easier to plan around.
The vCIO framework connects governance, resourcing, architecture, security, and innovation, which matters when access decisions involve clinical leadership, HR, privacy obligations, and the board at once.
The first step
Pick one record at random. Try to establish who accessed it, when, and why.
If you can answer confidently, you're in good shape. If you can't, start with the role map. It costs nothing and clarifies everything that follows.
Access should be fast for clinicians and traceable for the organisation. Both are achievable. They just need to be designed together.
