Access controls — who can click what
Unique logins and role-based permissions protect patients and your audit trail.
TL;DR
Give each person the minimum access needed for their job, review permissions when roles change, and never share passwords.
Updated 2026-04-21
Access controls answer: Who is allowed to open which door in your systems?
Unique identities
Shared accounts mean you cannot tell who changed a record. Break the habit—even for "just the weekend" coverage.
Role-based access
Billing should not browse psychotherapy notes. Students need tighter scopes. Match EHR roles to actual jobs.
Reviews
When someone changes roles or leaves, revoke access the same day. Quarterly access reviews catch drift.
Vendors
Provide SOC logs or admin audit trails so customers can investigate incidents.
Not legal advice. Educational overview only; consult qualified counsel for your situation.