Appearance
Record Protection
Protecting individual patient records
Some records need more protection than others. A record might belong to a member of staff, a public figure, or someone at particular risk. Record protection lets you restrict a single patient's record to a list of permitted users. Other users cannot open it, or can only open it after recording why they need to.
A protected record covers everything under that patient: identifying information, notes, uploaded files, alerts, additional data, appointments, tasks, exports, the audit trail and the forms the patient has submitted for review.
The patient's name and ID number still appear in the patient list, search results, groups, the calendar and the form review queue, marked with a lock icon in the patient list and search. This lets staff find the record and avoid registering the patient a second time. Alerts for a protected patient are hidden everywhere from users who cannot open the record.
Advanced searches on additional data (custom fields) leave out protected patients the user cannot open. Otherwise a match would reveal what the protected record contains.
A submitted form's answers are part of the record, so a user who cannot open the record cannot read, approve, reject, re-send or cancel its forms either. If they open one from the review queue they are asked for a reason (or shown who to ask, for strict protection) in the same way, and after breaking the glass are taken straight back to the form.
Protection types
There are two types of protection.
| Type | Permitted users | Everyone else |
|---|---|---|
| Flexible | Open the record as normal | Must type a reason before opening the record (known as "breaking the glass"). They can then open it for the rest of their session. |
| Strict | Open the record as normal | Cannot open the record at all. They are shown who the permitted users are, so they can ask for access. |
Flexible protection suits most sensitive records. It allows access in an emergency or when covering for a colleague, while making sure each access is justified and recorded. Use strict protection when nobody except the permitted users should ever see the record.
How to protect a record
Open the patient's record, expand Identifying information and click Record protection.
- Choose Flexible or Strict.
- Choose the Permitted users. You are added automatically. If you remove yourself, you cannot open the record after saving (unless you are a system owner).
- Choose whether to email the permitted users whenever someone breaks the glass or the protection changes.
- Click Save.
A banner at the top of the record then shows that it is protected, who can open it, and whether other users must record a reason for their access. To change or remove the protection, click Manage protection on the banner.
Who can manage protection
- Any user who can edit patients can protect a record that is not yet protected.
- Once a record is protected, only its permitted users can change or remove the protection.
- Users with the system owner role can always manage protection, even on records they cannot open. This means a record can be recovered if all of its permitted users leave. Anything a system owner changes is logged and emailed like any other change.
Opening a record by breaking the glass does not allow a user to change its protection.
Breaking the glass
When a user who is not permitted opens a record with flexible protection, they see a warning and are asked for their reason for opening it. The reason must be at least 10 characters long. After submitting it, they are taken to the page they were trying to open, and can open the record for the rest of their session.
Access ends when they log out or their session expires. It also ends if the record's protection is changed, after which they must break the glass again.
WARNING
Only break the glass when you have a legitimate reason. Every access is recorded, along with the reason you give.
Audit trail and notifications
The following are recorded on the patient's audit trail, which you can reach by clicking History on the record:
- Break glass access: who opened the record, when, and the reason they gave.
- Record protected, Record protection changed and Record protection removed: who made the change, the previous and new protection type, and which users were added or removed.
These entries cannot be reverted.
If emails are turned on, the permitted users are emailed when someone breaks the glass or the protection changes. Users who were removed from the list, and users who were permitted before notifications were turned off, are emailed too. The user who made the change is not emailed. The email includes a link to the exact audit trail entry. It does not include the patient's name or the reason given, so this information stays inside Secure Clinic.