How access, records, and operations fit together.
What we do so the record holds: encryption, role separation, an append-only log — and an export a regulator accepts. Every control names the clause it implements.
- Patient
- PT-04182
- Range
- 2024-01-01 → 2026-09-17
- Users
- All (7)
- Rows
- 1,284
Per patient, per user, per time range — with no spreadsheet in the middle.
Identity and access control.
Unique accounts, a second factor on every new device, timed sessions and roles the custodian configures without engineering.
Unique accounts
No shared logins, ever. Each user has one account, traceable to one person — and every action carries that name.
Second factor on new devices
The first login from a new device requires a second factor before the device is trusted. Missing enrolments surface in the daily check.
Idle timeout and lockout
Idle sessions end automatically after a per-clinic configured period. Repeated failed logins lock the account and notify the custodian.
Role-based access
Permissions attach to roles, roles to people. The custodian configures them; every change is logged with before and after.
Role-scoped sensitivity
Clinical detail of flags, boundaries and fitness-to-practice records is visible to clinical or disclosure roles only. Reception sees the operational impact.
Bound signatures
Every electronic signature is bound to identity, timestamp and content hash. A later edit requires a new signature and preserves the prior version.
Encrypted, backed up, restorable.
The controls that make every other privacy claim verifiable — with evidence producible on request.
Encryption in transit and at rest
No cleartext fallback on the wire; databases, file storage and backups encrypted, keys held separately and rotated on a schedule.
Backups that get restored
Backups are checksummed at write time and again at restore. A quarterly recovery test is logged with operator, recovery time and recovery point.
Integrity alert
Changes to stored records outside the application path are detected and reported; signed versions stay verifiable against their content.
Data residency per clinic
Storage and processing are pinned to a named region and documented in the clinic’s record. Moving it requires the custodian’s consent.
Disposal attestations
Every medium that held health information carries a disposal or secure-erase attestation; local offline caches become unreadable on sign-out.
Daily check
Key rotation due, backup failures, overdue restore drills and MFA gaps appear in the compliance hub every day — not at the next audit.
Records and evidence.
Append-only audit log, retention floor per chart, a disclosure log per patient — built into the platform, not bolted on.
Append-only audit log
Every authentication, authorisation, record access, export, print and administrative change is logged immutably. An attempt to tamper is itself recorded.
Retention floor on the record
Computed from SP 5.4 and enforced at the record. Deletion before the floor is blocked; destruction after it leaves an attestation.
Audit export
Regulator-ready exports per patient, per user, per time range. A patient can obtain the disclosure history of their own record on request.
Disclosure log
Every disclosure to a third party needs an authorisation with effective and expiry dates, purpose, recipient and revocability — and lands in the patient’s log.
Secured channels only
Health information leaves the chart through a secured path. No path exists to SMS, messenger apps or social media.
Information Manager Agreement
Signed before the first record, verified against every Appendix 4 component, versioned, and renewed before expiry.
Operational integrity.
Resilient under network and vendor disruption, with the continuity protocol the standard requires — and proven on a schedule.
Read-only fallback
When the primary application is unreachable, the last-synced chart stays accessible in a clearly labelled read-only mode.
Offline capture with reconciliation
Clinical notes are captured offline and reconciled on reconnect. Conflicts are shown, never silently overwritten.
Monthly chaos test
An automated test proves the fallback path end to end every month, before a real outage needs it.
Status page and support reference
Public status with incident history; every error screen carries a unique reference and the assurance that the incident has been logged.
Availability objective
A published chart-load objective, measured in production. Components below the objective surface in the daily check.
Onboarding gates
No health information is ingested without a bound regulatory authority, a signed IMA, a designated HIA officer and an approved PIA.