Glossary, regulation and privacy
What is role-based access control in healthcare?
Role-based access control (RBAC) gives each person access to systems and records according to the role they hold, such as clinician, receptionist or practice manager. It applies the principle of least privilege, so nobody can see more patient information than their work needs.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called RBAC or least-privilege access.
Why Role-based access control matters to a clinic
The HIPAA Security Rule requires access controls that allow access only to the people and software granted it,1 and UK GDPR expects the same through appropriate security. Inspectors and surveyors ask who can see what, and expect a clear answer.
RBAC also protects the business. When a member of staff leaves, changes role or works across sites, access goes with the role rather than a list someone has to remember to update.
Questions
Why enforce access in the database?
Because a rule enforced only in the application can be bypassed by any route that skips it. Enforced in the database, it holds for every route to the data. See security.
Can a receptionist see clinical notes?
Only if the clinic gives that role access. Each role sees what its work needs and nothing more.
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.