Experimental feature: This is not generally available to all customers at this time, and is subject to further revision.
For organisations that work with outside providers, we have a introduced a more detailed provider dashboard user experience locked down to the provider's current patients.
Provide navigation specific to the individual provider
CareRight currently supports a solo provider calendar view.
Extra permissions have been introduced, for view_own_patients aimed specifically at clinician logins.
The navigation links presented when only this permission is available would be adjusted to refer a provider to only their own calendar and tools.
Additionally, a further permission for locking down calendars is available:
When this is set; only calendar views related to the current provider appear in the dropdown
Security Policy Modification: view client (view patient)
We have modified patient policy security checks; so that if there is an attempt to access a record through an area we have missed locking down - ie a link in a task or similar; permission is denied when following the link.
The provider tries to access a client record; but fails the checks.
This reduces risk of PII disclosure to only name, dob, gender or similar summary information through advanced search or similar if an area has been missed.
Security Policy Modification: Allowed access
When only view_own_patients is granted; permit access by
“Provider association as a case worker”, or
Has an “Appointment where they are the provider” or
They are the client's “Primary provider”.
Primary Provider
When the primary provider is set, access is permitted.
Provider on Appointment
Where an appointment exists, access is permitted. Note that there would be no time limits, so an appointment 3 years ago would grant a provider a degree of access; as they provided treatment and created clinical notes, etc.
Initiative worker (Case worker)
Where a case is specifically assigned to a provider, they would be granted access.
Advanced search
Access restrictions are enforced similar to the view patient behaviours. This is audited as an access.
