Decide who can open charts, run the front desk and touch the money, down to a single patient. Then see exactly who looked at which record, and when.
Each person holds one role. Rows are permissions, columns are your roles, and a click moves a cell one step: all patients, their care team only, or none. The bottom row says how many charts a change would reach, before you save it. This is the real screen with a demo clinic in it. Click around.
The editor writes the consequence in plain language and previews the person's sidebar and the patient record as they will see it: what opens, what is locked, and what they can still book and bill.
Opening a patient, a chart, a file or a form answer writes a row: who, what, which patient and how. Filter by person, date, kind or action, and export exactly what matches as a CSV. Taking the export is itself logged.
For staff who are also patients, or anyone who asks. Only their care team opens the charts. Everyone else still sees the name, with a lock, so they can book and bill.
Someone locked out can ask. Admins and the patient's care team are notified and either can approve, and every change is written to the log.
A PIN switch gives the person at the keyboard their own permissions, never the owner's. Ten idle minutes locks the screen instead of falling back to whoever signed in.
Enrol a front-desk iPad or computer with a one-time code. It opens locked, every read is logged under the person who typed their PIN, and one click revokes it.
A Claude connection acts as the person who approved it, narrowed by their role. A front desk login can't read the books through an assistant.
On Team Practice, give the front desk "their sites": they book and bill at their own location while charts stay one record across all of them.
Roles apply to questions, too. When someone asks a question of the clinic's data in Ask & Reports, their role decides what the query is allowed to read, and every chart it opens lands in this log.
Owners and admins signed in as themselves. Someone who switched in with a PIN on a shared screen can't, whoever is signed in underneath.
No. Running the clinic (team, roles, billing, integrations, the access log) comes with being an owner or admin. Opening charts comes from a role. Most owners are practitioners and hold Full access from day one.
Roles are on Small Practice and Team Practice. The access log is on every plan, including Solo, because who looked at a record is a privacy matter rather than a feature.
No. Rows are written as it happens and the system has no route to change or remove one. Exporting the log is recorded in the log.
Who opened a patient, chart, file or form answer, when, and how: in the app, by PIN switch (with the device name), through an assistant, or via a shared link. Sharing, printing, exporting, and changes to roles or care teams are recorded too.
It gives you the tools those regimes expect, namely role-limited access and a record of who viewed what. Your obligations depend on your province and role, so confirm the details with your privacy officer or counsel.
Roles are on Small Practice and Team Practice. The access log is on every plan, from the first patient.