Restrict a client to assigned staff

Some clients should only be seen by the people looking after them. Turn on Restrict to assigned staff and only the clinic owner and the team members you assign see that client’s name, contact details and record. Everyone else sees Secured patient followed by a number.

​

Who sees a restricted client

Restriction is off for every client until someone turns it on. It is available on every plan.

​

Assign staff and restrict the client

Assign staff before you restrict. If you restrict first as a manager who is not assigned, the client turns into a secured label on your own screen straight away — you can still open Security settings to finish.

​

What changes once it’s on

• The client list shows Secured patient and the client’s number instead of their name to everyone who is not allowed to see them. Searching by the client’s name, phone or email does not find them; searching for “Secured patient” does.
• Opening the client shows the secured label and a Security settings button — no profile, contact details or record.
• The secured number is permanent. The first time a client is restricted they get the next number for your clinic. It never changes, is never given to anybody else, and stays with the client if you remove the restriction and turn it on again later.
• Every change is recorded in the audit log: turning the restriction on or off, each team member assigned or removed, and every use of emergency access. So is an attempt to change the settings or end emergency access by someone who is not allowed to. The owner and managers see all of it for one client in the access report.
• The calendar and schedules still show the appointment — its time, service, status, provider and price — as Secured patient and a number, with no contact details, notes or visit address. It can still be moved, or marked arrived, completed or cancelled. Saving a change never replaces the appointment’s notes, which the person saving could not see.
• Search — the header search and every client picker, including the one on a new appointment, a sale or an invoice — never finds the client by name, phone, email or record number. Searching for “Secured patient” and the number does. A couple’s shared name shows the secured label in place of the restricted partner.
• Record numbers are hidden wherever the client shows as Secured patient.
• Billing keeps working. Invoices, payments, pending balances, membership payments, sales, debtors and unbilled insurance appointments keep every amount, date and status, and show Secured patient and a number instead of the client. A downloaded invoice or account statement shows the secured label too, and a superbill cannot be created.
• Sending an invoice or statement goes only to the client’s email on file. The client’s copy is addressed to them by name; you cannot add another address, and you are not shown theirs.
• Check-ins show Secured patient and a number on the front desk board, without the visit reason or notes, and a downloaded visit record shows the secured label.

​

Book a restricted client

Anyone who can book appointments can book a restricted client. The provider you choose needs to be able to see the client, so:

• If the provider is already assigned (or is the clinic owner), the booking goes ahead as usual.
• If the provider is not assigned, Book appointment asks Give this provider access? first. Select Book and give access to book and add the provider to the client’s assigned staff, or Cancel to choose someone else. Nothing is booked until you confirm. Changing the provider on an existing appointment asks the same question, with Save and give access.
• You need to name a provider. “Any available provider” is not offered for a restricted client: you’ll see This client is restricted to assigned staff. Choose a provider for this appointment.

The provider stays assigned after the visit, so they can open the notes they wrote. The owner or a manager can remove them on the Security tab, and every provider added this way is recorded in the audit log. When the client books. A booking the client makes on your online booking page, in their portal, or through your booking assistant adds the provider they booked with to the client’s assigned staff, and records it in the audit log. If the booking is not completed — the time is taken, or a payment does not go through — nothing is added. Adding the client to a class, or repeating a visit, with a teacher or provider who is not assigned is refused with a message asking the owner or a manager to assign them on the Security tab first.

​

What else is protected

Everything below applies to a team member who is not allowed to see the client. The clinic owner and assigned staff see and work with the client exactly as before.

• Clinical records. Consultations, triage, lab tests and results, imaging orders and reports, prescriptions and dispensing, clinical and dictated notes, sticky and status notes, forms the client filled in, documents, files and signature requests, measures, problem list and history, ward admissions, vitals, nursing notes, drug charts and care plans, maternity and theatre records, drug-test orders, insurance claims and pre-authorizations, and secure messages. None of them appear (a prescription in the pharmacy, lab and imaging orders, consultations, triage records and ward stays appear only as a secured row, below), and opening a link to one shows This record could not be found, or you do not have access to it. The exception is a consultation, triage or ward chart, which shows the secured label and the way to request access instead, as described below. They also cannot add a new record for the client.
• Queues and history lists leave the client out: the records queues, form invitations and pre-screen reviews. Pharmacy, lab, imaging, consultation, triage and the wards are the exceptions — see the next points.
• Pharmacy queues and history show a secured row, not a gap. A prescription or counter sale for a restricted client you are not allowed to see appears in the pharmacy queue, Pharmacy History and the dashboard’s recent prescriptions as Secured patient and a number, with {n} items waiting (or the status of a counter sale) — and nothing else. There is no name, record number, medicine, dose, instruction, prescriber or note, and the row cannot be opened or dispensed. If you are assigned, covering or in the client’s department, you see the row normally. Otherwise select Request emergency access on the row (see Emergency access): once it is granted the row opens like any other, until the time you chose. The pharmacy’s counts include these rows, so a queue total is the real number of items waiting. Seeing a secured row is not logged as opening the record, because nothing about the client is shown; every emergency access is.
• Lab and imaging queues and history show a secured row, not a gap. A lab or imaging order for a restricted client you are not allowed to see appears in the lab queue, Lab History, the radiology queue, Radiology History and both station dashboards as Secured patient and a number, with {n} lab orders waiting or {n} imaging orders waiting — and nothing else. There is no name, record number, test or exam, result, finding or note, and the row cannot be opened, accessioned, reported on or have a result entered. If you are assigned, covering or in the client’s department, you see the orders normally. Otherwise select Request emergency access on the row (see Emergency access): once it is granted the orders open like any other, until the time you chose. The station counts and charts still include these orders. Seeing a secured row is not logged as opening the record, because nothing about the client is shown; every emergency access is.
• Consultation, triage and ward lists show a secured row, not a gap. A restricted client you are not allowed to see appears in the consultation queue, Consultation History, the triage queue, Triage History, the ward discharge list and the nursing station as Secured patient and a number, with what is waiting — Waiting for consultation, Waiting for triage, Currently admitted, or how many records or discharged stays there are — and nothing else. There is no name, record number, complaint, vitals, diagnosis, note, ward name, bed or dose, and the row cannot be opened. If you are assigned, covering or in the client’s department, you see them normally. Otherwise select Request emergency access on the row (see Emergency access): once it is granted the client appears in the list like any other, until the time you chose. Seeing a secured row is not logged as opening the record, because nothing about the client is shown; every emergency access is.
• The consultation, triage and ward charts stay closed. Opening one of these charts for a client you are not allowed to see — from a link, a bookmark or the browser’s back button — shows Secured patient and a number, This consultation is secured, This triage record is secured or This admission is secured, and Request emergency access. Nothing from the record loads, nothing can be saved, and the visit is not logged as opening the chart. Once access is granted the chart opens by itself. Saving a consultation, a triage, a ward note, an observation, a drug round or a discharge for such a client is refused with the same answer as a record that does not exist.
• Boards keep the space and hide the person. In the ward’s bed grid a bed stays shown as occupied and a class place as taken, with Secured patient and a number instead of the name, diagnosis, status, attending or notes. Select the bed and you are offered Request emergency access in place of New Vitals and View Patient.
• Downloads of clinical notes, lab, imaging and employer reports, and signed documents give the same “could not be found” answer.
• Exports leave out the client’s records and details when the person who asked for the export is not allowed to see them. Billing exports keep the row, so totals still add up, and show the secured label instead of the client.
• AI agents never see a restricted client, whoever set the agent up: an agent acts as if the client does not exist, and AI lab reports leave the client’s results out.
• Emails to the clinic name the client as Secured patient and a number. A refill reminder or a note mention includes the details only for people allowed to see the client. The clinic’s copy of tomorrow’s appointment reminder and the payment received or failed notice name no client at all, for every client: they say when, what and how much, and you open the calendar or billing after signing in for the rest.
• Files, recordings and attachments the client uploaded or that belong to their visits — documents, call and dictation recordings, secure message attachments, imaging, and files a signer uploaded — cannot be opened or listed. Call chat, claim and pre-authorization letters and documents, reminder message logs and AI search results stay out of reach too.
• Writing into the client’s chart is refused everywhere, not only on the forms: adding a note, vitals, a result, a prescription, a claim or a signature request for the client, marking their form answers or resolving their pre-screen gives This record could not be found, or you do not have access to it.
• The triage patient list leaves the client out, since a triage cannot be started for them.
• The audit log shows Secured patient and a number instead of the client’s name to a manager who is not assigned, and searching the log by that client’s name finds nothing. Who did what, and when, stays visible.
• The store and customer history keep the order and the amounts but show Secured patient and a number instead of the buyer’s name, email, phone and addresses. A customer’s purchase history keeps the monthly spend but not the products bought.
• Choosing a client for a membership, an add-on or a package lists the client as Secured patient and a number, so billing still works.
• Converting a lead into a client never links the lead to a restricted client you cannot see, even when the email or phone matches. You’ll see This record could not be found, or you do not have access to it. — ask the owner or an assigned team member to convert it.
• A second client on a visit (a couple or a group) who is restricted does not become visible to the visit’s provider when you add them. The provider sees the secured label, and the visit shows in the client’s access report as flagged so the owner or a manager can assign the provider if they should have access. When the client books the visit themselves, the provider is added to their assigned staff, as for the main client.
• Mail does not suggest the client’s address when you type a recipient.
• Reports leave the client out of the patient journey figures. Counts that name no one stay the same.
• Outside calendars you sync to show the general appointment title, never the client’s name.
• Medicine safety checks that need the client’s allergies and medicines say the check could not run, rather than showing a clean result, when the person dispensing is not allowed to see the client.

​

Emergency access

A team member who is not assigned can still open a restricted client when they need the record to provide care — for example, the client arrives unwell and the assigned provider is away. This is sometimes called “break the glass”.

• The clinic owner and the client’s assigned staff are told at once, with an in-app notification Emergency access was used for a secured client. It does not name the client, you, or your reason — they open the report to see it.
• Your reason is kept in the client’s access report and the clinic’s emergency access report, with the time and the length you chose.
• Asking again while your access is still open extends it instead of starting a second one. The button reads Extend emergency access, your new reason is added to the report beside the first, and access runs to the later of the two end times. No single request can last more than 24 hours.
• The owner never needs it, and neither does anyone assigned: the button only appears for a team member who cannot already see the client. Managers who are not assigned use it like anyone else.
• Access ends on its own at the time you chose. The owner or a manager can end it earlier — see below.
• AI agents are not given access by it: an agent still acts as if the client does not exist.

​

Access report

The owner and managers see an Access report on the client’s Security tab:

• Currently assigned — who is assigned, since when, and who assigned them.
• Emergency access — every time it was used for this client: who, when, their reason, how long, any extensions, and who ended it. A live grant shows Active and an End access button. Select it, then End access in the confirmation, and that team member stops seeing the client straight away; the grant and its reason stay in the report, and they are told their access was ended.
• Recent access events — assignment and emergency access changes, refused attempts to change the settings or end access, and visits booked with a provider who is not assigned, marked Refused or flagged.

For the whole clinic, open Audit Log and select Emergency access. The report lists every grant in the dates you choose — the team member, the client’s secured label, the reason, how long, whether it is still active, and who ended it early — a page at a time. It never shows the client’s name.

​

Access log

Below the access report, the client’s Security tab shows an Access log — every time the record was opened, downloaded or printed, and every use of emergency access, newest first. Each row shows what happened, who did it, and when. Only the clinic owner and the client’s current primary provider (set under Care team below) see this log. A manager who is not the primary provider does not — the access report above already covers assignment and emergency-access changes for managers; the access log is for the clinician actually treating the client.

​

Legal hold

When records may be needed for a legal matter, place a hold so this client’s records are not removed on a retention timer. While a hold is on, these scheduled removals stop: the retention clean-up of old records, telehealth recordings and call notes past their keep-for date, unassigned incoming faxes, exact locations on form answers, spam and trash in the mailbox, and the removal of very old audit entries (clinic-wide holds only). A recording, fax or message is not tied to one client, so a hold on any one client keeps those for the whole clinic. Copies you export are not held. On the Security tab, under Legal hold, select Place a hold and say why. Release it, with a reason, when the matter ends. Both are recorded, and the hold stays on record after it is released. A hold on the whole clinic is placed in Security settings. Placing a hold does not stop you deleting the practice: that is a separate, owner-confirmed step. If you are closing the account, tell support about the hold first.

​

Substance use consents

If your clinic is a Part 2 program, the Security tab also shows Substance use records: consent to share (42 CFR Part 2). See Substance use records and 42 CFR Part 2.

​

Services the client pays for themselves

United States: the US claim submission skips a claim whose service dates overlap an active restriction. Outside the US: a claim or pre-authorization sent through the health plan’s portal, by e-mail or by webhook is skipped the same way. When a client pays for a service themselves, in full, and asks that it not be shared with their health plan, your clinic has to agree. Record it on the Security tab under Services not shared with the health plan: select Record a restriction, choose the first and last date of the service, and confirm the client is paying for it themselves, in full. While the restriction is active, a claim or pre-authorization whose service dates overlap it is not sent to the health plan, by any route (the health plan’s portal, e-mail, a webhook or the US claim submission). You see: “This client asked that this service not be shared with their health plan, and your clinic agreed. It was not sent.” A claim link already e-mailed for those dates stops working when you record the restriction. A claim with no service dates is held while any restriction is active. On the Outside the US insurance setup, Bill HMO refuses a visit under an active restriction before any claim is made. You see: “This visit can’t be billed to the HMO: the patient paid for it themselves and asked that their HMO not be told.” Bill an HMO at the till Select End and give a reason when the client changes their mind. The restriction stays on record. A client can also ask from the portal; the request arrives with its deadline in Client requests about their record.

​

Disclosure accounting

The Disclosure accounting section on the same tab lists disclosures of this client’s record to someone outside your clinic. A client is entitled to this list for the last six years, so it is on every plan and covers six years unless you choose a date range.

• Exports and prints — a clinical report, invoice or other document downloaded or printed as a PDF.
• Emails — a signed document or payment notice emailed to the client or another recipient outside your clinic.
• Shares — a signed document sent to someone who is neither the client nor a member of your clinic (an employer, insurer, or a witness on a form, for example).
• Report links — a lab result, prescription, radiology report or clinical note sent as a private link to anyone other than the client’s own email on file. See Send a report securely.
• API — information an outside organisation received through the ClinikEHR API: the organisation, the kind of record and how many times that day.
• Recorded by the clinic — disclosures the system cannot see, which you record yourself.

Choose Last 6 years to pick a narrower range. Select Export CSV to save the list for your own records. The export itself is recorded in the HIPAA audit log.

​

Record a disclosure

Some disclosures happen outside the product: a court order, a report to a public-health authority, a request from law enforcement. Select Record a disclosure, give the date, who it went to, what was shared and why, and the legal basis if you have one. Do not record disclosures made for treatment, payment or running the practice; the law leaves those out of an accounting. A recorded disclosure is never edited. If you made a mistake, select Void and give a reason: the entry is kept, marked, and left out of the list. A client can also ask for this list from the portal; see Client requests about their record. Emergency access has its own report above rather than appearing twice.

​

Unusual access alerts

The clinic owner gets an in-app notification when access to a restricted client looks unusual:

• Many secured records opened quickly — one team member opens several restricted clients’ records in a short time.
• Access outside business hours — a restricted client’s record is opened outside your clinic’s normal hours (Monday to Friday, 9am to 5pm, unless your clinic has different hours on file — set them on Settings → General → Business hours).
• Repeated emergency access — one team member uses emergency access several times in a short period.

Each notification gives counts and a link to the audit log — never a client or team member’s name. Open the link to see who, using the access you already have.

​

Access alert settings

The owner or a manager can change how sensitive these alerts are on Settings → Security → Access alerts: how many secured records opened, and within how many minutes, before the “many records opened” alert fires; how many times, and within how many days, before the “repeated emergency access” alert fires; how many times a client may ask to restrict their own record from the portal before it asks them to wait (see Privacy requests below); and which categories are hidden from a guardian/proxy portal view by default for a client who has not had this set individually (see Proxy access limits below). Until changed, the defaults are 5 records within 60 minutes, 3 emergency accesses within 30 days, 5 privacy requests within 7 days, and every category hidden. Alerts still always go to the clinic owner.

​

Periodic access review

Every quarter, if your clinic has restricted clients, the owner sees a reminder to confirm their assignments are still correct. It appears as a card at the top of Audit Log and as an in-app notification. For each restricted client still needing review, select Confirm assignments if the current team is correct, or Needs change if it should be updated — then make the change on that client’s Security tab. A review from an earlier quarter that is still open counts as overdue and stays on the list until it is confirmed.

​

Privacy requests

A client can ask, from their own portal, for your clinic to restrict who can see their record — with an optional note about why. It shows up two places:

• A small queue on Audit Log, under Privacy requests — every open request across your whole clinic, newest first.
• On that client’s own Security tab, if they have an open request.

Select Approve to restrict the record the same way Restrict to assigned staff does — choosing who to assign in the same step, or leaving it empty and assigning staff on the Security tab later — or Decline, with an optional note the client will see either way. A client can have only one open request at a time; if you decline, they can ask again later.

​

Proxy access limits

When a parent or guardian reaches a dependant’s portal record through a shared contact email — common for a child too young to have their own email on file — some categories of sensitive record stay hidden from that guardian by default, even though the dependant sees them fine on their own login: behavioural health, substance use, reproductive health, HIV status, and other sensitive records. This covers the dependant’s documents, consultations, files, lab results, imaging reports and prescriptions. A shared contact email is what makes someone a guardian here. A client whose own email is on their record is not treated as a proxy on their own login, so their own sensitive records are never hidden from them. On the dependant’s Security tab, under Proxy access limits, select a category to toggle it between Hidden and Visible for that guardian. Every category starts hidden until you change it for that specific client — unless the owner or a manager has narrowed the clinic-wide starting point on Settings → Security → Access alerts, which every client who has not had this set individually then follows.

​

Care team

Beyond who can simply see a client, you can tag what each person on the team does for them — their care team.

​

Roles

On a client’s Security tab, under Care team, each team member can carry one role for that client: A client can have only one Primary provider at a time — assigning a new one is a transfer of care, not a two-click change. To add any other role, choose a team member and a role under Care team and select Add. To remove one, select the small × beside their name, then Remove in the confirmation. A client’s current primary provider can also add or remove the other roles (Specialist, Care coordinator, Nurse, Billing) without being a manager — but not reassign who is primary; that always goes through transfer of care, below.

​

Time-limited roles (locum cover)

Any role, including Primary provider, can carry an end date — useful for a locum covering while the usual provider is away, or a role that only applies for a referral episode. When you add a role, set an optional end date; leave it blank for an ordinary, open-ended role. A role with an end date shows until <date> on the badge, and stops applying automatically once that date passes. Two Primary providers may hold the role for the same client only if their dates don’t overlap — a locum’s window (for example, 10–24 September) can sit before or after another provider’s, but not on top of it. If you try to set a primary provider whose dates clash with someone already primary, you’ll see This client already has a primary provider for that time window — choose different dates, or use transfer of care to hand off permanently instead.

​

My Patients

Sidebar → My Patients is each provider’s own worklist: every client they’re assigned to — whether through a care team role or under Assigned staff on the client’s Security tab — plus any clients they’re covering for a colleague (see below). A client you hold a role on shows that role; a client you’re assigned to without a role shows Assigned. A client a triage nurse assignment put on your list shows the role Nurse. A client the front desk assigned to you at check-in today is listed for that day too, marked Checked in today, and drops off tomorrow unless you are assigned another way. An assignment with an end date drops off the list once that date passes. For each client it shows their next upcoming visit, open tasks assigned to you for that client, forms sent to the client that are overdue, and lab or imaging results completed in the last week. Select any client — anywhere on the row, or the card on a phone — to open their details. The sheet shows:

• Patient — their ID, age and sex, whether the record is restricted, whether they are checked in today, and their next visit.
• Your assignment — why the client is on your list (a care team role, an assigned-staff entry that gives you access, a department or ward you work in, coverage for a colleague, or today’s check-in), who assigned you, and since when, with any end date. A client you are the triage nurse of record for names the triage department.
• Care team — everyone on the client’s care team with their role, with you marked.
• What needs you — your open tasks for the client, overdue forms and new results, each with a link to where you deal with it. When nothing is waiting it says so.
• Recent activity — their last visit, latest consultation and latest triage.

Open patient record at the bottom opens the client’s chart. The address keeps the open client, so refreshing the page or sharing the link reopens the same sheet; closing it removes the client from the address. Opening a client’s details is recorded in the audit log. A restricted client you are entitled to shows their real name with a Restricted badge. The sheet never shows more than you may see. Unassign yourself or hand a client over. Select the three dots on a row, or use the buttons at the bottom of the sheet:

• Unassign me takes only you off the client — no one else’s assignment changes, and no one is notified. You are asked to confirm, and the message tells you if the client will be left without a primary provider or if you will lose access to a restricted record. The assignment is ended, not erased: you stop being on the client’s team and lose any access it gave you straight away, and the record of when you were assigned stays. If you open the client again, Your previous assignments lists what you held and when it ended. It is offered only where you hold an assignment of your own; a client who is on your list only because of coverage or today’s check-in has none to remove, and trying again once you are already off says so.
• Reassign… opens a panel where you choose a colleague. Anyone can Send for acceptance — write a handoff note, and it files a transfer of care: the colleague must accept before the client moves, and until they do you stay assigned. Owners and managers also see Reassign now, which is selected by default for them: the client moves to the colleague straight away, you come off the care team, the colleague gets a notice that a patient was assigned to them, and the change is written to the audit log with who did it. Reassign now has no handoff note, because nothing waits for the colleague to accept. It is offered for clients you hold a care team role on.

If you are a client’s primary provider and not an owner or manager, Unassign me asks you to use Reassign… instead, so the client is never left without a primary provider. Taking someone off a client on their behalf is on the client’s Security tab. Every assignment, ending, coverage period and transfer is written to the audit log with who did it and when.

​

Covering for a colleague

Going on vacation or taking on-call? On My Patients → Coverage, select Hand off coverage. In the panel, choose who is being covered, who is covering, the dates, and an optional reason, then select Hand off coverage. You can hand off your own clients; the owner or a manager can hand off anyone’s. The dates are whole days, including the last one, and a single date covers just that day — up to 90 days at a time. For that whole window, the covering colleague sees every client the covered provider is assigned to — marked Covering for <name> on their My Patients list — and it ends on its own at the end of the last day. Select any coverage entry to open its details: who covers whom (with their roles), the dates, the reason, who set it up (and who revoked it), whether it is Upcoming, Active, Ended or Revoked, and the clients it covers — only the ones you are allowed to open are listed; the rest are counted. To end it early, select Revoke coverage at the bottom of the details, then confirm. Only the owner, a manager or the provider being covered can revoke it, and only while it is upcoming or active. Revoking something already revoked says so instead of confirming again. The address keeps the open entry, so a link opens it directly. The covering colleague is notified when coverage starts. Coverage never names a client in that notice — only whose patients, and for how long.

​

Transfer of care

To hand a role on one client to a colleague permanently — not just cover for a while — go to My Patients → Transfers, select Request transfer, and in the panel choose the client, who receives it, and write a handoff note. The list offers every client you hold a care team role on, however many you have, and only colleagues who can actually sign in and receive the request. The receiving provider gets a notification and must Accept it before anything changes — nobody’s role moves until they do. They can also Decline, optionally with a reason, and you can Cancel request while it’s still pending. Each of these asks you to confirm first. Owners and managers who would rather not wait can use Reassign now from My Patients → Reassign…, which moves the client at once; it is refused while a transfer for the same role on that client is still pending, so decide or cancel that first. Select any transfer to open its details: the client, the role being handed over, who it is from and to, who requested it, the handoff note, and a timeline of when it was requested and decided and by whom. If the sender no longer holds the role by the time you open it, the sheet says so and Accept transfer is not offered — Decline it and ask for a new request. Accepting hands over the role together with any end date it had. Accept, Decline and Cancel request are at the bottom — each is shown only to the people who may do it (only the receiving provider accepts or declines; the sender, the owner or a manager cancels). Transfers waiting for you are marked Awaiting you. The handoff note and decline reason are visible only to the two providers involved and to the owner and managers. Opening a transfer is recorded in the audit log, and the address keeps the open transfer so a link opens it directly.

​

VIP / confidential clients

For a client who needs extra discretion — a well-known person, a staff member’s own family, anyone the clinic wants to handle with particular care — turn on VIP / confidential on the client’s Security tab.

• Turning it on also restricts the client to assigned staff, the same as Restrict to assigned staff above — you don’t need to turn both on separately.
• The clinic owner is alerted on every emergency access to a VIP client, in addition to the usual notice to assigned staff — so a VIP client’s record being opened under emergency access always reaches the owner, even on a clinic where the owner doesn’t otherwise hold a day-to-day staff role.
• Turning VIP off does not remove the restriction. If you also want the client visible to everyone again, switch off Restrict to assigned staff separately.
• A VIP badge shows next to the client’s secured label, visible only to people who can already see the client.

​

Sensitive records

Some individual records need to stay closed even to staff who can otherwise open the client’s record — behavioural health, substance use, reproductive health, HIV status, and similar. You can mark these: In each case choose a category and select Save. On a form that creates the record, the sensitivity is applied as soon as it saves — if that does not go through you are told so explicitly, rather than being shown a plain “Saved”.

• Only the person who recorded it, the client’s care team, and the clinic owner can open a sensitive record, or change the mark. A manager cannot — even though a manager can otherwise open most of the client’s chart. This applies even when the client themself is not restricted — sensitivity is a separate lock from the client-level restriction above.
• Everyone else sees “Sensitive note” in the list, with no title, no content and no author name — the row is there so counts and dates still add up, but it can’t be opened.
• Choose “Not sensitive” in the same place to remove the mark.
• A consultation or document you mark also follows the client’s Proxy access limits — see below.

​

Restrict by department

Instead of — or alongside — naming individual people, you can restrict a client to everyone in one or more departments. On the client’s Security tab, under Department scope, choose the departments and select Save department scope. Anyone whose own team profile is set to one of those departments can then see the client, in addition to anyone assigned by name. Set a team member’s department from Settings → Staff: open their actions menu and select Set Department. Like named assignments, department scope only matters once Restrict to assigned staff is switched on above.

​

Remove the restriction

​

Check it worked

Ask a team member who is not assigned to search for the client by name. They should find nothing, and the list should show Secured patient with the client’s number instead.

​

If something goes wrong