Staff Permissions

Precision Security Controls

In a high-trust clinical environment, security is not about lack of trust; it's about protecting your staff from accidental data exposure and your clinic from legal liability.

Permission Categories

Permissions are grouped into logical "Control Domains":

• Clinical Records: View, Edit, or Delete clinical notes/charts.
• Financial Data: Access to invoices, reports, and tax settings.
• Patient Privacy: Ability to see full phone numbers or export patient lists.
• Administrative: Inviting other staff, changing clinic settings, or deleting branches.

Override Capabilities

While Roles (like "Receptionist") provide a template, you can apply Individual Overrides:

• Example: You have a Head Receptionist who needs access to the Daily Collection Report but not the Full Year P&L. You can toggle just that specific permission for their account.

The "Four-Eyes" Principle

For critical actions (like deleting a finalized invoice or purging a patient record), you can enable "Super-Admin Approval Required". This ensures no single person can delete sensitive data without a second authorized signature.

Temporary Access

Visiting consultants or locum doctors can be given "Expiring Access".

• Set a start and end date.
• Once the date passes, their login credentials are automatically revoked by the system.

IP & Device Bonding

For extremely sensitive clinics:

• IP Whitelisting: Staff can only log into Alphatic if they are on the clinic's secure Wi-Fi.
• Device Binding: The system recognizes the specific hardware ID of the clinic computers, blocking logins from home or mobile devices.