Protecting patient data in a small clinic

Access that fits the job, and one account per person

The most important rule of data protection is that each person sees only what their work needs. Reception does not need clinical notes, a doctor does not need the cash screens, and an accountant does not need laboratory results. The fewer people who can open a file, the fewer chances for what is in it to leak.

Two people should not share one login, however much easier it looks in the first week. A shared account erases the record of who did what, and it cannot be closed without stopping everyone's work. In DrOnlineIQ each staff member has their own account, and access is set by role.

A strong password, and optional two-step sign-in

A long password that is not used anywhere else is better than a short complicated one. Do not stick it to the screen on paper, do not send it in a message, and do not let anyone but its owner know it.

DrOnlineIQ offers optional two-step sign-in, so knowing the password is not enough to enter an account; a code from the owner's phone is needed too. You can also create recovery codes and keep them somewhere safe, so you can still get in if the phone is lost. It is worth turning on at least for the owner's and the manager's accounts.

Private files, and results a doctor sees first

Each clinic's data is separate from every other clinic's, and staff of one clinic cannot open another clinic's patients. A patient's files, such as scans and laboratory reports, open only after sign-in, so there is no public link that anyone who receives it can open.

Think about what leaves the system: a photo of a report sent through a messaging app is out of your control at once. It is safer for a result to be reviewed by the doctor first and made available to the patient afterwards, rather than reach the patient before anyone has explained it. The review step before release to the patient exists for that reason.

Who did what, and what happens when someone leaves

An audit log tells you who opened a file or changed a detail, and when. Its first use is not accusation but reassurance: when a patient asks about a visit or a wrong detail turns up, you can look at what actually happened instead of guessing.

When a staff member leaves, close their account the same day, and change any password they knew for a shared device or service. Their account's history stays in the audit log, and nobody needs to hand their own password to a successor.

Backups, and screens left open

Do not settle for hearing that your data is kept safe. Ask any vendor, including us: when was a copy last actually restored to prove it works, what was restored, and how long did it take? A backup nobody has restored is a hope, not an assurance. Ask also whether you can take your data out in a form you can open without the vendor.

Finally, the simplest risk: a screen left open in the waiting room. Make sessions end when a device is left, train staff to lock the screen when they step away, and turn screens away from patients.

• Lock the device when you leave the desk, even for a minute.
• Do not sign in with your account on someone else's device and walk away.
• Do not take screenshots of patient data or send them through messaging apps.