Control who works with each healthcare record
Roles, permissions, two-factor sign-in and audit trails support accountable access. Review those controls against your staff responsibilities, then agree the technical and privacy details required for the deployment.
Make access part of the record review
Access decisions matter throughout the working day, from a receptionist opening a patient record to a colleague reviewing a facility document. The platform includes roles and permissions, two-factor sign-in and an audit trail. These controls give your team a basis for reviewing access and activity in the selected product scope.
In Care, each view of a patient’s chart is recorded with who opened it, which page and whether the person is in the care team, and changes to audited records are recorded too. Where a group requires it, a person outside the care team asks for a clinical access grant first. Review the relevant events and audit views in a demonstration, then agree the permissions and review responsibilities for your facility. This page makes no claim about immutable storage, log retention periods or access rules that have not been specified for your deployment.
Your security review also needs encryption specifications, identity integration, testing evidence and incident arrangements. Ask our team for the current security documentation for your deployment, and agree the details in writing before relying on a particular algorithm, federation protocol, certification or support commitment. This page does not claim ISO 27001 certification.
Controls to inspect and decisions to agree
The first three items describe controls in the product. The others name security and privacy scope to settle during review. None of them is treated as available until it is confirmed.
- Roles and permissions
- Control access through the platform’s roles and permissions. Review representative staff responsibilities and the information each role needs before agreeing the deployment’s access setup. Where your group requires it, a clinical access grant is requested before a person outside the care team opens a chart.
- Two-factor sign-in
- Two-factor sign-in is available in the product scope. Review the sign-in workflow and the agreed configuration. Do not assume another authentication method or an enforcement policy that has not been confirmed.
- Activity audit trail
- Care records each view of a patient chart and audits changes to records. Confirm the events, who can access the logs and the retention arrangements your organisation needs.
- Identity integration review
- Sign-in from Care to Engage is available. SAML, OIDC and SCIM are not confirmed on this page, so ask our team before including them in your scope.
- Encryption and assurance review
- Request the encryption specifications and security testing evidence that apply to your deployment. This page names no algorithm, testing frequency or independently held certificate.
- Privacy and incident responsibilities
- Agree responsibility for privacy requests and security incidents, including the incident contact, escalation and contractual notification arrangements. Clinical incident management in Flow is not a cybersecurity response service.
Review the evidence behind privacy claims
The library connects standards with product evidence. A readiness statement is not a certificate or a substitute for the organisation’s own privacy and security programme.
Common questions
-
Ask our team for the current assurance documentation relevant to your deployment. The platform’s controls can be reviewed against requirements, but this page does not claim ISO 27001 certification.
-
No. Sign-in from Care to Engage is a specific confirmed connection. SAML, OIDC and SCIM require separate confirmation before they are included in an enterprise identity scope.
-
Confirm the encryption used at rest and in transit for your proposed deployment with our team. Request the deployment’s technical specifications before completing your security assessment.
-
Flow Incidents describes clinical and facility incident workflows. It does not by itself establish a cybersecurity response service, security monitoring operation or contractual breach-notification commitment.
-
No automatic rights-request, erasure or retention workflow is established here. Agree the applicable privacy responsibilities and supported procedures with the team during the deployment review.
Not answered here? Contact the team
NXH Flow