Designing access controls for healthcare software

Healthcare software that shares documents with patients and external physicians has a brutal constraint: a single access mistake isn't a bug report — it's a HIPAA violation and a patient safety issue. The access model at LifeChoice didn't start with features. It started with a single principle: no patient data is ever publicly accessible, by design or by default.

Role-based isn't enough — you need per-patient scoping

A standard RBAC model (doctor, nurse, admin, patient) fails here because a doctor shouldn't see every patient's documents — only the patients they're actively caring for. We needed access that combined role-based permissions with per-patient assignment: the intersection of 'what can this role do' and 'which patients is this person assigned to'.

• Every document access check evaluates both the user's role AND their patient assignment list
• Assignment lists are maintained by clinic staff, not the engineering team
• Audit logs capture every access decision, not just successful accesses
• No 'super admin' role that can view all patient data — there is no backdoor

Sharing with people outside the clinic

Patients and external physicians needed access without having permanent clinic accounts. We built a shareable-link system with explicit constraints: each link grants access to a single document, has a configurable expiry window, and is tied to an email address the clinic explicitly enters. Links are single-use by default, and every access generates an audit entry.

The test for 'secure' in healthcare isn't whether you can describe the architecture. It's whether you can show an auditor exactly who accessed what, when — and prove the system couldn't have allowed anything else.

Before launching, we walked through the security model with the clinic's compliance team — not as a handoff, but as a collaborative review. The controls we put in place weren't just ours; they were co-designed with the people who'd be accountable for them. That's the difference between 'security we implemented' and 'security everyone trusts.'