- Ya
- 25 Agosti 2026, 19:23 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 198212c
Twenty-three rights under ServiceType.EHR, and every one of them is a SECOND gate rather than the only one. Holding VIEW_CHART does not let a member open a chart: ClinicalAccessService still requires a care relationship with that specific patient. A right says which JOB somebody does; the relationship says whose record they may do it to. Only the pair is safe, because the overwhelming majority of real HIPAA enforcement is workforce members looking up a neighbour or a relative — and in every one of those cases the role is entirely legitimate. The splits are where the thinking is. PRESCRIBE_CONTROLLED_SUBSTANCES is NOT a child of PRESCRIBE_MEDICATIONS. The DEA's EPCS rule makes it a different act: identity proofing, a second authentication factor at signing, and a logical access control naming the individual practitioner. A system where "can prescribe" implies "can prescribe controlled substances" cannot satisfy that and cannot even describe who is authorised. SIGN is separate from DOCUMENT because signing turns a draft into a legal record and a visit into a billable one — and scribes, students and medical assistants write notes they may not sign, which is the entire reason cosignature exists. REVIEW_CLINICAL_RESULTS is separate from placing orders because acknowledging a result is a clinical decision, not an inbox action: it asserts somebody qualified saw an abnormal value and decided what to do. MERGE_PATIENT_RECORDS is its own right rather than an implication of editing demographics, because merging two records is silent, very hard to undo, and produces one chart describing two people. BREAK_GLASS_PATIENT_ACCESS is a ROOT, not a child of VIEW_CHART. It is not a bigger version of viewing a chart, it is the ability to bypass the care-relationship check entirely, and a practice's answer to "who may do that" is a much shorter list than "everyone clinical". REVIEW_EMERGENCY_ACCESS is the other half of the bargain and must land on somebody other than the person who used it. VIEW_DISCLOSURE_ACCOUNTING is a root too: producing a patient's §164.528 accounting enumerates every disclosure the practice made about them, and the people who answer records requests are usually not the people who provide care. Deliberately NOT in **************** That mechanism exists to stop a new right silently REMOVING access that already worked; these gate a surface that did not previously exist, so seeding them would hand clinical access to roles nobody reviewed. Day-one reachability comes from the grant-all Administrator heuristic. Taxonomy ratchet moves 231/167/33/31 to 254/184/35/35.