A clinical system holds patient records used for care, research and operational analytics. How should access be architected?

The three uses have different rules

Care requires broad access under time pressure — a clinician must be able to see what they need in an emergency, and a control that blocks that is unsafe. Research generally requires de-identified data or a specific approval. Operational analytics rarely needs identifiable data at all.

Designing one access model for all three produces either a system that obstructs clinicians or one that grants research and analytics far more than they need.

The architecture

• Purpose-scoped access, so a user's access is granted for a use and logged against it.
• Break-glass access for care, granted quickly, logged prominently, and reviewed afterwards. The control is retrospective accountability rather than prospective prevention, because prevention in an emergency is itself a clinical risk.
• A de-identified derivative for research and analytics, generated once and governed separately, so the identifiable store has far fewer readers.
• Comprehensive access logging with review, since in this domain inappropriate access by authorised users is a more common failure than external breach.
• Minimum necessary as a design constraint, expressed as field-level restrictions rather than as a policy statement.

The de-identification caveat

Removing direct identifiers is not sufficient. Combinations of date of birth, postcode, admission date and a rare diagnosis re-identify individuals readily, and the re-identification risk rises with the richness of the dataset. This needs assessment against a stated risk threshold, generalisation of quasi-identifiers, and controls on linking datasets — not a field-removal checklist.

The operational reality

Clinicians will work around controls that impede care, and they are right to. A system that makes the safe path slow gets shared logins and screens left unlocked, which is worse than a permissive model with strong auditing. Design for the clinical workflow first and place the control where it does not sit between a clinician and a patient.