Who should see what: permissions in a veterinary practice

The most common security problem in a small veterinary practice is not hacking. It is one login that everybody uses.

It is easy to see how it happens. A system is bought, somebody sets it up, the password goes on a sticky note, and the practice gets on with its work. Nobody decided this; it accumulated.

Why one shared login causes trouble

Everybody can do everything. The new Saturday assistant has the same access as the clinical director, including the ability to delete things.

Nobody can be asked who did what. When a record is changed or an appointment vanishes, the honest answer is "one of us".

A person leaving takes the password with them. Changing it means telling everyone the new one, which is why it does not get changed.

It makes a reasonable question unanswerable. "Who viewed this client's record?" has no answer at all.

A practical way to decide access

Forget permission lists for a moment and ask one question per role: what does this person need in order to do their job, and what would they never need?

Reception needs the diary, the client list, contact details and the ability to book and reschedule. They do not need clinical records, and most receptionists would rather not have them.

Veterinary nurses need patient records, vaccinations and prescriptions — the clinical day. They usually do not need practice settings or anything to do with money.

Veterinarians need the clinical record in full, their own diary, and the ability to write what they decided.

Practice managers need the practice: team, rotas, reporting, settings. Whether they need clinical detail is a decision each practice should make deliberately rather than by default.

Locums and short-term staff need what a vet or nurse needs, for the fortnight they are there, and then not. The second half of that sentence is the part usually forgotten.

Owners need everything, including the ability to change who has what.

Roles first, exceptions second

Set a role per job and use it for almost everybody. Then grant the occasional extra permission to the one person who genuinely needs it, rather than inventing a new role for each exception — that is how practices end up with eleven roles and no idea which is which.

VetWorkFlo ships with six roles — clinic owner, practice manager, doctor, veterinary nurse, receptionist and staff — which can be duplicated and adjusted module by module, across 66 permissions and 25 modules, with direct grants for individuals. See staff management.

The part people skip: the log

An activity trail of who changed what is not about catching anybody. It is about being able to answer a question calmly — usually your own question, usually months later, usually "when did this change and why".

A half-hour that is worth it

Sit down once, list everybody who works there, write the role beside each name, and agree what each role can see. It takes less time than the next argument about who moved an appointment, and it is the single clearest improvement most small practices can make.

Ask for a demo if you want to work through your own list with somebody.