Senior Living Communities

Contents

Care Provider Access Only (CPAO) and Restricting Security Roles  - Quick Reference Guide

Care Provider Access Only limits a user to a specific set of residents' charts through the assignment of either a medical professional/care provider or an external facility, for example, a physicians' practice group or a pharmacy, on the resident's profile page.

This feature helps you limit which resident charts a user can view when used in conjunction with other security permissions available to limit use of other areas of the application.

To set up a Security User, for example, a physician, for access to only residents they care for in your organization:

Step

Action
1.

  2. Create a new or edit an existing role.

  3. Select Billing or Care Services Module.

  4. For Resident Access Restrictions, select yes.

  5. Give or restrict access to modules, dashboards, portals and reports based on required security level.
2.

  2. Create a new Security User or click roles for an existing user.

  3. Assign the Care Provider Access Only Security Role from step 1.

  5. If you are a multi-community organization, click access.

  6. Select all communities where the user requires care provider access. 
3.

  1. Community > Billing > Medical Professionals. 

  2. Create a new or edit an existing Medical Professional.

  3. In Login Name search and select the security user from step 2. 

Note

If you are a multi-community you must complete this step for each community to which this user has access.
4.

  2. In Medial Professionals, click Modify.

  3. Select the Medical Professional from step 3.

Important

You must complete this step for each resident in the community. If you are a multi-community you must complete this step for each community to which the user has access.

  • In Security Roles, you can search and find the exact screen access options using key words. Press Ctrl+f on your keyboard.

  • When creating a Care Provider Access Only security role to assign to any user, PointClickCare recommends your security administrator creates the role and tests access before releasing the role to the user. If the test shows items the security administrator does not want the user to see, for example, names of residents for whom the user is not providing care, the security administrator can:

    • Further restrict access. For example, do not give user access to certain modules, portals, dashboards or reports, as the names of other residents can appear in these.

    • Inform user the EHR system does not restrict her/his access to certain information but you expect users to meet legal obligations to respect residents’ privacy and only access information relevant to user’s provision of care to specific residents. This should be a consistent part of your internal user training, policies and procedures, regardless of what access any user is given.

  • If you do not want a user to have access to information appearing on the portal, dashboard, and reports including all residents, you must disable the user’s access.

  • If you do not want a user to have access to modules, for example, POC and eMAR, you must disable the user’s access. Regardless of Care Provider Access Only, all resident information can be viewed in POC and eMAR modules.

  • Whether or not you add 'Home bulletin' access, PointClickCare emphasizes that users SHOULD NOT post any resident PHI in Bulletin Board Messages. You cannot restrict Home Bulletin Board access to specific messages. If a user with Care Provider Access Only has a security role with 'Home Bulletin' access, you must reinforce that no users should post any resident PHI in Bulletin Board Messages. 

You can enforce restrictions by limiting the user’s access to only one or more specific residents’ charts where the assignment is enforced, and exclude access to all other areas of the application, as appropriate. Security Administrators must test all roles they create to ensure desired results. It is important to communicate and educate users on their moral, professional, and legal responsibility to open only records they must see, regardless if the user can view other information.