The receptionist who can read everything
Picture a hospital with three branches. A receptionist at one of them opens the patient system to check in a walk in. The same login also lets her open the full record of anyone registered at any branch: diagnoses, lab results, notes from the consultant. She has no reason to look. Nobody has ever told her she cannot.
This is the default state of many hospital systems, and it is rarely a decision. It is what happens when access is built around "staff can log in" instead of "this person needs this thing for this task".
What least privilege actually says
The principle is old and simple: give each person and each system the minimum access needed to do the job, and no more. In a clinical setting the difficulty is that the job changes by the hour. A nurse covering another ward tonight needs that ward's patients tonight. A billing clerk needs to know a procedure happened, but rarely needs the clinical notes that describe it.
So least privilege in a hospital is not one list of roles. It is three questions asked together:
- Who is this, and what is their role at this branch?
- What part of the record do they need: demographics, billing, clinical notes, results?
- Why now: is this patient assigned to them, or in their queue today?
A role alone answers the first question. Most systems stop there.
Design choices that make it real
Separate the parts of a record. A patient record is not one object. Administrative details, billing, clinical history and sensitive categories each carry different risk. If they live in one blob with one permission, you can only allow everything or nothing. Split them, and a receptionist sees what she needs to register someone and nothing more.
Tie access to a relationship. The strongest rule in a clinical system is often "you can open this record because this patient is assigned to you or your ward". It turns access from a standing permission into something earned by the work in front of you. When the assignment ends, so does the access.
Allow the emergency, then ask about it. Clinicians sometimes need a record they are not assigned to, and a locked door in an emergency is its own harm. A well designed system lets them break the glass: proceed, give a reason, and know that the access is flagged for review. The friction is small. The accountability is real.
Log reads, not only writes. Many systems record who changed something and say nothing about who looked. For patient privacy the looking is the risk. A usable audit trail answers "who viewed this record, when, and from which branch" without a database query and a favour from an engineer.
Expire temporary access. Locums, trainees and cover staff are where permissions pile up. Grant access with an end date by default, so removal is the system's job and not somebody's memory.
Where it does not hold
Least privilege can be pushed too far. If every lookup needs a justification form, staff will share logins to get through the day, and then you have no audit trail at all. The goal is to make the correct path the easy one. A control that slows a nurse during a bad night will be worked around, and rightly so.
There is also a real cost in setup. Defining who needs what takes conversations with clinicians, records officers and administrators, not only engineers. Expect disagreement. Expect the first version to be too tight in places and too loose in others, and plan to adjust it using the audit logs rather than guesses.
Nigeria's Data Protection Act 2023 treats health data as sensitive personal data, and privacy law in the UK and elsewhere does the same. We would not frame this as a compliance exercise, though. A system that limits access by design is easier to defend, easier to explain to patients, and easier to investigate when something goes wrong.
A place to start
Pick one question and answer it honestly this week: if a staff member at your smallest branch wanted to read the record of a patient they have never met, what would stop them? If the answer is "nothing, but they would not", you have found your first piece of work. Fix that one thing, and make the audit log show you the next.