How records are protected

A patient’s record belongs to the patient. Staff can’t open it just because they work at a hospital. They need a reason that PHB recognises.

The ways a clinician gets access

Way in	When it’s used	What the clinician sees
Consent	The patient approves an access request in their app, or reads a consent code to the clinician.	What the patient agreed to.
Treatment basis	The patient is present and is being treated now.	This visit and a non-sensitive summary. Sensitive history stays hidden.
Emergency override	An emergency where the patient can’t give consent.	The full record. The clinician must give a reason. The patient is told, and the access is reviewed.
Guardian	A parent or carer managing a child’s or dependent’s record.	The dependent’s record, as the link allows.
Self	The patient viewing their own record.	Everything.

What patients control

Approve or decline a clinician’s access request at Consent.
Revoke access they gave.
See who opened their record in the Access log.
Share a record with a clinician who isn’t on PHB, using a link and passphrase that expire.
Download a copy. The link is emailed, never shown on screen.

What staff don’t see

Front desk and cashier see names, contact details, visits and bills. They never see clinical notes, results or diagnoses.
PHB’s Care Line sees what they need to call you back. They don’t see your clinical record.
PHB’s administrators run the network. They have no screen that opens a patient’s record.

Sensitive results

Some lab results, such as HIV tests, are held until the ordering doctor has spoken to the patient. Until then the patient doesn’t see that result at all. Then the doctor releases it to the patient.

Identity checks never block care

Staff may ask “who are you?” to confirm a patient’s identity. This is a check, not a gate. A patient who can’t confirm their date of birth, or has no phone, is still treated.

Why a clinician can’t see a patient

If you are staff and a record is closed to you, it is because you have no basis yet. Ask the patient for consent, open a treatment basis while they are with you, or, only in a real emergency, use the emergency override. See Getting access to a record.

​The ways a clinician gets access

​What patients control

​What staff don’t see

​Sensitive results

​Identity checks never block care

​Why a clinician can’t see a patient