Approval for additional users and intake coordinator access

Hollie, Thank you for the walkthrough of the proposed additional users, and for the written description of what each group would be able to see. I have reviewed it against our business associate agreement and our internal access policy. I am content to approve the additional thirty users, on one condition that I would like documented as a control. The intake coordinators must see referrer-level data only. That means information about the referring hospital or physician group, such as the relationship, calls, tickets and contracts. No patient fields of any kind may be visible to that group, whether in pages, chat answers, search results or dashboards. To be clear about my reasoning: is any PHI in scope for the intake coordinators' work in the brain? My understanding is that it is not, and that the minimum necessary standard is therefore met only if the patient fields are excluded at the access level, not merely left out of the views they are likely to open. A hidden field is not a control. I would like to see the restriction applied by role, with the configuration described in writing. Please confirm the following: how the role is defined, who can change it, and whether a change would be visible in an audit trail. I would also ask that you tell me before any user is added to that role, not after. Danielle is copied so that the referral relations team understands the boundary and does not ask for it to be widened informally. Marisol Vega Privacy and Security Officer, Quarrington Care Network

Marisol, Danielle, Thank you both. Marisol, thanks for being so precise. It makes this easy to act on. On your conditions: - The intake coordinators will be set up as their own role, which sees referrer-level data only. Patient fields are excluded at the access level, so they do not appear in pages, chat answers, search or dashboards for that role. - Changes to the role can only be made by your admins, and any change is recorded in the audit trail, which you can review. - I will tell you before any user is placed in that role, and I will not add anyone until you have said yes. To answer your question directly: no PHI is in scope for the intake coordinators. If that ever changed, it would need a new request from you and I would not treat it as a small tweak. I will send you a short written description of the role configuration by the end of next week so you can file it as the documented control. If anything in it does not match what you expect, tell me and I will correct it before the new users go live. Danielle, I'll hold the new user set-up until Marisol has confirmed the description. Jordan has the commercial side with you, so I will leave that with him. Kind regards, Hollie Hollie Grieve Customer Success Manager, BB-Demo