Five questions, answered before anything opens.
Are you who you say you are?
People sign in once, through the identity provider the hospital already runs. We do not create another username and password for staff to forget, write down, or share on a busy ward.
What is your job here?
Roles come from your directory, not from a list we keep separately. When someone changes job or leaves, that flows through — you are not relying on anyone remembering to tell us.
What is your relationship to this patient?
This is the one most systems skip. Being a nurse does not mean every patient in the hospital. Access depends on the ward, the shift and whether this patient is actually in your care right now.
What if you genuinely need to override it?
Emergencies do not respect access rules. So there is a deliberate way through — one that asks for a reason, opens the record, and puts the person's name against it for review.
What about the systems, not the people?
Integrations get treated the same way. Every connected system has its own credentials, its own scope, and shows up in the same records as any human caller.
Every open, and every refusal, leaves a trace.
Six conversations, in this order.
The third one is where projects usually go wrong — deciding what context actually means for each role takes longer than anyone expects, and it is worth the time.