How to Control Access to Restricted Therapy Notes

Restricted therapy notes are the parts of a mental health record that only the treating clinician, and sometimes a named supervisor, should see. They often include detailed session content, personal history and the clinician's working reflections.

They differ from the general record that front desk, billing or other providers may need. That general record holds appointments, attendance, consent status and invoicing details.

Separating the two lets the clinic run smoothly without exposing the most sensitive information to everyone who logs in.

Access control matters because health data is classed as sensitive personal data under Kenya's Data Protection Act 2019. Clinics must process it lawfully, minimise who can see it and protect it from unauthorised access.

Providers handling patient data must also register with the Office of the Data Protection Commissioner (ODPC). If a breach creates a real risk of harm, the ODPC must be notified within 72 hours.

Beyond the law, access control protects trust. Clients who fear that receptionists or relatives on staff can read their notes may hold back information or avoid care.

You set up access by deciding roles first, then mapping each role to the smallest set of record sections it needs. A simple sequence works for most clinics.

1. List every role in the clinic, such as therapist, supervisor, front desk, finance and clinic director.
2. Classify record sections into general, clinical and restricted, and agree who owns each class.
3. Grant restricted notes to the treating clinician by default, and to supervisors only where your policy allows.
4. Define a documented "break-glass" process for urgent access, with a reason field and automatic alerts.
5. Switch on audit logging for every view, edit, export and print of restricted content.
6. Review user access monthly and remove accounts as soon as staff leave or change roles.

A good permissions model is simple enough for staff to understand and strict enough to protect clients. Look for these elements in your system and policy.

• Role-based permissions rather than one-off settings for each user.
• A clear split between psychotherapy notes and the shareable clinical summary.
• Read-only views for supervisors where full editing is not needed.
• Time-limited access for locum or visiting clinicians.
• Audit trails that show who accessed what, when and from which device.
• Masked client details on billing screens, including SHA claim workflows.

For a wider view of the safeguards regulators expect, see our data protection compliance checklist for Kenyan clinics.

The most common mistake is giving everyone "admin" rights to save time. Shared logins are a close second, because they make audit trails meaningless.

Other weak points include exporting notes to personal email, printing sessions without a log and leaving former staff accounts active. Sending appointment details over unsecured messaging apps can also reveal more than intended.

Each of these gaps is fixable with clear roles, named accounts and regular access reviews. Strong access control also makes it easier to keep compliance-ready therapy documentation.

Tymira360 brings scheduling, clinical notes, consent and billing into one record, so permissions can be set once rather than across several tools. Each role sees the screens it needs and nothing more.

Because activity is logged in one place, clinic leaders can review access patterns before an audit, not after a complaint. This also supports preparing mental health records for audits.

Policies still need human ownership. Software makes the rules visible, but your clinical and data protection leads decide what the rules should be.

Who should be able to read restricted therapy notes?

Usually only the treating clinician, plus a named clinical supervisor where your policy allows. Front desk, finance and most managers should see the general record only, such as appointments, attendance and billing status.

What is break-glass access?

Break-glass access lets an authorised user open a restricted record in an urgent situation. The system should ask for a reason, record the event and alert the record owner or data protection lead for review.

Do clients in Kenya have a right to see their own notes?

The Data Protection Act 2019 gives data subjects a right of access to their personal data. Clinics should have a written process for handling requests, reviewed by their legal or data protection adviser.

How often should we review user access?

A monthly review suits most clinics, with immediate removal when someone leaves. Larger organisations may also run quarterly reviews of audit logs for unusual access patterns.

Can billing staff process SHA claims without seeing session notes?

Yes. Claims typically need service, date and provider details rather than session content. Configure billing screens to show only the fields required for the claim.

Want to see role-based access in action? Book a demo of Tymira360 and explore how one connected record keeps therapy notes private.