Role-Based Access for Therapy Notes and Mental Health Records

Role-based access grants permissions by job role rather than person by person. Each role has a defined set of things it can view, edit or export.

When a new therapist joins, they receive the therapist role. They do not need dozens of individual settings.

This makes access predictable, easier to audit and easier to explain to clients and regulators.

It also scales. A clinic that grows from three to thirty staff can keep the same roles and simply assign people to them.

Most mental health clinics need a handful of clearly separated roles. A typical starting set looks like this.

• Therapist or counsellor: clinical notes and plans for their own caseload.
• Clinical supervisor: oversight of supervisees' caseloads, flags and alerts.
• Reception: scheduling, contact details and attendance, but no therapy content.
• Finance: invoices, M-Pesa payments, KRA eTIMS records and insurance claims.
• Clinic manager: operational reports and aggregated data.
• System administrator: user management, without default access to clinical content.

Your clinic may need more or fewer roles. Start with these and adjust after a pilot.

In smaller clinics, one person may hold two roles, such as reception and finance. Assign both standard roles rather than creating a custom super-user.

Design role-based access by starting from tasks, not from the software's menu. Each permission should trace back to a real job.

1. List every task each role performs in a normal week.
2. Map each task to the minimum data it needs.
3. Define permissions per role: view, create, edit, export and delete.
4. Separate highly sensitive content, such as restricted notes, from general clinical notes.
5. Set joiner, mover and leaver steps so access changes on the right day.
6. Review role assignments and audit logs at least quarterly.

Write the role matrix down. A one-page table is enough for staff and auditors to understand.

Involve one person from each role when you draft the matrix. They know which data they actually use day to day.

Store the matrix with your data protection records. It is useful evidence during an ODPC inquiry or a partner's due diligence.

Role-based access is one of the clearest ways to show data minimisation under Kenya's Data Protection Act 2019. It proves that access is planned, not accidental.

Health data is sensitive personal data, and patient-care providers must register with the ODPC. If a breach poses a real risk of harm, the ODPC must be notified within 72 hours.

Limiting access reduces both the chance of a breach and its impact. The Digital Health Act 2023 adds to these expectations, so check our data protection compliance checklist.

Insurers and NGO funders may also ask how client data is protected. A clear role matrix gives them a simple, credible answer.

Document any exceptions, such as temporary access for an audit. Exceptions without records weaken the whole model.

The most damaging mistake is giving everyone administrator rights to save time. That removes every protection at once.

Shared logins are another. When several people use one account, the audit trail stops meaning anything.

Clinics also forget leavers, so close former staff and locum accounts on their last day. See also restricted notes and secure infrastructure for mental healthcare.

Finally, avoid exporting full records to spreadsheets for reporting. Use aggregated reports instead, so sensitive detail stays inside the system.

Also review the access of long-serving staff. Permissions tend to accumulate as people take on new duties.

Tymira360 uses configurable roles, so clinics can match permissions to the way they actually work. Therapy content, scheduling and finance sit behind separate permissions.

Individual logins, audit trails and restricted notes come as standard, and admins can deactivate a leaver in one step. Learn more about Tymira360 for mental health providers.

Roles can be adjusted as the clinic grows, without rebuilding the set-up from scratch. New sites or services can reuse the same role matrix.

Tymira Health can help map your role matrix into the system during onboarding.

Should receptionists see therapy notes?

No. Reception needs scheduling, contact and attendance information. Therapy content should stay with clinicians.

Can a supervisor see all notes?

A supervisor typically sees notes for the clinicians they supervise. Any wider access should be agreed by clinical leads and recorded.

How often should we review access?

At least quarterly, and whenever someone joins, changes role or leaves. Review the audit log at the same time.

What about locums and visiting clinicians?

Give them time-limited accounts with only the access they need. Close the account when the engagement ends.

Does role-based access slow staff down?

Not when roles match real tasks. Staff see a cleaner screen with only what they need.

Want to see configurable roles and audit trails in Tymira360? Book a demo with Tymira Health.