Provider journey
Who this is for: clinicians, and whoever credentials them.
Source: guides/workforce.md, guides/clinical.md, guides/imaging.md, guides/lab.md,
guides/pharmacy.md, guides/access-control.md.
The shape of it
register → credentials → access → reach a patient → record care → orders & results → referrals
⚠ The step people skip is "reach a patient". Being a registered clinician with the right role is not by itself permission to open any particular patient's record. Access is decided per patient, every time, and every decision is recorded. Most of the confusion in this journey lives there, so Why a record will not open is the section worth reading first.
1. Register the provider
⚠ Never a direct person write. Providers are created through provider registration, which creates the underlying person record as part of registering — the same rule as patients and staff.
⚠ If the person is already known to the platform — already a patient, or already staff — link the existing person rather than registering them again. Two records for one human means their clinical history, employment record and provider identity end up on different identities.
→ Guide: Staff and workforce
2. Credentials and privileges
A credential records a qualification: what it is, who issued it, and when it expires.
Credentials are not decorative. A unit can require a valid, non-expired credential before anyone is assigned to or claims a shift there.
⚠ That gate does not act retrospectively. Turning it on stops new assignments; it does not remove someone from a shift they already hold when a credential lapses. Releasing them is a separate, deliberate act — see the staff journey.
3. Access
Two different things both have to be true, and they fail differently:
| Layer | Question it answers |
|---|---|
| Role and permission | May this person do this kind of thing at all? |
| Patient access | May they do it to this patient's record? |
A clinician can hold every clinical permission in the product and still be refused a particular record. That is the system working.
Why a record will not open
When the platform refuses, it tells you which of these it was. The distinction matters because each one is fixed by a different person:
| What you are told | What it means | Who fixes it |
|---|---|---|
| You do not have permission to perform this action | The role lacks the permission | Whoever manages roles |
| Required permission is missing for this action | The permission is not granted anywhere in your roles | Whoever manages roles |
| Access is outside your assigned scope | You hold the permission, but not for this facility/unit | Whoever sets your scope |
| The patient is not visible in this workspace | The patient exists but is not in the tenant/facility you are working in | Switch facility — or the patient genuinely belongs elsewhere |
| You do not have patient access for this resource | The patient is visible, but you have no grant to their record | Requires a patient-access grant, not a role change |
| Policy denied this request | A policy rule refused it, beyond simple permissions | Whoever owns the policy |
| This feature is not enabled for your workspace | The module or feature is off for this tenant | An administrator |
| The user account could not be resolved | Your account is not linked to a provider identity | Whoever onboarded you |
| The authorization service is unavailable | The decision service could not be reached — this is an outage, not a permission problem | Operations |
⚠ "Not visible" and "no access" are different, and the difference is worth learning. Not visible means you are looking in the wrong workspace. No access means you are in the right workspace and need a grant to that patient. Treating the second as the first — switching facility repeatedly — will never work.
⚠ A refusal never says whether the record exists. That is deliberate: a message that distinguished "no such patient" from "you may not see this patient" would confirm the existence of a record to someone not entitled to know it.
4. Recording care
⚠ Clinical forms are opened from the patient's dashboard, not from a forms menu. That is what guarantees the record attaches to the right patient and the right visit — a form opened out of context has nowhere correct to file what it collects.
⚠ A clinical write needs an open visit and an encounter. A refusal here is usually a missing prerequisite rather than a permission problem: the patient may not be checked in, or the visit may have ended.
→ Guide: Clinical records
5. Orders and results
Orders — laboratory, imaging, medication — leave the visit for the module that fulfils them and return as results against that same visit.
⚠ Critical results are acknowledged, not merely displayed. Acknowledgement runs through the workflow engine, so an unacknowledged critical result stays on a queue rather than relying on a clinician happening to open the right screen at the right time.
Also used for: the engine behind that acknowledgement is the same one that runs patient check-in, leave approval and shift swaps. Only the subject differs.
6. Referrals
⚠ A referral is a kind of clinical order, not a separate mechanism. It carries the same lifecycle, which is why it appears alongside other orders rather than in a section of its own.
Where a referral shares a patient's record with someone outside the current care relationship, that sharing is consented to and time-boxed rather than open-ended — the receiving clinician gets access to the episode being referred, not to the patient's whole history for ever.
What stops this working
| What you see | What it actually is |
|---|---|
| A record refuses to open | Read the message — see the table above; each cause has a different fix |
| Switching facility never helps | You are hitting no patient access, not not visible — you need a grant, not a different workspace |
| A clinical form will not open | It is being reached outside a patient context — open it from the patient's dashboard |
| A write is refused although the record opened | Reading and writing are separate; or the visit is not open |
| Everything is refused at once, for everyone | The authorization service is unavailable — an outage, not permissions |
| Cannot be rostered to a unit | That unit requires a valid credential and yours is missing or expired |
| An expired credential, still on shift | The gate does not act retrospectively — release is deliberate |
| A result appears but nobody acknowledged it | Acknowledgement is a queue item, not a side effect of viewing |
Where to go next
- Arrival to discharge → Patient journey
- Onboarding and rota → Staff journey
- Tenants, facilities and modules → Platform administrator journey