Access Controls for Operators: Role-Based Access, Least Privilege and Quarterly Reviews

Access in a multi-system operation tends to grow by accident. A nurse covering a second community is given access there and keeps it. A regional analyst receives payroll access for one project and never loses it. Each grant made sense at the time; together they create exposure no one chose.

Role-based access control replaces those individual decisions with a small set of roles that describe real jobs. Least privilege keeps each role narrow. Quarterly reviews catch the drift that happens anyway. The goal is simple to state: anyone should be able to explain why a given person can see a given record.

This matters for privacy and security, and also for data quality. Every person who can edit a governed field is a potential source of change. Narrow, well-understood access makes the audit trail meaningful, because changes come from people whose role includes making them.

1. Step 1

   Define roles by job, not by person

   List the jobs that touch governed data — community nurse, director of nursing, business office manager, payroll, regional finance, executive. Describe what each role needs to read and what it needs to change.

2. Step 2

   Apply least privilege

   Grant each role the minimum access its work requires. Separate read from edit, and community-level from portfolio-level. Treat broad administrative rights as a separate, tightly held role.

3. Step 3

   Map roles consistently across systems

   Build a matrix with roles as rows and systems as columns, and record the permission each role holds in each system. The same role should not be broad in one platform and narrow in another without a recorded reason.

4. Step 4

   Route approvals to domain owners

   Requests for access to a domain's data go to that domain's owner or a named delegate. IT or security carries out the change and keeps the record.

5. Step 5

   Review quarterly and on every role change

   Each quarter, owners confirm that current access matches the matrix and record exceptions. Tie role changes and departures in HR to same-day access changes in every system.

• Access that never expires. Temporary access granted for coverage or a project stays in place indefinitely. Set end dates when granting it.
• Shared logins. Shared accounts at a nurses' station or business office make the audit trail meaningless. Every change should belong to one person.
• Reviews without action. A quarterly review that lists exceptions but removes nothing is a report, not a control. Record who removed what, and when.

Next guide: Data Quality and Reconciliation: Getting Systems to Agree on a Fixed Calendar

Or return to the full data governance playbook for senior housing & care.