Who can see your clinic's patient data
· 6 min read
In conversations with clinic owners, the same moment almost always comes up. We show the calendar, the patient card, the finances, and the question is not "what can the system do" but "and who is going to see this?"
And that is the right question. A patient's diagnosis, phone number, payment history, a doctor's salary — these are the kinds of data whose leak can cost both the patient's trust and the clinic's reputation. And in many cases a leak does not start with a hacker attack, but with the fact that everyone in the clinic sees everything.
In this article we'll talk about the most practical side of patient data security: who should see what, and how to organise it without slowing work down.
The most common problem: "one password for the whole clinic"
Let's be honest. In many clinics the patient database lives in an Excel file on the reception computer or in a paper logbook. The computer password is known to the administrator, two doctors, the cleaner and the previous administrator who left six months ago.
This kind of setup is missing three things:
- Separation. A doctor who should see only their own patients sees everyone. The administrator sees the doctors' income.
- Individual login. If everyone logs in with the same account, it is impossible to know who changed what.
- Ability to remove access. An employee left, but the password stayed the same.
None of these is a complex technological problem. They are organisational decisions that simply nobody has made.
Who should see what: a practical split
A good rule is simple: everyone sees what they need for their work, and no more. In a clinic it usually looks like this.
Administrator / reception
Reception is the heart of the clinic. It needs the calendar, patient contacts, bookings and taking payments. But it doesn't necessarily need to see the monthly revenue summary, doctors' margins or payroll calculations.
Doctor
A doctor needs their own calendar, their patients' history, their services and schedule. If the doctor works in the clinic on a rental or contract basis, it is even more important that they don't see colleagues' entire patient base.
Owner
The owner sees the full picture: finances, reports, doctors' workload. And, most importantly, decides who else can see the money-related screens.
Patient
The patient should not "log in" to the clinic's system at all. If they are sent a link to leave a review or see their bonus points, that link should open only their own data and nothing more.
How this is organised in Plano
When building Plano, we started with exactly this split, because the very first clinics asked about it. Here is how it works.
Each clinic's data is separated at the database level. Many clinics work in Plano, but every record — patient, booking, payment — is tied to a specific clinic. The rule of who can read what is checked by the database itself, not only on screen. This means that even if someone tries to bypass the interface, another clinic's data will not be given to them.
Every employee has their own login. The administrator, the receptionist and the doctor log in with their personal accounts. An employee leaves — their access is removed from the team, and that's it.
A doctor sees only their own patients. In the doctor's personal portal, the patient list shows only those who have been booked with that doctor at least once. They manage their schedule, services and profile, but cannot change, for example, their link to the clinic or their active status.
Finances are seen by the owner and those the owner has allowed. In Plano the owner is marked separately in the team. When a clinic has an owner, the finance page, payroll and owner dashboard are seen only by owners and by those employees for whom the owner has ticked "Can see finances" in the settings. An administrator cannot remove or change the owner.
One important clarification: reception still sees the price of an individual booking and takes payments, because it cannot work without that. What is closed are the summary financial screens and reports, not every number.
Patient links are personal. Review and loyalty programme links that a patient receives by email or via a QR code contain a unique code. The review link is time-limited (30 days). Only reviews that the clinic itself has approved as public are published on the clinic's website.
And does the Plano team see your data?
We get asked this question, and we believe it deserves a straight answer.
The Plano support team has the technical ability to access a clinic's account. This is needed to launch the clinic, enable modules and help when problems arise. We don't think it is right to hide this or to say "we see nothing at all", since any cloud system has an administrator.
What you can do today — regardless of the system
Software can provide the right tools, but some things remain in the clinic's hands.
1. Don't share one account between several people. Every employee gets their own login.
2. Remove those who have left. On an employee's last day, remove them from the team that same day, not "later".
3. Review who sees the finances. Look over the list once a year.
4. Strong passwords. Plano shows password strength when one is created, but the final choice is the person's.
5. Don't send patient lists via messengers. If the data is in the system, leave it there.
Conclusion
Patient data security is not only about servers and encryption. The first and most effective step is much simpler: decide who sees what, and lock that decision into the system rather than leaving it as an informal agreement.
If you'd like to see how access is split in Plano for the administrator, doctor and owner, book a free demo, and we'll show you using your own clinic as an example.
Frequently asked questions
Can a doctor in Plano see other doctors' patients?
No. The doctor's personal portal shows only the patients who have been booked with that doctor. The clinic's full database is seen by administrators and reception.
Can one clinic see another clinic's data in Plano?
No. Every record is tied to a specific clinic, and access rules are checked at the database level. An employee of one clinic will not get another's data even when trying to bypass the interface.
Who decides who sees the clinic's finances?
The owner. When an owner is set for the clinic, the financial screens are seen only by owners and by the employees they have separately allowed.
What happens to an employee's account when they leave?
The administrator removes them from the clinic team, and they can no longer access the clinic's data. We recommend doing this on their last working day.
Can a link sent to a patient open someone else's data?
No. Review and loyalty links contain a unique code tied to a specific patient or visit, and the review link is valid for 30 days.