Not every staff needs
to see everything.

MODULE-LEVEL

Which areas of CureCast a staff member can

enter.

ACTION-LEVEL

Whether they can edit, delete, download, or share.

LOCATION-SCOPED

Each clinic is a separate account with its own staff.

Not everyone on your team needs to see everything.

• A front-desk staff member may need access to patient records but not clinical photos. A staff member responsible for clinical photography may need access to clinical photos and albums but may not need permission to download or share those photos.
• Different people need different levels of access. CureCast lets administrators configure permissions individually so access can be reviewed and adjusted according to each staff member’s responsibilities.
• This gives practices a practical way to manage employee access to patient records and clinical photos without relying on an all-or-nothing access model.

• New staff permissions should be reviewed when the account is created. Administrators can adjust module access and sensitive action permissions based on the staff member’s actual responsibilities before the account is used for patient records or clinical-photo workflows.
• Individual staff logins are enforced for US, UK, EU and Australian accounts. Each team member signs in with their own credentials, permissions are set per person, and every view, download, share and export in the audit trail is attributed to the individual who performed it. This matters beyond convenience. HIPAA’s Security Rule requires unique user identification at 45 CFR 164.312(a)(2)(i), and unlike encryption that is a required implementation specification rather than an addressable one. A shared account cannot satisfy it, because the log cannot establish which of several people took an action.
• CureCast uses individual staff logins as the enforced access model. Each team member signs in with their own credentials, helping practices attribute recorded activity to the appropriate staff account. Individual staff accounts also make it easier to remove a specific person’s access when they leave, and to connect recorded activity in the audit trail back to the staff member who performed it.

Module permissions determine which areas of CureCast a staff member can access, such as:

Additional operational modules such as Confidential Patient, and Settings can be included where those permissions are exposed to the relevant customer account.

For example, a staff member may be allowed to access clinical photos or before-and-after content while not being allowed to download, share, edit, or delete those files.

This separation gives administrators more control than simply deciding whether someone can enter a module.

Each clinic location is configured as a separate account with its own staff and permissions. Staff assigned to one location cannot access the patients or clinical photos belonging to another location.

For multi-location practices, administrators can oversee multiple clinic accounts from a central login while keeping each location’s staff access scoped to the appropriate clinic.

Staff who work across locations must use the appropriate account for each clinic and log out before switching to another location’s account.

Marketing staff do not necessarily need access to the full clinical-photo library.

Administrators can restrict a marketing employee to approved content, such as the Albums module, while keeping the broader patient-photo library inaccessible. Practices remain responsible for ensuring that photos placed in marketing albums have the appropriate signed patient authorization for the intended use.

Temporary staff, contractors, photographers, consultants, and agency workers may need limited access to CureCast for a specific role.

A contractor or clinical photographer can be restricted to the specific modules and actions required for the assignment. For example, a photographer may be given access to Albums only, without access to Before/After, patient records, or other clinic modules.

Before giving a temporary staff member access, administrators should review the default module and action permissions and adjust them for the person’s specific responsibilities.

When access is no longer needed, the practice can deactivate the account to prevent further authenticated access.

Staff turnover happens. When it does, you need to revoke employee access to patient records so a former employee does not continue to have access to patient records or clinical photos.

When a staff account is deactivated, CureCast prevents further authenticated access on the user’s next request and ends active CureCast sessions associated with that staff account. This helps practices remove CureCast access across a former employee’s phone, tablet, computer, and browser sessions as part of offboarding.

Administrators can also review the devices associated with the staff member and manage active CureCast sessions from those devices.

Practices should also follow their own broader offboarding process for clinic devices, downloaded files, email, EHRs, cloud storage, and other systems that may contain patient information.

When a staff member leaves the practice, account deactivation is more than removing a staff profile.

Deactivating a staff account ends active CureCast sessions associated with that staff account. This helps a practice remove CureCast access across the former employee’s devices, including active phone, tablet, computer, and browser sessions.

CureCast account deactivation controls CureCast access. It does not remotely wipe the physical device, remove downloaded files, erase photos from a camera roll, revoke access to other clinic systems, or determine whether a privacy incident is reportable.

Revoke Access From a Lost or Stolen Device

If a staff phone, clinic iPad, laptop, or browser session is lost, stolen, or no longer trusted, an administrator can review the associated device record and end the active CureCast session from that device.

The practice can then use the audit trail to review recorded activity associated with the device, staff account or login, patient, event type, and date range.

Ending CureCast access is one important response step. Practices should also follow their own lost-device and incident-response process for other systems, email accounts, downloaded files, and physical-device controls.

CureCast does not remotely wipe the physical device, remove files from the device, locate the device, or automatically determine whether a breach occurred.

A change in job responsibilities can change what a staff member needs to access.

Practices can review and update module and action permissions when someone moves from front desk to clinical work, starts managing photo sessions, or takes on additional responsibilities.

Reviewing employee access to patient records at these moments, not just at hiring, helps keep staff permissions aligned with actual job duties.

Practices may also review access on a regular schedule based on their own policies and risk assessment, such as when someone is hired, changes roles, takes extended leave, or leaves the organization.

Controlling who can access patient information is part of a HIPAA-compliant workflow, not the whole of it.

CureCast’s module-level and action-level access controls let administrators determine which areas a staff member can access and whether they can perform sensitive actions such as editing, deleting, downloading, or sharing.

To review what happens after access is granted, CureCast’s audit trail records key activity, including logins, patient-record views, photo views, downloads, and shares.

Every entry identifies the staff account that performed the action. Individual logins are enforced for US, UK, EU and Australian accounts, so each entry is attributable to a named person.

Practices can filter recorded activity by staff or login, patient, event, device, IP address, and date range when investigating a particular patient photo or record.

Discuss how CureCast fits into your clinical photo workflow, from capturing and organizing patient photos to securely managing them across your practice.

Prefer email? [email protected]