When a clinic runs from a single location, staff permissions are almost invisible. The owner knows everyone, the team shares one front desk, and most people can see most things because it is easier that way. Then a second branch opens, then a third, and that informal trust stops scaling.

A receptionist at one branch can suddenly browse patient files from another. A branch manager edits a price the group agreed to keep consistent. A doctor who splits the week between two locations ends up with two logins, or worse, borrows a colleague’s. Nobody planned any of it. It simply accumulated.

This article looks at clinic staff permissions for growing groups of two to five clinics: who should have access to which branch, how access should differ between admins, branch managers, doctors, nurses, receptionists and billing staff, and how to keep a reliable trail of who did what. The focus is operational. The goal is to protect patient data, prevent billing errors and make sure every action in your system has an owner.

Why permissions become a problem as you add branches

In a one-clinic setup, everyone works in the same physical space. Physical presence acts as an informal control: the receptionist cannot open a file for a patient who is not standing at the desk without someone noticing. Once you add branches, that control disappears. A user sitting in one location can open records belonging to another, and nobody in the second branch will ever see it happen.

Three risks worth designing for

Data leaks. Patient records contain some of the most sensitive information a business can hold. Most leaks inside clinics are not hacks. They are curiosity, convenience or carelessness: a staff member looking up a neighbour, a screenshot sent to a group chat, a login shared at a busy front desk. The more people who can open a record, the more chances for any of these to happen.

Billing errors. When too many people can edit invoices, apply discounts, change prices or cancel payments, errors multiply. Some are honest mistakes, such as a wrong service code or a discount applied twice. Others are harder to spot, like a refund processed without approval. Either way, the finance team spends days reconciling numbers that should have matched from the start.

Accountability gaps. When something goes wrong, the first question is always the same: who did this? If staff share logins or if permissions are so broad that anyone could have done it, there is no good answer. The result is blame spread across the team and no clear fix.

The core idea: good permission design is not about distrusting your team. It is about making sure that every person can do exactly what their job requires, nothing is hidden when you need to investigate, and a single mistake cannot spread across the whole group.

Four principles that keep the structure simple

1. Give access by role, not by person

Start by defining roles that match real jobs, then assign people to them. If you build permissions one person at a time, you end up with dozens of unique combinations that nobody can remember or review. A defined role makes onboarding faster and audits easier, because you can answer the question “what can a receptionist do?” in one sentence.

2. Apply least privilege

Each role should have the minimum access needed to do the job well. This does not mean making work harder. It means asking, for every permission, whether the person would be blocked from doing their job without it. If the answer is no, leave it off. Extra access can always be added later when a genuine need appears, but removing access after a problem is far more disruptive.

3. Separate branch scope from role scope

Two different questions decide what a user can do: what their role allows, and which branches they can reach. Keep these separate in your thinking. A branch manager and a receptionist in the same branch share the same location but have very different rights. A doctor who works at two branches shares a role with every other doctor but needs access to more than one location. Treating these as independent settings keeps the design clean.

4. Separate duties that should not sit together

The person who creates an invoice should not be the only person who can cancel it or approve a refund. The person who records stock should not be the only one who can adjust stock counts. Splitting these tasks across roles means that an error or a bad decision is much more likely to be caught by someone else.

Role by role: what each account should and should not do

Every clinic group is different, so treat the following as a starting point rather than a fixed rule. The logic behind each recommendation matters more than the exact list.

Admin or group owner

The admin account sits at the top of the structure and usually belongs to the owner, the operations director or a small number of trusted senior people. It typically needs visibility across all branches, the ability to create and edit roles, and control over system settings such as pricing structures, service lists and user management.

The most important point is to keep this group small. Every additional admin multiplies the risk, because admin accounts can change the rules for everyone else. Two or three named admins is usually enough for a group of up to five clinics. Admins should also use personal accounts for everything they do, never a shared “admin” login, because the audit trail is only useful when it points to one person.

Admins do not need to act as clinicians or process daily front-desk tasks. If an admin also practises as a doctor, consider giving them a separate role for clinical work, so that their daily activity is not mixed with high-level system changes.

Branch manager

The branch manager runs a single location and needs the tools to do it: staff schedules, daily operational reports, appointment oversight, inventory requests and visibility of the branch’s revenue and collections. In most groups, the manager should be scoped to their own branch only.

Where groups run into trouble is giving branch managers rights that belong at group level. Changing the price list, creating new roles or editing another branch’s data are decisions that affect the whole business. Reserve them for admins so that each branch stays consistent with the rest of the group.

Branch managers also often need to approve exceptions, such as a discount, a write-off or a refund. This is a good place to apply separation of duties: the manager can approve, but the person who requested the exception cannot approve it for themselves.

Doctors

Doctors need deep access to the clinical side: patient history, diagnoses, prescriptions, clinical notes, orders for lab work or imaging and treatment plans. They do not usually need access to the full financial picture. A doctor may need to see the price of a procedure to discuss it with a patient, but does not need to see group revenue, staff payroll or other doctors’ earnings.

Many doctors also work across branches. That is where a multi-branch access option becomes valuable. Rather than creating a separate account for each location, a single doctor account can be given access to specific branches. This has two benefits. The doctor sees a continuous record of their own patients, and the audit trail shows one identity rather than several scattered ones.

Nurses

Nurses usually need access to vital signs, clinical notes, triage information, medication administration records and the patient’s current visit. They often need slightly narrower access than doctors in areas such as diagnosis editing or prescription authoring, depending on local practice and the nature of the clinic.

A common mistake is giving nurses the same role as doctors because it is quicker to set up. The result is that nurses can do things they are not authorised to do, and the audit log no longer reflects who has clinical responsibility. A dedicated nurse role, with clinical read access and the specific write permissions they need, is a small effort that pays off whenever someone reviews a record.

Receptionists

The front desk handles appointments, patient registration, check-in, contact details and often payment collection. Receptionists generally do not need access to clinical notes, diagnoses or detailed medical history. Limiting that access protects patients and also reduces the risk of accidental disclosure at a busy front desk.

For cash handling, consider whether the receptionist can take payments but not cancel or edit them after the fact. Edits and cancellations are better routed through a manager or billing user.

Billing and finance staff

Billing teams need invoices, insurance claims, payments, outstanding balances and financial reports. They typically do not need full clinical records. A billing specialist needs to know what service was provided and which code applies; they do not usually need to read the doctor’s notes about the patient’s condition.

Billing is also where separation of duties matters most. Consider splitting tasks so that the person who prepares claims is not the same person who approves write-offs, and the person who records payments is not the only one who can reverse them. In a small group this can be as simple as requiring branch manager or admin approval for refunds and write-offs above a defined threshold.

For groups where billing is centralised, a billing user may need access across several branches while being blocked from clinical data at every one of them. This is a good example of why role scope and branch scope should be set independently.

A quick comparison of access levels

The table below summarises a typical starting structure. Adjust it to fit how your group operates.

Role	Branch scope	Clinical records	Billing and pricing	System settings
Admin	All branches	Full, if needed	Full, including price lists	Full, including roles and users
Branch manager	Own branch	Limited or read-only	Branch reports and approvals	None or limited
Doctor	Assigned branches	Full for own patients	View prices only	None
Nurse	Own branch	Vitals, notes, triage	None	None
Receptionist	Own branch	None or minimal	Take payments, no edits	None
Billing staff	Assigned branches	Service and diagnosis codes only	Invoices, claims, payments	None

Managing staff who work across branches

As groups grow, more people end up working in more than one location. Doctors rotate between branches, visiting specialists cover specific days, and billing or operations staff support the whole group from a central position. Handling this well is one of the biggest differences between a tidy structure and a messy one.

The temptation is to create duplicate accounts, one per branch, for each person who moves around. This feels simple at first but causes problems quickly. Records get split, reports show the same person as two different users, and the audit log can no longer give you a clear picture of one person’s activity. It also makes offboarding harder, because someone has to remember every account the person held.

A better approach is to use a single account that is explicitly granted access to more than one branch. In Balsam Medico, this is handled through a clinic chain user privilege, which allows one user to access multiple clinic branch accounts. The user keeps one identity, one set of credentials and one activity history, while the group still controls exactly which branches that user can reach.

A few rules for cross-branch access

• Grant it deliberately. Multi-branch access should be a conscious decision for each person, not a default.
• List the branches. A user who works in two branches does not need access to the other three.
• Review it regularly. Staff move. Access that made sense in January may not make sense in June.
• Treat visiting and locum doctors carefully. Give them the branch access they need for the days they work and review it when their engagement ends.

Using the audit log as a working tool

Permissions decide what people can do. An audit log tells you what they actually did. The two work together: permissions reduce the chance of problems, and the log makes sure that anything that slips through can be traced.

Balsam Medico includes an audit log that lets you check the actions of each user and their activity. Many clinics treat a log like an insurance policy that is only opened after something goes wrong. The groups that get the most from it use it routinely.

What to look at

• Edits and deletions on financial records. Look for cancelled invoices, edited payments and adjusted discounts. These are the places where billing errors and misuse are most likely to appear.
• Access to sensitive records. If a receptionist or a doctor from another branch has opened a record they had no reason to open, the log is where you will see it.
• Unusual timing. Activity outside working hours or on days when a person was not scheduled deserves a quick check.
• Changes to roles and permissions. Any change to what a role can do should be traceable to a named admin and a reason.

How often

For a group of two to five clinics, a short weekly review of financial edits and a monthly review of access patterns is usually enough. The aim is not to read everything. It is to spot the exceptions. If the team knows that activity is logged and reviewed, behaviour tends to improve without any further effort.

Onboarding, role changes and offboarding

The best permission structure falls apart if it is not maintained. Three moments in a staff member’s time with you matter most.

When someone joins

Assign a defined role, set the branches they need and give them a personal login. Avoid the shortcut of copying a colleague’s account. It is quick, but it carries over access that may not be appropriate. A short checklist for every new hire keeps the process consistent.

When someone changes role or branch

This is where permission drift happens. A receptionist who becomes a branch manager should have their old access reviewed, not just topped up. A doctor who stops working at one branch should lose access to it on the same day. Make access changes part of the move, not an afterthought.

When someone leaves

Deactivate the account on the last day, or earlier if the departure is unfriendly. Do not delete the user, because the history connected to that account is still needed for records and audits. Check that no shared passwords, personal devices or external integrations remain connected to their access.

A practical way to start

If your group has grown without a deliberate structure, you do not need to redesign everything in a day. List every user with their job and branches, settle on the six or so roles that match real jobs, decide who genuinely needs cross-branch access, give everyone a personal login, and use the audit log to see what people actually do. Then put a quarterly access review in the calendar. Because Balsam Medico lets you define each role and design its privileges, this structure can match how your clinics actually work rather than forcing your team into a fixed template.

Final thoughts

Clinic staff permissions are one of those topics that feel administrative until something goes wrong. Done well, they quietly protect patients, keep billing clean and make it easy to answer the question of who did what. Done poorly, they leave a growing group exposed in ways that are hard to see.

The principles are simple: give access by role, keep it to what the job needs, treat branch access as its own decision, separate duties where money or sensitive data is involved, and use the audit log as an everyday tool. For a group of two to five clinics, those habits are enough to grow without losing control of who can see and change what.

Connect with Us

Ready to embark on this exciting journey? Contact us today: 

📍 Dubai, United Arab Emirates – Tel: +971 56 640 9602 

📍 Khartoum, Sudan – Tel: +249 91 273 1048

Explore Balsam Medico and discover a world of efficient clinic management at www.balsammedico.com. Together, let’s reduce fines, elevate efficiency, and embrace a new era of dental healthc