A worked example following one external care worker from a time-boxed grant, through a scoped, minimum-necessary view, to automatic expiry and a governed extension — with every step landing in an immutable, intelligent audit.
Below: how the access is granted (A), what she can and can’t see (B), and how it auto-expires and is extended (C) — each illustrated with a representative commvita screen.
A third party never gets a standing key. Access is a chain of controls the controller assembles for the duration of the care episode — and no link is skipped.
The controller decides why — supporting the patient’s community rehabilitation (direct care) — and how little is needed: the rehab care plan, goals, exercise programme and visit log only, never the full record (Caldicott Principle 4 / Art.5(1)(c) data minimisation).
Harbourside Community Care self-serves capacity and profile through the Provider Portal; its DSPT / DTAC assurance and Art.28 DPA are held in Supplier IG Assurance, and — where the councils/trust jointly control the data — an Art.26 joint-controller agreement is managed in the DSPA Manager. No data flows before assurance is in place.
Rita is given a scope-only / whose is set to the rehab episode — 6 weeks. A scope-only group grants org codes, never a role; her read-only role resolves only the scoped rehab fields. Because this is direct care under Art.9(2)(h), no Caldicott gate is required.
Role + scope let Rita reach the patient; opening the record on each daily visit needs a care reason. Every access is justified and logged, so the record shows exactly who looked, when and why.
The grant is a boundary, not a doorway. Scope caps the view to the rehab set; everything else is invisible; every view is written to the record.
resolves only the org codes and fields the grant permits. Rita sees the rehab care plan, goals, exercise programme and visit log — and can add a visit entry — but the wider record simply doesn’t resolve for her.
Out-of-scope sections aren’t hidden buttons she might press — they’re never returned by the API for her token. Data minimisation is enforced by design, not by UI.
Each open and each visit log is written with a care reason to the immutable access log, giving the patient and IG a complete, tamper-evident picture of who accessed what.
The important part: access ends by itself when the episode does — and if rehab continues, it’s extended by a governed re-attestation, never by a note-to-self.
filters the lapsed grant at authentication time — the moment the passes, the rehab scope stops resolving and Rita’s access drops automatically with no manual step. The lapse is written once to the immutable hash chain.
If physio extends the rehab, the care coordinator (or Rita) requests an extension. The controller re-attests and sets a new via PATCH /rbac/user-groups/{id}. The grant and its new expiry are written to the tamper-evident login audit hash chain — access can’t quietly persist or silently re-elevate; it’s renewed only by an explicit, recorded decision.
Every grant, access, expiry and extension lands in a log that can’t be quietly rewritten and doesn’t just sit there — it watches for the things that matter.
Intelligent, not passive. The audit flags out-of-hours access and out-of-area / bulk / cross-ICS anomalies (/legitimate-access-log); the Security Console adds clinical-workflow-aware anomaly detection. And if the record is opened in another setting — hospital, out-of-hours or NHS 111 direct care — a Clinical Trigger Alert sends a safety-netting notification to the registered GP practice (/ig-spine), gated on encounter/ADT corroboration, minimum-necessary, deduplicated and rate-limited, with the acknowledgement itself audited.
| Event | When | Actor | Flag |
|---|---|---|---|
| Grant created · scope-only · read-only | 01 Jul 2027 · 10:02 | K. Mensah | ok |
| Record accessed · rehab set | 05 Jul 2027 · 09:14 | R. Okafor | ok |
| Record accessed · rehab set | 08 Jul 2027 · 08:58 | R. Okafor | out-of-hours |
| ⚠ Opened in acute setting · GP practice notified (cross-setting) | 09 Jul 2027 · 21:37 | ED clinician | trigger alert |
| Extension requested · +4 weeks | 09 Aug 2027 · 14:20 | R. Okafor | pending |
| Extension approved · new 09 Sep 2027 | 09 Aug 2027 · 16:05 | K. Mensah | re-attested |
| Step in the journey | Module | Route | Model / API | Standard |
|---|---|---|---|---|
| Onboard the external provider | Provider Portal | /provider-portal | capacity & profile self-service | CQC · provider assurance |
| Processor assurance & DPA | Supplier IG Assurance | /supplier-ig-assurance | DSPT / DTAC · DPA register | Art.28 · DSPT · DTAC |
| Joint-controller sharing | DSPA Manager | /dspa-manager | DSPA lifecycle · signatories | Art.26 · NHS DSPA template |
| Time-boxed scope (episode-length) | RBAC · Groups & Delegations | /rbac · /rbac/user-groups | groups and delegations | ODS · Caldicott P4 / Art.5(1)(c) |
| Extension & re-attestation | RBAC · Groups & Delegations | PATCH /rbac/user-groups/{id} | re-attest | least-privilege renewal |
| Per-visit legitimate relationship | Legitimate Relationship Log | /legitimate-access-log | access log · anomaly alerts · Art.15 SAR | DSPT · GDPR Art.30/15 |
| Delegated access & consent | Concierge · Consent Hub | /concierge · /consent-hub | delegated access records · FHIR Consent R4 | GDPR Art.7 · Art.15 |
| Community rehab context | Community Nursing Portal | /community-nursing | visit queue · interventions · caseload | NMC 2018 · NICE SC1 |
| Immutable audit (grant/access/expiry/extend) | Login Audit · IG Spine WORM | /login-audit | hash chain · GET /auth/login-audit | GDPR Art.5(1)(f) · DSPT |
| Intelligent audit (triggers & anomalies) | IG Spine · Security Console | /ig-spine | Clinical Trigger Alert (ADT-gated) · anomaly detection | Caldicott 8 · FHIR R4 AuditEvent |