Caregiver Access Permissions in Adult Family Home Software

Caregiver permissions should let each staff member complete authorized work for the correct facility and residents while preventing unnecessary access to billing, administration, other homes, or sensitive historical records. A single “caregiver” role is rarely precise enough for every workflow.

This guide covers software access design, not a legal determination of workforce authority. It was reviewed on August 8, 2026. Providers should complete their own role, privacy, security, employment, and regulatory review with qualified guidance.

Start with job functions, not page names

Define what a person needs to do:

• View assigned residents
• Read current care-plan guidance
• Complete daily care tasks
• Record notes, vitals, and behaviors
• Administer or assist with medications when authorized
• Report incidents
• View appointments
• Send approved secure messages
• Upload defined documents
• Correct or amend records within policy

Then map those actions to data and conditions. “Can access medications page” is too broad if it also permits order changes, deletion, reports, pharmacy acceptance, and administration.

Use a permission matrix

For each resource, define separate permissions for:

• List or search
• View detail
• Create
• Edit unsigned draft
• Sign or finalize
• Amend signed record
• Approve
• Delete or restore
• Export or print
• Manage access

Add scope: own records, assigned residents, current facility, selected facilities, or platform-wide. Document which roles receive each permission and why.

The caregiver mobile app features guide covers the front-line experience. Permission design determines which of those features and records each person may use.

Give every person a unique account

Do not share a caregiver login. Unique accounts support attribution, revocation, authentication controls, and defensible audit history.

When HIPAA applies to a covered entity or business associate, HHS states that regulated entities must assign a unique user identifier to track each workforce member's system activity. HIPAA applicability depends on the organization and activity, but unique accounts remain sound security practice.

Never store a caregiver's password in a manager-visible profile or send it by email. Use a secure invitation, identity verification, password creation, and recovery process.

Scope access by facility and resident

A user working at one Adult Family Home should not receive another home's residents merely because both homes share an owner. Assign facility membership with effective dates and status.

Within a facility, resident assignment may further limit routine views. Emergency or coverage access can be broader under a defined process, but it should be time-bound and audited.

Server-side authorization must enforce facility and resident scope for:

• Search results
• Record reads and writes
• Attachments
• Messages and recipients
• Reports and exports
• Background synchronization
• Offline data

Hiding a link or table row in the browser is not access control.

Offline and cached data need the same boundary. Store only the minimum authorized resident information needed for the supported offline workflow, encrypt it, apply an expiry, and remove it when access ends. When the device reconnects, recheck current permissions before uploading or displaying queued records. A previously authorized cache must not become permanent access after a facility transfer or account deactivation.

Separate medication permissions carefully

Medication access needs granular actions:

• View active resident medication list
• View scheduled eMAR opportunities
• Record an authorized administration outcome
• Give PRN under the applicable process
• Amend a signed MAR entry
• Add or change a prescription
• Accept pharmacy medication orders
• Mark delivery received
• Request a refill
• View controlled-medication counts
• Export MAR or inventory reports

Assignment of a permission does not establish professional authorization, training, or delegation. The system should also verify the resident, facility, active role, and any applicable credential context at action time.

Limit corrections, deletion, and exports

Most caregivers may need to correct their unsigned draft and request an amendment to a signed record. Fewer users should approve amendments, restore deleted items, permanently delete, or export many residents.

Use additive corrections for signed care records. Preserve original value, correction, reason, user, and timestamp.

WAC 388-76-10315 requires resident records to be confidential and protected from loss, destruction, unauthorized use, and alteration. Broad export or deletion rights should never be a default convenience.

Provision access through an accountable workflow

An invitation or access request should capture:

• Person and verified contact
• Facility
• Employment or service relationship
• Requested role
• Resident scope if used
• Start and expected end dates
• Approver
• Required acknowledgements
• Credential or delegation dependencies
• Invitation status and expiration

Do not activate access merely because an email address exists in a caregiver record. Link the authenticated account to the verified staff identity and approval.

Change permissions when duties change

Role and facility changes should be effective-dated. Before applying them, show added and removed privileges. Require approval proportional to risk.

On transfer between facilities:

• Remove old access when it ends
• Add only approved destination access
• Clear cached residents and drafts
• Review open assignments and messages
• Preserve prior audit attribution
• Confirm reports cannot span unapproved homes

Do not copy all permissions from another caregiver without reviewing differences in role, qualification, and schedule.

Deactivate access promptly

Offboarding should disable sign-in and active sessions at the authorized effective time. Revoke refresh tokens, offline access, API keys, shared-device sessions, and pending invitations as applicable.

Reassign open tasks and notify designated managers. Preserve the caregiver's authored records and audit history; do not delete them with the account.

Track request, approver, effective time, execution result, exceptions, and post-deactivation verification.

Design emergency access explicitly

Emergency access should not mean a permanent administrator account shared in the home. Define who can invoke it, circumstances, duration, data scope, authentication, reason, and review.

Show a prominent emergency-access state. Log every record viewed or changed, automatically expire the elevation, and route activity for review.

HHS's Security Rule summary describes access control, audit controls, integrity, authentication, and transmission security for regulated entities. Apply requirements according to the home's actual status and risk analysis.

Keep the interface understandable

Managers need a tabbed access workspace rather than one crowded form. Useful views include:

• Active caregivers
• Pending invitations
• Facility assignments
• Permission exceptions
• Temporary or emergency access
• Expiring access
• Deactivated accounts
• Audit and access reviews

Show plain-language capabilities and risk summaries. Avoid ambiguous toggles such as “full access” without listing what that includes.

Caregivers should see disabled actions with a clear explanation only when that helps navigation. Sensitive modules can remain absent entirely.

Review access periodically

Create review cases by facility, role, and risk. The reviewer should confirm:

• Person still active
• Facility membership current
• Role matches duties
• Resident scope appropriate
• High-risk exceptions still needed
• Temporary access expired
• Dormant account status
• Shared or suspicious sign-in signals reviewed
• Open tasks reassigned where necessary

Record reviewer, date, decisions, changes, and next review. A review is not complete merely because the manager opened the list.

Produce access and activity reports

Useful reports include:

• Users by facility and role
• Permission matrix
• High-risk privileges
• Pending and expired invitations
• Recent grants, removals, and deactivations
• Emergency access events
• Cross-facility denials
• Export and deletion activity
• Dormant accounts
• Access reviews and exceptions

Filter by facility, user, role, action, status, approver, and date range. Format PDF output as an access-governance report, not a screenshot of the admin page.

The broader staff credential tracking guide can support qualification review, but credentials and software permissions remain separate records.

Test authorization at every layer

Use demonstration accounts to test:

1. Caregiver assigned to one facility only.
2. Caregiver assigned to selected residents.
3. Medication view without order-edit permission.
4. Administration without MAR-amend approval.
5. Draft edit versus signed-record amendment.
6. Report view without bulk export.
7. Facility transfer with cache clearing.
8. Deactivation during an active session.
9. Expired invitation and password recovery.
10. Temporary access expiration.
11. Emergency access and review.
12. Direct URL and API request to an unauthorized record.
13. Offline device after permissions are revoked.
14. Mobile UI with inaccessible actions removed.

Confirm authorization after every request, not only at login. A user whose access changes must not retain stale privileges in an open tab.

Frequently asked questions

Is one caregiver role enough?

Usually not. Separate actions such as viewing, signing, amending, approving, deleting, exporting, and managing access, then scope them by facility and resident.

Can staff share one login for a shift?

No. Unique accounts preserve attribution and allow individual authentication, revocation, and review.

Does permission to administer medication prove authorization?

No. Software permission is only one control. The home must also verify the person's applicable role, training, qualification, delegation, and resident context.

What happens to records when a caregiver leaves?

Disable access and sessions, reassign open work, and preserve authored records and audit attribution. Do not delete care history with the account.

Should managers receive every permission automatically?

Grant permissions based on job need. Management status does not require unrestricted medication, export, deletion, or multi-facility access.

Give the right person the right action in the right home

Strong caregiver access control combines unique accounts, granular actions, facility and resident scope, accountable provisioning, prompt deactivation, emergency procedures, and continuous audit review.

Explore AFH Manager to evaluate caregiver roles, facility assignments, medication permissions, invitations, deactivation, access reviews, audit history, and formatted reports. Test direct API and offline revocation scenarios before production use.