Clinical Record Access Audits: A Quebec Therapist's Checklist

A clinical record is not protected by a password alone. It is protected by knowing which people, devices, applications, and vendors can access it today — and which ones could still access it yesterday.

Access tends to accumulate in private practice: a former assistant's account, a trial user, a calendar integration, a personal device, or a file link created in a hurry. An access audit turns that uncertainty into a short, repeatable, documented control.

This guide is written for psychologists, social workers, psychotherapists, counsellors, and other psychosocial professionals working in Quebec. It is practical information, not legal or professional advice.

Why audit access?

Quebec's Act respecting the protection of personal information in the private sector requires reasonable safeguards for personal information. The Commission d'accès à l'information du Québec provides guidance on privacy governance and security measures.

An audit answers four questions:

1. Who can view or change clinical records?
2. Why does each access still exist?
3. Does the permission match the person's or vendor's actual role?
4. What evidence do you keep that the review and corrections happened?

The goal is fewer unnecessary permissions, not a report nobody reads.

The 30-minute checklist

1. Inventory every access point

List the places where clinical information may flow:

• practice-management and client-record software;
• email and client portal;
• file storage and backups;
• synced calendars;
• telehealth platform;
• work computers, phones, and tablets;
• administrator, support, and integration accounts.

Do not limit the inventory to systems labelled “clinical.” A calendar can reveal a client's name, and a video platform can retain metadata.

2. Record users and permissions

For each system, note the account, role, last known activity, and permission level. Use plain categories: read-only, edit, export, administrator, or billing access.

If the system has no detailed audit log, keep a dated note or screenshot of the user list. A lack of logging is useful information when assessing a vendor.

3. Apply least privilege

Each person should have only the access needed for their task. A billing assistant does not automatically need clinical notes; a calendar integration does not need administrator rights; a demo account should never contain real client information.

Ask: If this account were compromised today, what could it expose? Reduce the scope when the answer exceeds the professional need.

4. Close obsolete access

Disable accounts belonging to former employees, students, consultants, and partners. Revoke sharing links, integration keys, and devices that are no longer used. Changing a password is not enough if an active session or application token remains valid.

After a change, test the revocation or ask the vendor to confirm it.

5. Review privileged accounts

Keep administrator accounts to a minimum. Each privileged account should be named, protected with multifactor authentication, and used only for administrative tasks. Avoid shared credentials: they make accountability difficult.

The Canadian Centre for Cyber Security recommends planning for incidents and strengthening controls before one occurs. Multifactor authentication, patching, backups, and privilege management matter even more when the practitioner is also the practice administrator.

What to put in the access register

A minimal table is enough:

Date	System	Account or role	Justified?	Correction	Verified by
2026-08-28	Client records	Owner admin	Yes	MFA checked	Team
2026-08-28	Calendar	Integration	Reduce	Read-only	Team

Do not copy clinical details into the register. It should demonstrate the control without becoming another sensitive record. Store it securely and restrict access.

When to run an exceptional review

Review access immediately after:

• a departure or role change;
• a new vendor or integration;
• a lost or stolen device;
• an unusual login or sharing mistake;
• a software migration;
• a suspected or confirmed privacy incident.

If an incident occurs, contain access first and preserve relevant evidence. Quebec's CAI guidance on confidentiality incidents explains the risk assessment and record-keeping duties that may apply.

Common mistakes

“The vendor is compliant, so I do not need to check.”

Vendor security does not replace your governance. You still need to assign roles, close accounts, and review the devices and integrations used in your practice.

“Everyone having the same access is simpler.”

That simplicity spreads risk across every record. Separate roles are usually easier to explain, review, and correct than universal access.

“The audit is done once I have looked at the list.”

An audit includes corrections and a verification date. Without dated evidence, it is hard to know what actually changed.

How FYL.care can help

FYL.care brings the administrative pieces of a practice into one workspace designed to reduce fragmentation: clients, appointments, documents, and follow-ups. Use this checklist as a starting point, then verify the controls and settings for your own configuration.

Ready to make practice management clearer? Explore FYL.care for free.

FAQ

How often should I audit access?

Quarterly is a sensible starting cadence, with an immediate review after role changes, new vendors, or incidents.

What if my software has no access log?

Ask the vendor what evidence is available, enable the controls they offer, and document manual reviews. Treat the limitation as part of your vendor assessment.

Should I delete every old account?

Disable accounts that no longer have a purpose. Do not destroy useful evidence before meeting your retention and professional obligations; document the deactivation instead.

Last updated: August 28, 2026. This content is informational and is not legal or clinical advice.