CalMHSA Learn (LMS System)
Live Chat Support
EHR Bulletin
Check/Update Existing Issues

MENU

Client Access Rules

CalMHSA recommends that most users be able to see all clients in SmartCare. This minimizes the risk of creating duplicate clients in the system that later must be merged. This only allows the user to see the client in the client search; that the person they’re searching for exists in the system with a Client Id. Any treatment information is hidden via CDAG rules. Clients who are sequestered from all staff are not automatically included in search results.

There is a single exception for this, and that’s the Auditor/Read-Only user role. This user role is meant for people who only log into SmartCare to conduct audits, which means viewing the records of only a few selected clients. This user role therefore has no access to any clients by default. In order to view these clients, access to these specific clients must be granted. CalMHSA recommends that after the audit period has passed, that access to these clients is subsequently removed from this user.

What a user will see in the Client Search results is managed by the permission type “ClientAccess Rules”.

  • All Clients – grants access to all clients in SmartCare
  • Allow restricted client search – VIP sequestered clients will show in the search results but to view the client’s record, the user must request access
  • Clinician in Program Which Shares Clients – shows clients that are associated with a program that the staff user is associated with in Staff Details: Proc/Prog/Loc/Proxy/Supervisor: Programs
  • Primary Clinician – shows clients where the staff user is designated as the Primary Clinician. CalMHSA does NOT use the Primary Clinician designation due to 42 CFR Part 2 concerns.
  • Seen in Past 6 Months – shows clients that the staff user has had a service with in the past 6 months.
  • Staff in Provider Which Shares Clients – shows clients that are seen by an MCO Provider that the staff user is associated with in Staff Details: Care Management: Providers. CalMHSA is currently only piloting MCO functionality, so this feature is not currently being used.

Granting Access to a Client

When an auditor needs to view a client, the system administrator will need to grant them access to the specific client they will be reviewing.

  1. Click the Search icon.
  2. Type in Staff/Users in the search bar.
  3. Select Staff/Users (Administration) from the search results.
  1. This takes you to the Staff/Users list page. Use the filters to find the user you want to block access to. Click the link in the Staff Name column.
  1. This takes you to the Staff Details Screen. Click the Client Access Overrides tab.
  2. In the Allowed Clients section, click the Add To List button.
  1. This brings up the Client Search window. Search for the client. Select the client from the search results and click Select.
  1. This takes you back to the Staff Details page. You’ll see the client added to the Allowed Clients section. Add dates in the “Granted From” and “Granted To” fields, if access should only be granted for a short timeframe. This would be used in cases such as granting access to a client’s record to an auditor.
  2. Click Save. 
This staff member will now be able see this client in any client searches they do. You may have to refresh tables and/or have the staff member log out and log back in to have the change enacted. See How to Refresh Shared Tables for more information.

Sequestering Client Charts

The ClientAccess Rules permission type only addresses the default search results for users. There are additional methods of blocking a client’s chart from staff users. There are generally two reasons a client’s chart should be hidden from staff users:

  1. A client needs to be hidden from a single staff user.
  2. A client needs to be hidden from all staff users.

The first scenario is often because a client has a family member or friend who works in Behavioral Health. This is often referred to as client sequestering. The second scenario is often because the client in question is so well-known, such as a Behavioral Health employee or a local politician, that additional privacy steps are recommended. The client in this second scenario is often called a VIP client, and the process for blocking staff user access is often called VIP client sequestering.

To sequester a single client from a single staff user, see How to Block a Single User from Viewing a Client’s Chart. This can also be done by the client as part of the Coordinated Care Consent process (see step 9 of How to Complete a Coordinated Care Consent).

To sequester a single client from all staff users, see VIP Client Sequestering. This article also shows how to grant access to a VIP sequestered client, as some users will need to be able to see the VIP client’s chart in order to treat them.

Updated 11/5/24