Acceptable use
A proposed practice-level supplement. The existing workforce confidentiality and acceptable-use agreement stays separate.
Authorized users and accounts
The practice must assign individual accounts only to authorized users and keep permissions consistent with actual clinical, administrative and supervision responsibilities. Shared credentials, access under another person's identity, and attempts to bypass role restrictions are prohibited.
Permitted use and professional responsibility
Use UP for lawful healthcare-practice operations within the user's professional scope and the practice's authority. UP does not replace clinical judgment, informed consent, billing review or required supervision. External supervisee access is limited to its authorized supervision relationship and does not grant practice responsibilities.
Protected information and consent
Use secure, authorized channels and minimum necessary information. Do not put patient records into the public website, routine support messages, personal calendar titles or an unauthorized third-party tool. Obtain the required permissions for reminders, recordings, telehealth, records release and third-party connections. Linking family or guardian records does not by itself grant access to every linked chart.
Prohibited activity
Do not introduce malware; probe, scrape or export records without authority; evade safety or financial controls; submit fabricated clinical signatures or payer evidence; harass users; or use patient information for unauthorized advertising, sale, or model training.
Incidents and device safeguards
Promptly report suspected unauthorized access, lost devices and account misuse through the published secure process. Follow the practice's device, session, MFA and offboarding policies. A risk acknowledgment does not waive the practice's or vendor's legal security obligations.
Restrictions and continuity
Security restrictions must be proportionate to the problem and preserve legally required access, export and records obligations. Final notice, cure, emergency restriction and appeal procedures must be defined in the signed service agreement. This draft is a commercial acceptable-use supplement and does not replace the existing workforce confidentiality agreement.