A worked example following one external care worker from a time-boxed grant, through a scoped, minimum-necessary view, to automatic expiry and a governed extension — with every step landing in an immutable, intelligent audit.
Below: how the access is granted (A), what she can and can’t see (B), and how it auto-expires and is extended (C) — each illustrated with a representative commvita screen.
A third party never gets a standing key. Access is a chain of controls the controller assembles for the duration of the care episode — and no link is skipped.
The controller decides why — supporting the patient’s community rehabilitation (direct care) — and how little is needed: the rehab care plan, goals, exercise programme and visit log only, never the full record (Caldicott Principle 4 / Art.5(1)(c) data minimisation).
Harbourside Community Care self-serves capacity and profile through the Provider Portal; its DSPT / DTAC assurance and Art.28 DPA are held in Supplier IG Assurance, and — where the councils/trust jointly control the data — an Art.26 joint-controller agreement is managed in the DSPA Manager. No data flows before assurance is in place.
Rita is given a scope-only UserGroup / UserDelegation whose expires_at is set to the rehab episode — 6 weeks. A scope-only group grants org codes, never a role; her read-only role resolves only the scoped rehab fields. Because this is direct care under Art.9(2)(h), no Caldicott gate is required.
Role + scope let Rita reach the patient; opening the record on each daily visit needs a care reason. Every access is justified and logged, so the record shows exactly who looked, when and why.
The grant is a boundary, not a doorway. Scope caps the view to the rehab set; everything else is invisible; every view is written to the record.
effective_scope() resolves only the org codes and fields the grant permits. Rita sees the rehab care plan, goals, exercise programme and visit log — and can add a visit entry — but the wider record simply doesn’t resolve for her.
Out-of-scope sections aren’t hidden buttons she might press — they’re never returned by the API for her token. Data minimisation is enforced by design, not by UI.
Each open and each visit log is written with a care reason to the immutable access log, giving the patient and IG a complete, tamper-evident picture of who accessed what.
The important part: access ends by itself when the episode does — and if rehab continues, it’s extended by a governed re-attestation, never by a note-to-self.
effective_scope() filters the lapsed grant at authentication time — the moment the expires_at passes, the rehab scope stops resolving and Rita’s access drops automatically with no manual step. The lapse is written once (lapse_recorded) to the immutable hash chain.
If physio extends the rehab, the care coordinator (or Rita) requests an extension. The controller re-attests and sets a new expires_at via PATCH /rbac/user-groups/{id}. The grant and its new expiry are written to the tamper-evident LoginAuditEvent hash chain — access can’t quietly persist or silently re-elevate; it’s renewed only by an explicit, recorded decision.
Every grant, access, expiry and extension lands in a log that can’t be quietly rewritten and doesn’t just sit there — it watches for the things that matter.
Intelligent, not passive. The audit flags out-of-hours access and out-of-area / bulk / cross-ICS anomalies (/legitimate-access-log); the Security Console adds clinical-workflow-aware anomaly detection. And if the record is opened in another setting — hospital, out-of-hours or NHS 111 direct care — a Clinical Trigger Alert sends a safety-netting notification to the registered GP practice (/ig-spine), gated on encounter/ADT corroboration, minimum-necessary, deduplicated and rate-limited, with the acknowledgement itself audited.
prev_hash → row_hash re-checked on read · no breaks · append-only.
| Event | When | Actor | Flag |
|---|---|---|---|
| Grant created · scope-only · read-only | 01 Jul 2027 · 10:02 | K. Mensah | ok |
| Record accessed · rehab set | 05 Jul 2027 · 09:14 | R. Okafor | ok |
| Record accessed · rehab set | 08 Jul 2027 · 08:58 | R. Okafor | out-of-hours |
| ⚠ Opened in acute setting · GP practice notified (cross-setting) | 09 Jul 2027 · 21:37 | ED clinician | trigger alert |
| Extension requested · +4 weeks | 09 Aug 2027 · 14:20 | R. Okafor | pending |
Extension approved · new expires_at 09 Sep 2027 | 09 Aug 2027 · 16:05 | K. Mensah | re-attested |
| Step in the journey | Module | Route | Model / API | Standard |
|---|---|---|---|---|
| Onboard the external provider | Provider Portal | /provider-portal | capacity & profile self-service | CQC · provider assurance |
| Processor assurance & DPA | Supplier IG Assurance | /supplier-ig-assurance | DSPT / DTAC · DPA register | Art.28 · DSPT · DTAC |
| Joint-controller sharing | DSPA Manager | /dspa-manager | DSPA lifecycle · signatories | Art.26 · NHS DSPA template |
| Time-boxed scope (episode-length) | RBAC · Groups & Delegations | /rbac · /rbac/user-groups | effective_scope() · UserGroup · UserDelegation · expires_at | ODS · Caldicott P4 / Art.5(1)(c) |
| Extension & re-attestation | RBAC · Groups & Delegations | PATCH /rbac/user-groups/{id} | re-attest · lapse_recorded | least-privilege renewal |
| Per-visit legitimate relationship | Legitimate Relationship Log | /legitimate-access-log | access log · anomaly alerts · Art.15 SAR | DSPT · GDPR Art.30/15 |
| Delegated access & consent | Concierge · Consent Hub | /concierge · /consent-hub | delegated access records · FHIR Consent R4 | GDPR Art.7 · Art.15 |
| Community rehab context | Community Nursing Portal | /community-nursing | visit queue · interventions · caseload | NMC 2018 · NICE SC1 |
| Immutable audit (grant/access/expiry/extend) | Login Audit · IG Spine WORM | /login-audit | SHA-256 hash chain · GET /auth/login-audit | GDPR Art.5(1)(f) · DSPT |
| Intelligent audit (triggers & anomalies) | IG Spine · Security Console | /ig-spine | Clinical Trigger Alert (ADT-gated) · anomaly detection | Caldicott 8 · FHIR R4 AuditEvent |