Personnel Health Information Privacy Controls Within Shared Exposure Records (Feature Enhancement)

• What – Health & Wellness exposure records now enforce individual privacy controls, ensuring personnel sharing an exposure record can only view their own protected health information. Other personnel included in the same record will appear as redacted cards, maintaining record visibility while protecting sensitive health information.
• Why – This enhancement strengthens HIPAA compliance by preventing unauthorized access to other personnel's protected health information within shared exposure records. Updated permissions ensure users can only access information appropriate to their assigned level of access.
• How –
  • The existing Exposure permissions have been updated to support the enhanced privacy controls:
    • Exposure – Manage All: Previously the full-access Exposure permission, this permission retains Read, Update, Create, and Delete capabilities, allowing users to continue viewing and managing all personnel information within exposure records.
    • Exposures – Manage Own: This permission now includes Read, Update, and Create capabilities only. Delete access has been removed, and users can only view their own personnel-level information within shared exposure records.
  • When viewing a shared exposure record with Exposures – Manage Own permissions, other personnel's information will appear as redacted cards, hiding protected health details.
  • Users previously assigned full-access Exposure permissions will automatically transition to Exposure – Manage All without any changes to their existing access.
  • Users assigned Exposures – Manage Own will automatically receive the updated permission restrictions upon release. No manual action is required.
• Use Case – When multiple firefighters are included in a shared exposure record following an incident, personnel with Exposures – Manage Own permissions can review their own health information while other personnel's protected details remain redacted. Supervisors with Exposure – Manage All permissions can continue viewing and managing all personnel information without interruption. Administrators can also more easily distinguish between full-access and individual-access permissions when reviewing access controls, supporting stronger privacy protections and compliance auditing.