Security
Field-level encryption, explained for clinicians
What it means when we say a mental-health note has its own key, without the cryptography jargon.
5 min read
Delegation fails on the switch, not on the trust. Where a system offers a single grant — the assistant is inside the record or outside it — a practice either shares more than it meant to or keeps the doctor doing reception between patients. Doctopass grants by task, one named action at a time, and writes every grant down.
The all-or-nothing trap
One switch forces a bad trade. Over-share, and the consultation note travels further than anyone decided it should. Under-delegate, and the most expensive hour in the building is spent booking, invoicing and answering the door. Both are expensive; only one shows up on a bank statement.
The unit that fixes this is the task, not the patient. "Can she see this file" has two answers and both are wrong. "Can she move an appointment" and "can she open a consultation note" are different questions with different answers, and a system that cannot hold them apart ends up set to whichever answer hurts least that week.
Before choosing anything, run your own arithmetic; we publish no time-saving figure, because every figure in circulation was measured in somebody else's waiting room. Take the minutes reception work costs you per patient, multiply by the patients in a day, then by the days you actually work in a year. That total is what delegation competes for. What else practice management software in Tunisia should carry is treated elsewhere.
Four toggles, not one switch
A permission here is one named action an assistant may take, granted by one doctor, switched on or off by itself and logged by itself. Four of them appear in the secretary settings screen, which shows one of the four denied and the other three allowed.
| Permission | What the toggle names | State shown in the settings screen |
|---|---|---|
| Manage calendar | The appointment calendar | Allowed |
| Create invoices | Invoices | Allowed |
| View clinical notes | The consultation note | Denied |
| Message patients | The patient conversation | Allowed |
Four are named here because four are in the interface. Each doctor grants their own assistants scoped permissions, and every change to a grant is itself recorded in the audit log — the settings panel says so in its own footer. Authorisation is then checked twice on every access to patient data: a role-based guard, and a per-record ownership and permission check in the service layer.
What this article will not describe is the screen: whether a denied note is hidden, greyed or refused at the boundary is not something we can show you here. The claim is narrower and firmer: the toggle exists, the settings screen shows it denied, and authorisation is enforced in two layers rather than in the interface alone. What sits behind it — the computerised patient record itself — is the other half of the subject.
What the front desk actually runs
The front desk runs on plan features, not on toggles. The appointment calendar, with drag-and-drop and conflict detection, is on all three plans. The walk-in queue is where an unbooked arrival goes instead of into somebody's memory. Patients connect five ways: email, SMS, link, Patient ID, or QR.
Appointment reminders by push and in-app are on all three plans. SMS reminder credits are an add-on on Essential, 200 a month on Pro and 500 on Premium; WhatsApp reminder credits follow the same pattern. Invoicing with manual payments — cash, cheque, transfer, card, insurance — is on all three plans, while auto-invoicing from the consultation starts at Pro.
CNAM belongs in this section because the first step is a front-desk step: the act is entered at check-in; after the consultation the invoice is generated showing the patient share, the CNAM share and the CNAM code; the bordereau is generated from that invoice; conveyance to the caisse stays with the practice. The rest of CNAM billing is treated where it belongs, on a page of its own.
Delegation you can review
Permissions answer who can. The audit trail answers who did. Every read and every write of patient data is logged, including access by another doctor, and the trail is available to the responsible doctor, searchable on Premium. The lines read in plain language, in the form "viewed this record on 12 May 2026, 14:32".
That trail is gated by plan, and the gate is worth printing:
| Capability | Essential | Pro | Premium |
|---|---|---|---|
| Full audit trail | No | Yes | Yes |
| Audit log search and investigation interface | No | No | Yes |
On Essential the trail is neither the full one nor the searchable one. We would rather write that limit down than let it be discovered after signature. The access model around it — including the field-level encryption that holds the most sensitive categories under separate keys — is set out under audit logging and access control.
The seat, and what we will not say
A seat is the licence unit. Essential carries one secretary seat, Pro three and Premium five, and the rate is quoted per doctor, per month, billed annually.
Two refusals, stated openly. We will not publish a total number of permissions: naming four that are visibly in the product is a stronger claim than a sum nobody can check. And we will not tell you what a medical secretary in Tunisia may lawfully see, what the role should be paid, or what training it presupposes — those belong to your professional obligations, to your caisse and to your Ordre.
One thing is regularly confused with delegation and is not. A doctor other than the one who created a record opens it only with the patient's explicit consent, granted per doctor and revocable, and every such access is recorded in the audit trail — a consent mechanism between doctors, not a grant from one doctor to one assistant. Not the same door, and neither one opens the other.
Worth remembering
Grant by task, from each doctor, and read the trail before you widen a grant. The four toggles the settings screen shows are the four we will name; we publish no total, and we will not tell you what your professional obligations allow an assistant to see. Doctopass records who did what; it does not decide who should.
Frequently asked
Can my secretary open a consultation note?
Only if you grant it. View clinical notes is one of the four toggles in the secretary settings screen, and that screen shows this one denied and the other three allowed. Authorisation is then checked in two layers on every access, so the answer does not depend on which screen the assistant is looking at.
How do I see what my assistant looked at?
Through the audit trail, which records every read and every write of patient data and is available to the responsible doctor. Read the plan gate before you rely on it: the full trail starts at Pro, and audit log search with the investigation interface is Premium.
Three of us share one front desk. Who grants what?
Each doctor grants their own assistants scoped permissions, individually, so one doctor allowing an assistant to create invoices says nothing about what a colleague has allowed. Records belonging to another doctor are a different mechanism: consent-gated, granted per doctor, revocable, and recorded in the audit trail.
How many assistants does each plan cover?
Essential one seat, Pro three, Premium five, at 69, 159 and 269 DT per doctor per month, billed annually. There are no setup fees and no per-note charges, data migration is free, and patients are free and unlimited on every plan. The seats sit beside everything else on the three plans side by side.
A permission you cannot review is not a permission, it is a hope. To see the four toggles on a real front desk and the trail they leave behind, request a 30-minute demo — bring the four things your front desk did yesterday and we will set the screen up against them.