Healthcare data security: roles, 2FA, encryption, audit log

Roles and permissions: who sees what in the CRM

95sales CRM has flexible roles and permissions, and permissions can be overridden for an individual person. The default roles:

Permissions are granular: "Finance, P&L, taxes," "Rates, debts, patient amounts," "Personal data and phone numbers," "Medical records and care," "Restricted psychiatric records," "Payroll," "Export the database," "Urgent alerts" and more. The location manager, nurse and doctor roles are for medical businesses. For example, a nurse sees a patient's care plan but not their debt. A sales rep sees that a lead was admitted but can't open the patient record.

Why server-side checks matter

In 95sales CRM, permissions are enforced by a server gateway, not just the interface. If a role has no finance permission, the server simply doesn't return that data. It can't be pulled out through browser developer tools, an export or search. The same goes for regions: a regional manager sees only the locations in their region. More on running a network: multiple locations and clinic groups.

Entering isn't seeing

Permission to enter a payment or an expense doesn't mean permission to see other people's amounts. An employee without finance access sees only the records they entered themselves. For roles without money, the server strips prices, amounts and money notifications, so medical staff don't see money at all. A page outside a role's menu doesn't open even from a direct link. These rules are checked by automated tests.

Sign-in and sessions: 2FA, auto-lock, watermark

How 95sales CRM protects sign-in and the workstation:

1. Two-factor authentication (2FA, TOTP). A code from an authenticator app. You can make it mandatory for specific roles. By default it's required for leadership, admissions managers, office and support.
2. Session list. See where and on which device the CRM is open. A lost phone or laptop can be cut off by ending its session. The owner can end all employees' sessions at once.
3. Auto-lock. The screen locks after 60 minutes of inactivity. A laptop left open at the front desk won't stay accessible.
4. Watermark. The employee's name, role and the time are shown over the screen. A photo of the screen can be traced back to a specific person.
5. Copy and print blocking. Lists and records can't simply be copied or printed. PDF exports carry a watermark too.
6. Password reset by email. "Forgot password?" sends a one-time link to the employee's email, valid for an hour. It doesn't bypass 2FA, and after the change the person is signed out on all devices and the owner is notified. The owner can turn this off.

Audit log and trash

The audit log records who did what and when: created, edited, deleted, exported, ended a session. Excel and PDF exports go into the log too, so you can see who downloaded what. Deleted leads, files and other records go to the trash, where they can be restored.

Acceptance of the Terms of Use, DPA and Privacy Policy is written to an immutable log. Employee activity tracking follows a versioned monitoring policy that every employee accepts.

AES-256 encryption of medical data

The most sensitive fields in 95sales CRM are encrypted with AES-256 before they're written to the database. Each client has its own data key, and the keys are stored separately from the database.

What gets encrypted:

• the patient's diagnosis and relative's contact details;
• the care log;
• the doctor's comment on a visit;
• call transcripts and their AI scores;
• conversations with the voice AI assistant on your website.

Even if a copy of the database ends up with an outsider, these fields stay unreadable without the key. And since every client has its own key, one company's data can't be decrypted with another's.

De-identification before AI

AI call analysis transcribes and scores calls against your script's criteria, and names, phone numbers and other personal data are masked before anything is sent to AI. The AI assistant sees only the data the employee's role allows and changes nothing without a click on "Confirm."

Separate database and support access

Separate database. Each client's data lives in its own database, not in a shared table with every other company. The database can be moved into the client's own account. Each company gets its own subdomain.

Support access only on request. 95sales staff don't sign in to a client's CRM by default. Access is opened at the client's request for a limited time, and names, phone numbers and amounts are masked on the server. Opening access is recorded in the log.

How to set up security at launch

1. Assign employees to roles and, if needed, override individual permissions.
2. Make 2FA mandatory for roles with access to money and personal data.
3. Check who has the "Export the database" permission. Keep it to 1–2 people.
4. Once a month, review the export log and active sessions.
5. If you want the database in your own account, arrange the move at launch.

For how to protect personal data across the whole clinic, with GDPR and Ukraine's personal data protection law in mind, see the medical data protection guide.