Hospital Staff Roles in Nigeria EMR: What RBAC Should Actually Gate

The Monday complaint is rarely “we needed more modules.” It is a cashier who opened ICU notes, a locum still on the consultant login, or a receptionist who can invite staff. Hospital staff roles in an EMR are the named accounts that stop that. Role-based access (RBAC) is who may prescribe, who may take cash, who may invite the next nurse, and who is locked out of Team and Roles.

This guide is for medical directors, clinic administrators, and superintendents buying EMR or HMS in Nigeria. Pair it with who opened the chart, locum doctor access, and cashier queue software. Score roles on a live login, not a logo that says “granular RBAC.”

What are hospital staff roles in a Nigerian EMR?

In procurement language, a staff role is this person, this clinic, this job, persisted on a staff row. It is not “Nurse” written on a shared tablet.

At minimum you should be able to:

Invite a named person by email with a real role (doctor, nurse, cashier, pharmacist), not owner.
Let them log in as themselves. SOAP notes, MAR doses, and invoice posts carry that account.
Give the minimum role. An OPD doctor consults and prescribes. They should not manage staff or change tariffs.
Deactivate the row when they leave, without deleting what they already wrote.
Keep Clinic A’s patients out of Clinic B. Tenant isolation is not a courtesy filter.

Buyers mash four different products into “RBAC”:

Named clinic roles with capability gates. Invite, accept, work, deactivate. This is the DawaHQ public claim.
Module switches. Pharmacy or theatre can be off for the whole clinic even if the role would otherwise use it.
Assignment-only “need-to-know” ACL. Only Consultant B’s patients. DawaHQ does not ship that. Clinical roles that may use a module still see the clinic-wide board.
Platform admin roles (super admin, regional manager). Those are DawaHQ operations seats, not how Hospital A grants a ward nurse.

If a vendor says “we have RBAC,” ask which of those four they just opened. Then make them log in as cashier and as doctor on the same patient.

DawaHQ treats this on hospital / general practice as Team and Roles: email invite, assignable role, deactivate. There is no separate “RBAC module” SKU. Do not buy a security add-on that cannot show the same SOAP, invoice, and patient-access audit trail as the rest of the HMS.

Why do shared ward logins fail hospital RBAC?

Administrators already know the pattern. Vendors still demo the owner account.

Shared passwords destroy attribution. When a prescription or a cash waiver is queried, you cannot say which human acted. MDCN clinical responsibility stays with the person who treated the patient. Software cannot certify that a shared “Nurse” login was justified.

Named accounts are this email, this role, this clinic. DawaHQ invites go out by email. The invitation link expires in seven days if unused. Acceptance creates the staff member’s own login. Owner invites and deactivates from Team and Roles (clinic admin has the same API capability; confirm that login if your administrator is not the owner). Deactivation sets the row inactive. Dashboard access ends. Notes they already signed stay on the chart.

Owner is not an assignable staff role. The clinic owner is the account holder. Invite and role-change APIs reject owner and platform super_admin. Do not invite a weekend dentist as owner “so they can see everything.”

Same-clinic multi-role is not a hospital switcher. One person can hold more than one staff row in the same clinic (for example owner and doctor). DawaHQ shows a header role switcher for that case. It is not a picker that flips you into another hospital. Two independent hospitals are two memberships. See locum access and multi-location HMS.

Staff seats count against the plan cap. Unique accounts plus idle session timeout beat a laminated password on the nurses’ station. Book a demo if weekend density must sit in the quote.

Which staff roles should HMS software actually ship?

Ask for the roles your floor already uses. Admin / Doctor / Staff only will force cashiers onto clinical logins. DawaHQ’s clinic roster:

| Role | What to expect in a demo | |------|--------------------------| | Owner | Settings, staff invite, modules, subscription. Not an invite-able role. | | Clinic admin | Staff, settings, operations. Do not use this as a locum seat. | | Doctor | Consult, prescribe, queue, lab request, clinical reports. No staff invite. | | Nurse | Triage, nursing documentation, MAR administer, ward chart. No discharge, no prescribe. | | Receptionist | Registration, check-in, queue. Not the cash drawer’s ₦ amounts. | | Dentist / optometrist | Specialty consult and prescribe when those modules are on. | | Physiotherapist / mental health practitioner | Specialty consult on those modules. Not a general-practice prescribe seat. | | Pharmacist | Pharmacy inventory and dispense. Not ICU notes. | | Lab technician | Lab processing and results. Not the cashier queue. | | Radiographer | Radiology capture/report workflow. Product role is radiographer, not a separate “radiologist admin.” | | Billing officer | Invoices, reports, HMO claim workflows. Not NHIA national portal. | | Cashier | Payments and the cashier queue. Not Team and Roles. |

Central store is gated to owner, clinic admin, and store manager. Confirm that path if you run a non-pharmacy store. Specialty modules still have to be on. A dentist role will not grow FDI charts if Dental is off.

Do not buy “midwife,” “locum_doctor,” or “specialist” unless they are on the invite picker. DawaHQ maternity work is doctor/nurse (plus owner/admin). Locums are ordinary doctor (or dentist/optometrist) rows you deactivate when the block ends.

How should a cashier, nurse, and doctor differ on the same patient?

This is the demo that kills brochure RBAC.

Doctor. Opens the chart, writes SOAP, prescribes, requests labs. Sees the clinic-wide queue for modules they may use. Does not invite staff, does not take the discount PIN as their job, does not dispense from pharmacy stock.

Nurse. Records vitals and nursing notes, administers MAR doses, writes the nurse chart. Does not author the discharge summary. Does not become a second prescriber because “everyone uses the doctor PC at night.”

Cashier. Posts payment, works the billing queue, may see IPD money fields. A 403 (or a missing clinical nav item) on ICU notes is a pass. An empty chart that still loaded is a fail.

Receptionist. Checks patients in. They should not see outstanding naira the way billing and cashier do.

Pharmacist vs store. Pharmacy dispense and allergy gates at the window are not the same as central-store requisitions. Controlled-drug register with NAFDAC-number tracking is a pharmacy record, not blanket “NAFDAC compliant.” See pharmacy software.

HMO desk. Billing officer runs panel pre-auth and claim batches inside the clinic. That is not an NHIA e-submit portal, and it is not a doctor role.

Capabilities are the useful language: prescribe, consult, triage, nursing document, bill, approve discount, manage staff, check in, dispense, request lab, process lab. DawaHQ uses those gates on APIs plus the sidebar. Role gates are the first 403; RLS is the safety net so tenants stay apart.

What clinical roles do see, inside this clinic: the clinic-wide patient list and boards for enabled modules. Coverage and emergency takeover are the design. There is no break-glass product because clinic-wide clinical read is the default for those roles. If your policy is “only my assigned ward,” say so in the demo script and score honestly.

Does RBAC make you NDPA or NDPC compliant?

No.

NDPA is about how your hospital processes patient data as a controller. Prefer NDPA-oriented consent logging and a patient-access audit trail that stores the role at the time of the open. DawaHQ is built to align with the Nigeria Data Protection Act 2023 on those controls. We do not sell “NDPA certified,” “fully NDPA compliant,” or “HIPAA RBAC.” Organisational filing, a DPO where required, and a rule against curiosity browsing remain yours. See patient consent and NDPC registration.

NDHI / FHIR / “national EMR.” Private HMS roles are not a national exchange. Do not accept those phrases as a substitute for named logins.

Discount and write-off. Owner or clinic admin sets a PIN; applying a waiver needs that PIN and a usage log. That is money control, not a privacy badge. Do not treat it as the whole RBAC story.

Regional manager is platform oversight, not Friday OPD cover. MDCN, PCN, and nursing council duties stay with licensed humans. Software stores membership and the trail.

What should we test in a staff-roles demo?

Bring the administrator who invites people, plus a cashier and a matron.

Open Team and Roles. Show the invite list. Confirm owner is not a checkbox.
Invite a test doctor and a test cashier (second browser or incognito). Confirm the doctor cannot open Team and Roles.
As doctor: write a SOAP and a prescription. Confirm the author is that login.
As nurse: administer a MAR dose if IPD is in scope. Confirm they cannot discharge.
As cashier: take a payment. Confirm they cannot open ICU or theatre notes (403 or hidden nav, not an empty clinical page).
As receptionist: check a patient in. Confirm they do not see billing-officer naira the same way.
Deactivate the test doctor. Confirm dashboard access ends and the SOAP remains.
If someone is owner and doctor, show the header role switcher. Ask for a clinic switcher. If there is none, write that down.
Open a named patient. Show a patient-access row with user and role. Then show Reports audit as a different log (staff activity).
Ask how an already registered email joins a second hospital. Score “sign up again” as a process gap, not SSO.

Offline support for key workflows is a separate demo (offline hospital software). Optional AI note drafts are not a role. The Medical Director still owns who may treat patients this week. Software stores the seat. It does not replace credentialing or a handover that names unstable patients (night-duty handover).

What to do next

List this week’s live logins: owner, doctors, nurses, cashier, reception. If two desks share a password, or a departed locum still opens charts, the EMR is not the access product yet.

Then book a demo or request access. Walk one invite, one cashier 403, one deactivate, and one patient-access row on the same morning. Explore HMS for Nigeria, EMR for Nigeria, and the hospital solution. Pricing is sales-led from ₦25,000/month, then a scoped quote. If the product cannot name the person on the note and keep the cashier out of the ICU chart, it will not help when the question is asked in writing.