Write the access decision before opening the demo
List the people involved, the information each needs and the actions each may perform. Scheduling an appointment, paying an invoice, completing intake and receiving a record copy are separate decisions. Give each decision an approving role and a review trigger. Start with a fictional adult client called Jordan, a counselor, a scheduler and a billing colleague. Add a contact who helps Jordan with appointment logistics but has no other access in this exercise. Those are test assumptions, not a policy for every practice. Ask the vendor to show both an allowed action and a rejected action for each person.
Distinguish staff permissions from client rights
Staff access should reflect assigned duties and the practice’s reviewed policies. A scheduler may need a contact preference and appointment time without needing the contents of a counseling note. Separately, a client request for records needs its own process. HHS describes a broad HIPAA right of access to information in designated record sets, with exceptions. Do not treat a hidden portal tab as a decision about that right. Ask how the practice receives a request, verifies the requester, reviews its scope, supplies the appropriate records and records completion. A vendor should explain the workflow even when some steps happen outside the portal.
Identify which kind of note is being demonstrated
Use blank templates and ask the vendor to name the record category, who can open it and what an export contains. HHS distinguishes separately maintained psychotherapy notes from clinical case notes and other information in the designated record set. The word private on a screen does not establish that legal classification. Have the practice’s qualified reviewer determine the applicable category and access rules before configuration. In the demonstration, keep a routine progress-note example separate from any separately maintained note category, then inspect the client view, staff search, attachments and export for unintended visibility.
Map couples, family and representative relationships separately
Do not use one shared household login as the starting assumption. For a fictional couples scenario, identify each person, the service record and the intended recipient of each document or message. Test whether an individual’s separate appointment appears to the other person. For a representative or a minor, obtain a clinic-specific decision about authority and scope before choosing permissions. HHS explains that personal-representative authority depends on applicable law and that exceptions can apply, including for minors. Being a parent, payer, emergency contact or appointment helper is not a substitute for reviewing the specific relationship and disclosure.
Test invitations, recovery and message previews
Send a demonstration invitation only to a controlled test account in an agreed test environment. Inspect the recipient, expiry, sign-in steps and recovery process. Ask what happens when an email address changes or a device is shared. Look at email subjects, SMS previews, calendar invitations and downloaded filenames, not only the signed-in screen. A message that says a document is available can still reveal the clinic’s identity. Record the practice’s intended communication preferences and compare them with the actual output. The public Flor walkthrough is fictional; it does not invite real clients or provide a working patient account.
Change access while a session is already open
In the vendor’s test environment, sign in as the logistics contact, open the permitted appointment view and save a sample link. Remove the test permission using an authorized staff account. Try a fresh sign-in, refresh the open view and revisit the old link. Record which actions stop immediately and whether any require a session expiry or another step. Also remove a departing staff member and inspect scheduled notifications and integrations that could retain access. Revocation cannot retrieve a file already downloaded, so include downstream copies and the clinic’s response process in the discussion. Keep the retained clinical record separate from the sign-in account.
Keep evidence that another evaluator can follow
For every scenario, record the product version or demonstration date, test role, permitted scope, expected result and observed result. Capture only fictional information. Note the account that changed a permission, the effective time and any evidence the vendor can provide about access history. HHS guidance discusses authorization, access modification, unique user identification and audit controls; use it to frame questions about accountability. A shared administrator account can make the human actor harder to identify. Ask who reviews unusual activity and what evidence the clinic can obtain without relying on a vendor screenshot or an undocumented assurance.
Turn unresolved access questions into a rollout decision
Mark each scenario demonstrated, follow-up needed or unavailable. A feature on a roadmap belongs in the latter two categories until the required behavior is shown. Identify the owner and next action for every gap, such as clarifying a record category, testing revocation or confirming an export. Decide which gaps prevent your planned rollout before moving real records. For Flor, bring the completed worksheet to an early-access review and confirm the exact supported environment, agreement and acceptance scope. The useful outcome is a documented fit decision, not a generic claim that every portal or every US counseling practice has the same requirements.
Questions for a US practice
Separate self-pay invoicing, superbills and electronic claims in your requirements. A working invoice does not establish payer connectivity. Ask for USD pricing, define staff and recipient access, and test the exact state, discipline and payer workflows relevant to your practice.
Where HIPAA applies, review the actual cloud services, responsibilities and agreements involved. HHS cloud-computing guidance is a starting point for those questions. A software label is not evidence that a particular clinic configuration satisfies its obligations.
A role-access worksheet for the demonstration
These fictional scopes are starting assumptions for a vendor test, not legal rules or verified Flor capabilities. Replace them with your practice’s reviewed decisions. Test each person using a separate demonstration account and record both the permitted and rejected action.
| Test role | Permitted in this exercise | Expected to be blocked | Question to resolve |
|---|---|---|---|
| Adult client | Own appointment and assigned form | Another client’s appointment or file | How is a separate records request handled? |
| Appointment helper | Only the agreed logistics for the fictional client | Clinical note, invoice or another household member’s visit | Who reviewed and approved the scope? |
| Scheduler | Appointment status and intended contact preference | Note content outside the assigned duties | Can the task be completed without broad clinical access? |
| Billing colleague | Reviewed financial records needed for the task | Unrelated counseling content | Are financial and clinical permissions independent? |
| Counselor or assigned supervisor | The assigned record and reviewed clinical task | A client or record outside the assignment | How are temporary assignments ended? |
| Former staff member or revoked contact | No further protected access under the removed grant | Old link, open session or new sign-in | When does the change take effect and what evidence remains? |
Copy each scenario into your evaluation notes with the expected result, observed result, evidence, reviewer and next action. Use demonstrated, follow-up needed or unavailable consistently across vendors.
Connect this access review to counseling practice management software, the patient portal workflow and the broader US clinic software checklist. For the contract and service questions, use the privacy and security review.
Primary sources for the US review
HHS distinguishes information covered by the HIPAA right of access and its exceptions, including separately maintained psychotherapy notes. Its personal-representative guidance explains authority and scope, including exceptions for minors. The OCR guidance on controlling access to electronic health information supports the accountability questions above.
Sources reviewed November 11, 2026. Check the state, professional and other rules that apply to the practice; this worksheet does not decide a particular person’s legal access.
A few common questions
Does portal access determine a client’s right to receive records?
No. The portal interface and the practice’s records-request process are different. Review applicable access rights and exceptions, then confirm how the software supports the required process.
Should someone paying a bill automatically see counseling notes?
Do not configure that assumption. Review the person’s role and applicable authority, then test the specific financial and record permissions separately.
Does the worksheet prove HIPAA compliance?
No. It is a software evaluation aid. Assess the services, agreements, safeguards and rules applicable to the practice; demonstrated portal controls alone do not establish compliance.
Can I test these permissions with real client records in Flor’s public demo?
No. Use fictional examples. The public walkthrough is not a live patient portal; confirm any deeper permission testing in a guided early-access review.
Prepared for clinic owners in United States. Updated . These guides support product evaluation and do not replace professional or legal advice.