Security
Security & Multi-Tenancy
Isolation, access control, authentication and audit — how HMS protects data.
Who can use: Hospital Admin
What it does
HMS isolates every hospital tenant at the data layer, enforces role and branch authorization on the server for each request, authenticates staff with OTP, prices and gates subscriptions server-side, and records platform and hospital audit trails.
Who can use it
Security is automatic for every tenant. Hospital Admins manage staff roles and branch assignments; audit logs let them review who changed what.
How to use it
Keep staff roles minimal, assign branches where staff work, review audit logs periodically, and use strong, private mobile numbers for OTP delivery.
- Tenant isolation — hospital data is never visible across tenants
- Role-based access — enforced server-side on every request
- Branch authorization — staff act only inside assigned branches
- OTP authentication — passwordless sign-in with expiring codes
- Server-side entitlements — plans and limits cannot be bypassed from the interface
- Audit logs — hospital and platform actions recorded with actor and time
Important rules
Never share OTP codes or staff credentials. Deactivated staff lose access immediately. This page intentionally omits implementation internals — contact support for security questionnaires.
Related documentation