Data scope and isolation

Records are stamped with the part of the organization they came from, and users only see their own part.

Acceptance criteria

US-52a Data-Scoping Design + Org-Node Stamping HIGHEST NEW SCREEN

As the system, I want every record stamped with its originating org-node and a data-scoping model designed, so that row-level isolation can be enforced later without a data retrofit.

Design the row-level scoping model (deferred enforcement to US-52b).
Every record stamped with its originating org-node from now on.

US-52b Row-Level Enforcement + Facility Isolation HIGHEST NEW SCREEN

As a security/compliance owner, I want row-level data isolation enforced by org node, so that users can only see records belonging to their facility/subtree.

Users see only records within their org node/subtree (uses US-52a stamping).
A facility user cannot view another facility's patients/claims.
Verified by logging in as a facility-scoped user and confirming isolation.

OP-9 Facility scope for multi-facility users P1 OPERATIONAL REVIEW

As a central desk user, I need to see work from several facilities and switch between them, so one desk can serve a group.

Lists show a Facility column and a Facility filter for a user with more than one facility.
The top bar has a facility switcher. A record of a facility outside the scope is refused with a clear reason (US-52b).
A user with one facility sees none of this.

Wireframe state

DefaultMulti facility

Organization Structure Reporting groupsData scope

A user with a subtree. Faisal Al-Dosari works at a central desk. His A/R role is given once, at the Al Raneem Group node, so it covers Facilities A, B and C and nothing outside the group.

What a central desk user sees

Record	Facility	Owner	What the user sees
CL-20418Noura Al Harbi, Bupa Arabia	Facility A	RAReem Al-Otaibi	Opens normally
CL-30091Bupa Arabia	Facility B	SASami Al-Ghamdi	Opens, because Facility B is inside the subtree
CL-40228Tawuniya	Facility C	MAMaha Al-Mutairi	Opens, because Facility C is inside the subtree
CL-50117Another group	Outside the subtree	No owner	This record belongs to another facility

See a record outside the scope

The Facility column and the switcher

Lists get a Facility column and a Facility filter chip, because one user works in more than one facility.
The facility switcher in the top bar narrows every screen to one facility, or back to all of them.
A user with one facility sees neither, since there is nothing to choose.
A record outside the subtree is never listed. Opening it by link shows "This record belongs to another facility", and the attempt is logged.

Stamping is on, enforcement is on. Every record already carries the org node it started in. Enforcement can be switched on per rule once you have checked the result below.

Isolation rules

Show a user only the records inside their org node and below
Block patient and claim lookups across facilities
Let the Administrator read across all facilities
Allow reporting groups to read the facilities they contain

Test it before your users do

Check as user

What they search	Visible	Hidden
Claims	148	62Facility B and C
Patients	1,204	388Facility B and C
Authorizations	91	40Facility B and C

Isolation holds. Reem opens CL-30091 from Facility B by its link and sees "This record belongs to another facility". The attempt is logged.

See what Reem sees

What is stamped on a record

Record	Stamped with	Example
Claim	Org node where it was created	CL-20418Facility A / Claims
Prior authorization	Org node of the requesting user	PA-10977Facility A / Consultation clinics
Eligibility check	Org node of the requesting user	EL-30551Facility A / Front desk
Patient	Facility of first registration	Noura Al HarbiFacility A
Payment notice	Org node that recorded it	PN-7782Facility A / Accounts payable