Role-based access and confidentiality in case management: a permission matrix you can adapt
Confidentiality in case management comes down to one document written before anyone configures a screen: a matrix of who can see, edit, export and approve each kind of record. Start from least access, restrict at the level of note types and fields rather than whole modules, and log every view and export. This post gives you a filled-in matrix to adapt. For how access fits into choosing software overall, see our case management software for nonprofits guide.
Why module-level access isn’t enough
Most tools can hide a whole module from a role. That isn’t the problem. The problem is that a single case record mixes things with very different sensitivity: a service-delivered note (“food parcel given, 3 March”) sits next to a narrative note describing abuse. If access is all-or-nothing on “case notes”, either the volunteer who logs food parcels reads the abuse narrative, or they can’t log anything.
So the first design rule is to categorise notes. “Service delivered”, “general update” and “sensitive narrative” become separate note types, and access is set per type.
The permission matrix
This is EdZola’s default “least access” starting point. Cells read: None, View own (own caseload), View team, Edit own, Edit team, Approve.
| Role | Identity & contact | Safe contact | Assessment | Sensitive narrative notes | Service log | Referrals | Documents | Exports | Closure |
|---|---|---|---|---|---|---|---|---|---|
| Caseworker | Edit own | Edit own | Edit own | Edit own | Edit own | Edit own | Edit own | None | None |
| Supervisor | Edit team | View team | Edit team | View team | Edit team | Edit team | View team | View team (logged) | Approve |
| Programme manager | View team | None | View team | None | View team | View team | None | View team (logged) | None |
| Partner agency user | Referral fields only | None | None | None | Edit own (referral) | Edit own (received only) | None | None | None |
| Volunteer | View own | None | None | None | Edit own | None | None | None | None |
| MEL analyst | None (de-identified only) | None | De-identified | None | De-identified | De-identified | None | De-identified (logged) | None |
| Admin | System setup only | None | None | None | None | None | None | Approve export requests | None |
Two cells surprise people. The admin sees almost nothing: running the system isn’t a reason to read case files. And the programme manager doesn’t see narrative notes, because managing a programme doesn’t require reading what happened to a specific person.
Write your version, then test it with real roles logged in. Don’t trust the configuration screen; open the system as a volunteer and try to find a narrative note.
Safe contact for survivors
In domestic violence and GBV work, the contact field itself can be dangerous. A text message to a phone an abuser checks can put someone at risk. Add three fields to the person record: a safe number, safe times to call, and a code word. Add a “do not contact by SMS” flag that blocks automated messages. And restrict search so staff cannot browse survivors by name; they find a record from their own caseload or by case ID.
Audit trail, exports and retention
- Audit trail. Log who viewed, edited and exported each record, not just who changed it. Views matter most for narrative notes.
- Exports. Exports are where data leaves your control. Limit who can download, log every export, and route bulk exports through an approval.
- Retention. Closed cases move to a restricted archive with a stated retention period per record type. Keeping everything forever isn’t safe; it’s a growing liability.
Regional rules that change the matrix
- United States. Check whether HIPAA applies (health-related services, or a covered-entity partner) and ask vendors for SOC 2 reports and a signed business associate agreement where needed. Victim service providers funded under VAWA are generally barred from putting client-identifying information into a community HMIS, which affects any shared-database role.
- United Kingdom. Health, ethnicity, religion and sexual life are special category data under UK GDPR and need an Article 9 condition as well as a lawful basis. Large-scale processing of them typically needs a data protection impact assessment. The ICO’s special category data guidance is the place to start.
- India. The DPDP Rules, 2025 bring notice, security safeguards, breach reporting and retention duties into force around 13 May 2027, and any breach must be followed by a detailed report to the Data Protection Board within 72 hours (summary). The access log in your matrix is what lets you answer “whose data was exposed?” inside that window. Our DPDP breach response plan template for NGOs shows the 72-hour sequence.
Where this connects
If your case work involves children, the matrix needs guardian consent and child assent fields; our child protection case management deep dive walks through those. If caseworkers use phones in the field, remember that offline devices hold data too: a lost phone with unsynced case notes is a breach risk, so ask for remote wipe. Our guide to offline sync conflicts covers the sync side.
Find your gaps first
EdZola’s free nonprofit technology assessment includes a security and data protection area. It takes about ten minutes, gives you a score per area and the two areas to fix first, and your answers stay in your browser.