A new direct support professional starts Monday. To do the job well, they need to know that Maya gets overwhelmed in loud rooms, that her seizure plan lives on the fridge, and that "all done" means she's finished, not upset. What they do not need is the family-therapy note from the divorce two years ago, or the paragraph her mother wrote at midnight about her own fear of what comes next. Both live in the same record. Only one belongs in front of the new hire.
That gap — between what helps someone do their job and what is simply nobody else's business — is the whole question of who sees what on a care team.
The all-or-nothing trap
Most tools force a bad choice. Share everything, and a person's entire medical and emotional history is suddenly visible to a dozen people who needed three facts. Lock it all down, and the new DSP shows up blind, the therapist never hears what happened at home, and care falls through the gaps that silence creates.
Families feel both edges of this. Over-share, and you've handed a near-stranger the most private details of your child's life. Under-share, and you're back to re-explaining everything yourself, forever, because the system couldn't be trusted to share just the right amount. Neither is coordination. One is exposure; the other is isolation with extra steps.
The way out isn't a dial between "open" and "closed." It's the recognition that a care team is not one audience. It's several, each standing at a different distance from the person at the center.
Role-based access, done like a human would
Think about how a thoughtful family already handles this in real life. They tell the babysitter what the babysitter needs. They tell the doctor what the doctor needs. They don't read the babysitter the medical file, and they don't ask the doctor to handle bedtime. Nobody calls this a permission model — it's just respect, applied person by person.
Good software should do exactly that, and no more:
- The DSP sees what they need to support the day — communication, sensory triggers, the crisis plan, today's goals. The working knowledge that makes a shift go well.
- The therapist sees their own domain — their goals, their progress notes, the clinical thread they're responsible for — without inheriting the rest of someone's life.
- The family holds the whole picture. They're the constant; the record is theirs. Everyone else sees a slice of what the family sees in full.
- A private reflection stays private. A parent's late-night note to themselves is not a team document, and it should never quietly become one.
The roles aren't a hierarchy of who's trusted more. They're a map of who's responsible for what. A speech therapist isn't less trusted than a parent — they simply aren't there to manage medications, so medications aren't their view.
The principle to design around
Strip it all the way down and one rule remains: everyone sees exactly what their role needs — no more, no less.
"No more" is the dignity half. A person's care record is their private life, not a shared drive. The fact that many hands help care for someone is never permission for all of them to read everything. The default for anything sensitive should be closed, and opened deliberately — not the reverse.
"No less" is the safety half. Withholding what someone genuinely needs to do their job isn't privacy; it's a gap, and gaps are where the seizure plan goes unread and the trigger gets tripped. Protecting someone's information can't come at the cost of protecting them.
Hold both at once and access stops being a wall you argue over. It becomes a quiet act of respect: each person handed precisely what their role requires to show up well, and trusted not to need the rest.
A care record is someone's private life. Sharing it is a decision, not a default.
The test for any single piece of information is short: does this person need this to do their part well? If yes, it's their view. If no, it stays with the people whose part it actually is — not because anyone is untrusted, but because that's what it means to treat a life with care.
How we think about it at Trellis
This is why visibility in Trellis is controlled per person and per role, not flipped on all at once. Care notes carry their own audience — team, clinical-only, family-only, or just the author. The new DSP sees the day; the therapist sees their domain; the family holds the whole; a private reflection stays private, full stop.
And it's built into the architecture, not bolted on after. Permission lives at the data layer, so a view someone shouldn't have is one the system structurally won't return — not a setting that can be left misconfigured. Privacy you can trust is privacy you don't have to police.