A veterinary practice runs on access at odd hours. The out-of-hours call comes in, a locum or the duty vet needs the animal's history right now, and the fastest path is the shared login taped to the monitor or saved in everyone's browser. It works, which is exactly why it persists. It is also the single arrangement that undoes almost everything else you might do for security, because a login everyone uses is a login no one is accountable for.

The problem with a shared account is not only that it is easy to guess or overhear. It is that when something goes wrong - a record altered, data taken, a controlled-drugs entry disputed - there is no way to say who was signed in. Every action traces back to “the practice”, not a person. For clinical records that carry both animal-welfare and data-protection weight, that lack of a trail is a genuine liability, not just untidy housekeeping.

The fix is individual accounts for everyone who touches the system, locums included. Yes, setting up a locum for a single weekend feels like friction, but it is the friction that gives you a record of who saw what, and the ability to switch off access the moment they leave. Pair each account with a second sign-in step, because a vet's login reaches confidential records and, increasingly, the practice's payment and ordering systems too.

Out-of-hours is where good intentions slip, so build for it rather than against it. Make sure the duty vet can get in from home securely - through the practice's own remote access, not a personal export of records onto a laptop that then lives in a car. Records leaving the controlled system “just for the on-call shift” is how a lost bag becomes a reportable data breach. Keep the access remote and logged, and the data stays where it belongs.

None of this requires a big project. Start by listing who currently uses a shared login, give each of them their own, turn on the second step, and set a simple habit of disabling accounts when someone stops working with you. The payoff is a practice where, if a client or the ICO ever asks who accessed a record and when, you have a clear answer instead of a shrug.