Nurse access changes

In a recent update we adjusted the access to Students ⇒ Nurse to make it a "Super User Only" access permission.

Why did we make this change?

After some discussion on the KAMAR forums and some internal discussion it was noted that there is widespread access to the Nurse area in KAMAR which has the potential to breach privacy laws and professional standards if mis-used. The access to the Staff tab in the Nurse area is already restricted to Super User access and it made sense to increase this purview to include the whole Nurse area.

Confidentiality and Privacy

The New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020 both outline the safe and confidential handling of personal data. The key point is that all data (and in this case specifically health information) is confidential and must be protected. The NZSN provide a template policy for schools to adapt to their own situation, you can find a copy of this here: NZSN Procedures and Guidelines Template

KAMAR has been developed to meet these needs for our users and, as is outlined in the above document, is an approved SMS for storing digital health records.

For counselling or sensitive wellbeing notes, we suggest creating a dedicated Confidential Notes category. This provides an extra encrypted layer of protection for that information, in addition to the regular KAMAR login security.

Access to Students ⇒ Nurse

This should only be given to your approved school nurse. That way the only staff with access to the area are your nurse and your super users. There is a separate sickbay page which you can give to other administrative staff for minor health/medical related entries. This has its own access which can be given without access to the Nurse page.

Shared Logins and 2 Factor Authentication (2FA)

We regularly see users who are sharing user accounts in KAMAR, we strongly suggest avoiding this. KAMAR contains large amounts of private data and we always suggest enabling 2FA (privacy should always take precedence over convenience), this can not be used in a shared login situation as only one user can receive the verification code. KAMAR also has extensive logging of changes and usage of all users in KAMAR so that any discrepancies or mistakes can be tracked back to the specific user, these are rendered somewhat worthless if more than one user can login using the same credentials. 

In particular we often see an "IT Support" account with a generic name and contact email, this also makes it difficult/impossible to audit changes made by specific users. There is no issue in providing every individual user with their own individual account and login and this is what we would suggest as best practice.

Super User and Privileged User Access

As time goes on we are seeing more and more schools that are taking the easy route to providing "full access" to users by adding them to the Privileged User or Super User access group. We would highly suggest taking the time to check over your user access settings and make sure that staff don't have more access than they should. We have a guide page discussing super and privileged user access and when they should be used. In short "The Super User access group should be given to as few people as possible - ideally, only one person, appointed by the school's Privacy Officer". We have seen some schools with up to as many as 20 Super Users; that's 20 people with access to almost every scrap of data in KAMAR. Your IT Support technician/company does NOT need Super User access and should not have it. In all cases you're better off giving a user less access and adding on those permissions they need than giving blanket access to everything and increasing your risk of a privacy breach.

If you have any questions around this or would like one of our support team to take a look at your access groups with you then please call our support line. Bear in mind that as well as access groups a user can have specific overrides added to give them further access, the View Access tab is invaluable in checking on who has access to specific areas.

Removing Nurse access from Privileged Users

In the next update (Jan 2026) we will remove the Nurse access from the Privileged User access group. Because Nurse access is now a Super User access group it prevents other full access users from changing the access of Privileged Users or using the "Login As" function as they have a Super User access permission against their account. Schools will need to assess their user access and manually give access to the Nurse area if this removes it from a user who should intentionally have access to this data. This would be a great opportunity to discuss these access settings with your school's nurse.