Someone says they can see observations relating to a child that they should not be able to see

[Lauren]

If someone can see an observation they shouldn't be able to see, there are a few things you can check to make sure that everything is set up correctly. If you're confident when it comes to using Tapestry, and it only seems to be affecting one user, you might be better off checking the things I'll describe to you in this tutorial first as they are the most likely causes behind it. However, if you're new to Tapestry or you think it's affecting a few users please get in touch with us as soon as you can - that way we can deactivate your entire account while we investigate. 

To get in touch with us, you can either use the 'Contact us' page in the drop down list from your name, or send an email to customer.service@eyfs.info. If you do send us an email though please make sure you message us from the email address you or another manager uses to sign into Tapestry - that way we will be able to help you a lot more quickly and efficiently because we will know we're speaking to the right person. 

 

 

When you do contact us please use the 'in brief' text box or subject line to make it clear this is an issue about security. We keep an eye out for those ones. So for example you could say 'Account Breach' or 'Wrong person seeing observations '.

Within the body of the text please try to give us as much detail you can about who is affected and in what way.

 

So, onto the things you can check.

The first thing is that the correct child has been linked to the observation. If several children have been linked to the observation remember that the relatives and key workers of all those children will be able to see it. 

You can do that by finding the observation on your 'Observations' page (1) and looking at the green boxes under the notes section in the preview. If there are quite a few children linked to it you may have to click on the button that says 'and x more' to see all the children's names (2). If the children are wrong then use the 'Edit' button (3) to change who is connected to the observation. As soon as an incorrect child has been removed from an observation their relatives will no longer be able to see it on their Tapestry account. 

 

 

If only the correct child is linked to the account then start by removing that observation from the journal. That way you can be sure that no one other than people set up as staff will be able to see it. You can do that by clicking on the cog along the line from the title (1) and choosing 'Remove from journal' (2). 

 

 

We'll start by looking at what to do if the person who can see an observation they shouldn't is a relative. If they are a staff member, click here to skip ahead.

If the someone who can see an observation they shouldn't be able to see is a relative on your account

At this point, you should check which child/children the relative is linked to. You can do that from the Control Panel (1) on the 'Manage Relatives' tab (2) by finding them in the list and looking below their name at the green boxes with names of children. In my example you can see that the relative, Analise Williams, is linked to Georgia Williams (3).

If that is incorrect, then you can edit who the relative is linked to by either clicking on the 'Edit' button next to their name (4) and scrolling down to the bottom of the page that takes you to, or from the 'Manage Relationships' button (5) at the top of the page.

 

 

If that is correct though, your next step should be to deactivate the relative. Because at this point it's still not totally clear what has happened, so the safest thing to do is to deactivate all the relatives. That way, in the unlikely event that an issue with Tapestry is causing relatives to be able to see data they shouldn't be able to, then they won't be able to log in. You will be able to reactivate them again later without much work. 

To do so, use the quick filters at the top to view all of the relatives that are 'Active' (1). Then, from the drop-down, change the number of relatives displayed on the page from 20 to 'All' (2). Now you're viewing all of the active relatives you'll be able to select all of them from the 'Select Items' drop-down, and again choose 'All' (3). 

From the pop-up in the bottom right corner, choose 'Make Inactive' (4), and then press 'Go' (5). 

 

At this point, if you haven't contacted us yet, please do. 

 

If the someone who can see an observation they shouldn't be able to see is a staff member on your account

In this case you first need to make sure that they are set to only see their 'key children' and that the correct children are in their key children group. 

To do that, you need to start off by going to the Control Panel (1) then 'User Permissions' (2). Here were want to check the permissions for staff members, so make sure you're on this tab (3). 

Go to the 'Children' section (4) and make sure that 'View children who are not key children' is set to 'Not Permitted' and that no one has been individually permitted. If you need to change anything there, just click on the 'Edit' button along the line from the title (5).

 

 

If that is set up correctly (it will have to be 'Not Permitted' if you want to limit who each staff member can see), go to the 'Manage Staff' page (1) and use the 'Manage Key Children' button (2) to make sure that each staff member is only linked to the children that they should be. 

 

If you need to change any of those key children groups you can do so by clicking on the 'Edit Relationships' button next to the staff member who the change needs to happen for. 
 

 

If after following those steps you think everything is set up correctly, and the staff member has been set to not see the observation in question for a safeguarding reason, you should deactivate them and any other staff members who are also restricted in case there is an issue with Tapestry. To do that just go back to the 'Manage Staff' page on the Control Panel (1), and once you've found the staff member click the cog along the line from their name (2) and choose 'Make Inactive' (3).
 

At this point, if you haven't contacted us yet, please do. 

We will respond to your message as soon as we see it, at which point we will take you through the next steps either over email or over the phone if possible. 

While you wait to hear back from us though, you can continue to investigate. 

To do that, you need to go to your 'History' in the Control Panel. 

 

 

You can use the 'Filter & Sort History' bar to search for the observation in question and see a full history of it. 

 

What you might see is that the wrong child was initially linked to it, which was why the relative/staff member could see that observation. If the incorrect child has now been removed, the relative/staff member shouldn't be able to see the observation anymore, but it's worth checking with the relative/staff member that that is the case.

If you have the related issue of a parent has seen an observation which hasn't been published yet, you'll be looking out for it being published, then removed from journal, either through a purposeful status change, or though a staff member who needs manager approval to publish observations editing it (that would cause it to be taken out of the journal).

If you do find the cause behind the problem and are able to make the changes necessary so that only the people who should see observations can see them, then you can reactivate any users that you have deactivated and re-add and observations to the journal that you have taken out whilst investigating. 

This tutorial will help you to reactivate staff and this one will help you to reactivate relatives. 

 

 

 

Back to Main Tutorials Page