Question 1

What licences does FastLogin verify for clinicians?

Accepted Answer

MDCN for medical and dental practitioners, NMCN for nurses and midwives, and the relevant licence body for pharmacists, optometrists, and physiotherapists as the role catalogue extends. Verification is two-step: the licence number is OCR'd from the document you upload by Didit, and the document itself is checked for tampering. We do not issue you a clinical role until both sides return a clean signal.

Question 2

How long does the KYC step take?

Accepted Answer

About ninety seconds end-to-end on a typical mobile connection in Lagos. Document upload runs to Didit; liveness is a single passive frame, not a video; OCR and licence cross-check return within thirty seconds for most documents. If the document scan returns ambiguous you get up to three retries before a terminal decline routes to manual review by Fastclinic compliance. Manual review aims for a one-business-day turnaround; we email you the result and the audit chain records every step from submission to decision. If you're declined, the decline reason is plain-language — wrong document type, expired licence, image illegible — and the next steps are concrete, not a generic try-again message.

Question 3

Why do I need both a passkey and a TOTP secret?

Accepted Answer

The passkey is what you use every day — fastest, phishing-resistant. The TOTP secret is the portable backup. Passkeys live in a single device's secure enclave; if that device dies, you'd be locked out without a second factor that travels independently. Backup recovery codes are the third line of defence behind that. The policy is enforced by the registration flow, not by you.

Question 4

When does AAL2 step-up trigger?

Accepted Answer

Clinical scopes — record read, record write, prescription, lab order — require AAL2 within the last sixty minutes by default. The threshold is configurable per organisation. If your session is older than the threshold when you try to open a record, FastLogin re-prompts for a passkey or a TOTP code before Hydra issues the scoped token. You don't sign back in; you confirm.

Question 5

Do I have to KYC again at every hospital I work at?

Accepted Answer

No. A second hospital invites your existing identity rather than creating a new one. Your KYC artefacts are reused; your audit history is preserved across hospitals; only entitlements (which products, which scopes) differ per tenant. Locum doctors and visiting specialists particularly benefit — your identity is yours, and the entitlements travel with the org.

Question 6

What if my MDCN licence expires while I'm employed?

Accepted Answer

The licence-board check runs on a schedule. When the system flags an expired or revoked licence, your clinical entitlements are auto-suspended within hours, and the affected hospital's IT admin gets a notification. Suspension is reversible: re-upload the renewed licence and Didit re-validates. The hash-chained audit shows the suspension and reinstatement events with timestamps.

Question 7

Can I see when my own record was accessed?

Accepted Answer

Yes. The personal audit feed shows every authentication event you initiated and every clinical-access event you performed — patient lookup, record open, prescription write. The hospital's audit feed shows the inverse: who accessed which record. Both are derived from the same chain. NDPA 2023 §25 read-rights apply.

Question 8

Why hash-chain the audit and not just sign each row?

Accepted Answer

Because the chain catches deletions and reorderings, not just edits to existing rows. Each row's hash includes the previous row's hash; tampering breaks the chain at every subsequent row. Verifiers can replay the chain end-to-end and prove no row has been altered or removed. This is the same property that supports the seven-year retention exposure to regulators.

Question 9

How does session revoke work?

Accepted Answer

When you click End session, FastLogin marks the Kratos session inactive immediately and revokes the matching Hydra refresh token. Existing access tokens are still valid until their fifteen-minute expiry; the affected products will fail to refresh. In practice the revoke takes effect within minutes. Hospital admins can also force-revoke a specific user across all sessions from the admin console.

Question 10

What's the SLA for sign-in availability?

Accepted Answer

FastLogin targets four nines on sign-in availability across the Lagos region, measured monthly. Outages and slow-paths trigger an incident response with a customer-facing status update within fifteen minutes of detection. The trust page tracks the historical numbers and links to the most recent post-mortems. The five-minute JWKS cache means that during a brief FastLogin disruption, already-signed-in clinicians keep working against the cached keys until their fifteen-minute access token expires — most short outages never reach the bedside.

Question 11

Can I write prescriptions and lab orders through FastLogin scopes?

Accepted Answer

FastLogin issues the scoped tokens; the actual prescription or lab-order workflow lives in the product. Doorcta and OneHealth both expose prescription scopes that require an AAL2-fresh session and an MDCN-verified clinical role on your FastLogin profile. When you sign a prescription in Doorcta, FastLogin attests that the session is fresh and the role is verified, and the prescription record carries the FastLogin user ID and the audit timestamp. The actual prescription content is stored in the relevant product's record store, not in FastLogin.

Question 12

What if I'm covering an on-call shift and need access at 3am?

Accepted Answer

Sign in normally. After-hours sign-ins are flagged for compliance review by the org-admin tooling, but they are not blocked — that would defeat the point of on-call. The flag becomes a high-signal queue item that the hospital's compliance team reviews the next business day to confirm the activity matched a real on-call assignment. The default after-hours window is Africa/Lagos 08:00–18:00; your hospital's admin can configure a different window or disable flagging entirely if your roster doesn't follow that pattern.

Question 13

How do you handle supervision relationships for trainees?

Accepted Answer

Supervision is currently expressed via entitlements on the trainee's FastLogin identity that scope what they can do without a co-signature. A trainee's prescription scope, for example, may require an attending clinician's AAL2-fresh session within the last five minutes for the prescription to be accepted by the product. The dual-attestation pattern lives in the product's workflow; FastLogin's job is to make the supervisor's identity provable and the supervision event auditable. The OneHealth break-the-glass workflow uses the same primitive for emergency access.

Name	Role	MDCN	Last sign-in	Status
Dr. Adaeze N.	Doctor	MDCN/R/12345	09:14 · Lagos	Active
Dr. Tunde O.	Doctor	MDCN/R/22318	Yesterday	Active
Nurse Funmi A.	Nurse	NMCN/N/55012	08:50 · Lagos	Active
Mary Eze	Front desk	—	08:10 · Lagos	Active
Dr. Sade B.	Locum	MDCN/R/98412	Last week	Suspended

User	Doorcta	OneHealth	FastCredits
Dr. Adaeze N.	Doctor · active	Provider · active	Spend · active
Dr. Tunde O.	Doctor · active	Provider · active	Spend · active
Nurse Funmi A.	Read-only · active	Read-only · active	—
Mary Eze	Front desk · active	—	Reconcile · active
Dr. Sade B.	Doctor · suspended	Provider · suspended	—

Device	Where	Last seen	Action
This device · Chrome 124 · macOS	Lagos · 102.89.42.7	Now	—
iPhone 15 · Safari	Abuja · 41.220.11.88	12 min ago	End session
Doorcta app · iOS	Lagos · 102.89.42.7	2 hours ago	End session

Verified once. Recognised across the network.

1 · Hospital invites you

2 · Verify your medical licence

3 · Enrol MFA — both factors

4 · Step up before clinical access

5 · Use the same identity at every hospital

6 · See your sessions and audit

MDCN-verified identity portable across hospitals

Phishing-resistant MFA, mandatory

Audit trail that follows you, not the building

Visible session control

Capabilities

Integrations

Compliance & safety

Plain answers

Verify once. Practise everywhere.

Verified once. Recognised across the network.

1 · Hospital invites you

2 · Verify your medical licence

3 · Enrol MFA — both factors

4 · Step up before clinical access

5 · Use the same identity at every hospital

6 · See your sessions and audit

MDCN-verified identity portable across hospitals

Phishing-resistant MFA, mandatory

Audit trail that follows you, not the building

Visible session control

Capabilities

Integrations

Compliance & safety

Plain answers

01What licences does FastLogin verify for clinicians?

02How long does the KYC step take?

03Why do I need both a passkey and a TOTP secret?

04When does AAL2 step-up trigger?

05Do I have to KYC again at every hospital I work at?

06What if my MDCN licence expires while I'm employed?

07Can I see when my own record was accessed?

08Why hash-chain the audit and not just sign each row?

09How does session revoke work?

10What's the SLA for sign-in availability?

11Can I write prescriptions and lab orders through FastLogin scopes?

12What if I'm covering an on-call shift and need access at 3am?

13How do you handle supervision relationships for trainees?

Verify once. Practise everywhere.