diff --git a/api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java b/api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java
index 7185fd7e..c9af5b25 100644
--- a/api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java
+++ b/api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java
@@ -134,4 +134,10 @@ public static enum ContentFamily {
 	public static final String REPRESENTATION_OBS = "(uuid:ref,comment:ref,obsDatetime:ref)";
 	
 	public static final String REPRESENTATION_VISIT = "(uuid:ref,stopDatetime:ref)";
+	
+	/**
+	 * PRIVILEGES
+	 */
+	public static final String CREATE_ATTACHMENTS = "Create Attachments";
+	public static final String VIEW_ATTACHMENTS = "View Attachments";
 }
diff --git a/api/src/main/java/org/openmrs/module/attachments/AttachmentsService.java b/api/src/main/java/org/openmrs/module/attachments/AttachmentsService.java
index 77a9620d..76ea7551 100644
--- a/api/src/main/java/org/openmrs/module/attachments/AttachmentsService.java
+++ b/api/src/main/java/org/openmrs/module/attachments/AttachmentsService.java
@@ -5,8 +5,10 @@
 import org.openmrs.Encounter;
 import org.openmrs.Patient;
 import org.openmrs.Visit;
+import org.openmrs.annotation.Authorized;
 import org.openmrs.api.APIException;
 import org.openmrs.module.attachments.obs.Attachment;
+import org.openmrs.module.attachments.AttachmentsConstants;
 
 public interface AttachmentsService {
 	
@@ -18,6 +20,7 @@ public interface AttachmentsService {
 	 *            voided ones or not.
 	 * @throws APIException if non-complex obs are mistakenly returned
 	 */
+	@Authorized(AttachmentsConstants.VIEW_ATTACHMENTS)
 	List<Attachment> getAttachments(Patient patient, boolean includeVoided);
 	
 	/**
@@ -29,6 +32,7 @@ public interface AttachmentsService {
 	 *            include attachments that are not associated with any visits or encounters.
 	 * @throws APIException if non-complex obs are mistakenly returned
 	 */
+	@Authorized(AttachmentsConstants.VIEW_ATTACHMENTS)
 	List<Attachment> getAttachments(Patient patient, boolean includeEncounterless, boolean includeVoided);
 	
 	/**
@@ -38,6 +42,7 @@ public interface AttachmentsService {
 	 *            voided ones or not.
 	 * @throws APIException if non-complex obs are mistakenly returned
 	 */
+	@Authorized(AttachmentsConstants.VIEW_ATTACHMENTS)
 	List<Attachment> getEncounterlessAttachments(Patient patient, boolean includeVoided);
 	
 	/**
@@ -48,6 +53,7 @@ public interface AttachmentsService {
 	 *            voided ones or not.
 	 * @throws APIException if non-complex obs are mistakenly returned
 	 */
+	@Authorized(AttachmentsConstants.VIEW_ATTACHMENTS)
 	List<Attachment> getAttachments(Patient patient, Encounter encounter, boolean includeVoided);
 	
 	/**
@@ -58,7 +64,9 @@ public interface AttachmentsService {
 	 *            voided ones or not.
 	 * @throws APIException if non-complex obs are mistakenly returned
 	 */
+	@Authorized(AttachmentsConstants.VIEW_ATTACHMENTS)
 	List<Attachment> getAttachments(Patient patient, Visit visit, boolean includeVoided);
 	
+	@Authorized(AttachmentsConstants.CREATE_ATTACHMENTS)
 	Attachment save(Attachment attachment, String reason);
 }
diff --git a/omod/src/main/resources/config.xml b/omod/src/main/resources/config.xml
index df1bc5c1..d746ae92 100644
--- a/omod/src/main/resources/config.xml
+++ b/omod/src/main/resources/config.xml
@@ -156,4 +156,13 @@
 		<description>Allowed to access the main attachments page</description>
 	</privilege>
 
+	<privilege>
+		<name>Create Attachment</name>
+		<description>Allowed to create attachments</description>
+	</privilege>
+
+	<privilege>
+		<name>View Attachments</name>
+		<description>Allowed to view attachments</description>
+	</privilege>
 </module>