Vendor support access
How time-boxed vendor support access to your EDFlow site works: no standing access, a ticket and reason, read-only or admin scope, at most 4 hours, notifications to managers and a full audit trail.
EDFlow operators have no standing access to your site's data. When your team asks for help that needs a look at your site, an operator opens a support-access session.
How it works
| Duration | At most 4 hours, then it ends on its own |
| Scope | Read-only or admin, chosen for the ticket |
| Reason | A support ticket id is required |
| Notification | Your site's managers are notified when it starts (monitoring rule A-8) |
| Audit | Every action in the session carries the support-access id in your audit log |
Checking what happened
Filter the audit log by actor type platform, or by the support-access id from the notification. The per-patient access report includes any visit opened during support access.
Break-glass
For production emergencies, break-glass access needs a second operator's approval and is recorded. See Privileged access for how vendor staff can and can't reach production.
If something looks wrong
Contact your EDFlow account contact and open a privacy incident if needed.
Last updated on