Site settings

How EDFlow site settings work: allowed ranges, settings locked in production, privacy-reducing changes, approvals, history and revert, configuration transfer, and the full settings reference.

Every site setting has a default, an allowed range, a plain explanation and a history. The table at the bottom of this page is generated from the same specification the admin forms and the server use, so it is always current.

Hospital information: names in English and French, address, phone numbers, Wi-Fi and the patient portal link. — WebCaptured from build 7c7f41f on September 27, 2026

How changes are checked

Ranges: values outside the allowed range are refused by the server, not just the form.
Locked: some settings are fixed everywhere (for example MFA for administrators) or fixed in production (MFA for all staff).
Privacy-reducing: turning on something that shows more (named clinician metrics, room labels, detailed lock-screen text) needs a typed confirmation and a fresh sign-in check, and is audited with before and after values.
Trust anchors: the main phone, patient portal URL, Maps link and the patient-relations and privacy-office contacts need a second approver, because patients rely on them.
Every change goes through one path, so the same checks apply in the UI, imports and reverts.

History and revert

Settings → History lists every version of the site's settings and catalogues with who, when and what changed. Revert creates a new version with the old values, under the same checks.

Configuration transfer

Export the site's configuration (settings, catalogues, content, request and code types, zones; never patient data, keys or users) as a signed file, and import it into another site with a diff preview. The import applies all or nothing. Use it to promote a tested configuration to production or to clone a site.

Admin search

One search box over users, invites, content, request and code types, tests, sources and settings keys, filtered by what you can open. Patients are never searched here.

Setting groups

Group	Page
Hospital information	Hospital information
Zones, beds, shifts, reassessment intervals	Zones, beds and shifts
Request types and service levels	Request types
Code types	Code types
Tests, benchmarks and estimates	Tests and benchmarks
Content, tasks and going-home templates	Patient content
Languages	Languages
Privacy, access and retention	Privacy and retention
Notifications	Notifications
Waiting-room display	Waiting-room display
AI	AI

Every setting

Setting	Default	Allowed values	What it does
`flow.piaSource`	attending_assigned	attending_assigned, explicit	Which event counts as the physician initial assessment (NACRS PIA only when explicit).
`flow.piaRoles`	["attending","resident","nurse_practitioner"]	array	Clinician types whose assignment counts as the PIA.
`flow.assignmentNotifyHoldMinutes`	10	5–15 minutes	How long a provider assignment is held before the patient is told (D-25).
`flow.seenInference.firstOrderByAssigned`	true	boolean	The assigned clinician's first order infers "seen".
`flow.seenInference.consultRequest`	true	boolean	A consult request infers "seen".
`flow.seenInference.disposition`	true	boolean	A disposition infers "seen".
`flow.reassessmentInference.newOrderAfterAllBack`	true	boolean	A new order after all results are back infers reassessment (D-26).
`flow.reassessmentInference.consultRequest`	true	boolean	A consult request infers reassessment.
`flow.reassessmentInference.noteSigned`	true	boolean	A signed note infers reassessment.
`flow.reassessmentInference.procedureArea`	true	boolean	A move to a procedure area infers reassessment.
`flow.resultComplete.lab`	resulted	in_lab, in_progress, performed, preliminary, resulted	Lab status that counts as "Back".
`flow.resultComplete.imaging`	preliminary	in_lab, in_progress, performed, preliminary, resulted	Imaging status that counts as "Back" (D-28).
`flow.resultComplete.cardiology`	performed	in_lab, in_progress, performed, preliminary, resulted	Cardiology status that counts as "Back".
`flow.resultComplete.imagingByModality`	[]	array	Per-modality imaging thresholds, e.g. X-ray at performed where ED physicians read their own films.
`flow.resultsReviewedCountsForImaging`	true	boolean	An imaging order with results reviewed counts as "Back".
`flow.manualProfile`	lite	lite, full	Manual-mode depth at sites without a feed (D-46).
`flow.manualStaleMinutes`	90	30–240 minutes	Manual-lite prompt after this long without an update.
`flow.noUpdateAlertHours`	12	4–24 hours	"No updates" alert for the charge nurse (D-50).
`flow.observationIsCdu`	false	boolean	Observation happens in a clinical decision unit.
`imaging.serviceHours`	[]	array	Modality service hours; empty means 24/7 (D-28).
`imaging.downtime`	[]	array	Current imaging downtime per modality (set from W-S06).
`results.displayDelayMinutes`	0	0–30 minutes	Delay before a completed result shows as "Back" to the patient.
`results.holdAllowed`	true	boolean	Clinicians may hold results (D-29).
`lifecycle.deceasedPauseHours`	24	1–72 hours	Pause length after a deceased disposition (D-21).
`reassessment.intervals.ctas2`	15	5–240 minutes	Waiting-room reassessment interval for CTAS 2 (D-53).
`reassessment.intervals.ctas3`	30	5–240 minutes	Waiting-room reassessment interval for CTAS 3.
`reassessment.intervals.ctas4`	60	5–240 minutes	Waiting-room reassessment interval for CTAS 4.
`reassessment.intervals.ctas5`	120	5–240 minutes	Waiting-room reassessment interval for CTAS 5.
`cards.autoPrint`	true	boolean	Visit cards print automatically at the print station.
`cards.printAt`	after_triage	after_triage, registration	When the card prints (D-43).
`cards.form`	card	card, wristband_label	Card or wristband label (discouraged; forces the date-of-birth check on every device, D-51). (Reduces privacy)
`cards.nameDisplay`	initials	initials, first_initial, none	Name printed on the visit card. (Reduces privacy)
`cards.shortUrl`	—	string	Printed "go to" URL on the card; https on a trusted domain. (Reduces privacy)
`tasks.urineMinAge`	4	0–10 age_years	Minimum age for the urine task T-01 (D-44).
`tasks.derivedDelayMinutes`	3	0–10 minutes	Delay before derived tasks appear.
`tasks.consentStyle`	written	written, verbal	Consent task wording (T-02).
`tasks.consentWho`	{"en":"Your nurse","fr":"Votre infirmière ou infirmier"}	object	Who explains the test in the verbal consent task.
`tasks.pregnancyCheckAges.min`	12	10–60 age_years	Youngest age for the pregnancy check T-05.
`tasks.pregnancyCheckAges.max`	55	10–60 age_years	Oldest age for the pregnancy check T-05.
`capacity.treatmentSpaces`	30	1–500 count	Treatment-space capacity, the occupancy denominator (F-08.3).
`privacy.dataProfile`	standard	standard, minimal	Data minimization profile (EHR §11.3). (Reduces privacy)
`access.patientGraceHours`	72	0–168 hours	How long patient access lasts after departure (D-05). (Reduces privacy)
`access.familyGraceMinutes`	120	0–1440 minutes	How long family links last after departure. (Reduces privacy)
`retention.operationalWindowDays`	30	7–90 days	Days PHI is kept before de-identification (F-21.2). (Reduces privacy)
`retention.auditDays`	730	730–3650 days	Audit log retention. (Reduces privacy)
`retention.analyticsDays`	730	365–2555 days	De-identified analytics retention. (Reduces privacy)
`access.guardianAge`	16	0–18 age_years	Guardian mode applies below this age. (Reduces privacy)
`access.youthConfidentialAges.min`	12	10–18 age_years	Youngest age for youth-confidential mode (D-43). (Reduces privacy)
`access.youthConfidentialAges.max`	17	10–18 age_years	Oldest age for youth-confidential mode. (Reduces privacy)
`access.recipientPrompt`	true	boolean	Triage asks who receives the card (D-43). (Reduces privacy)
`access.visitCodeSource`	edflow	edflow, ehr_visit_number	Random codes or the EHR visit number (only with attested non-sequential numbers; never under minimal). (Reduces privacy)
`retention.safetyRecordYears`	10	2–30 years	Retention of care records (D-36). (Reduces privacy)
`sharing.enabled`	true	boolean	Patients can share with family. (Reduces privacy)
`sharing.maxLinks`	5	1–5 count	Active family links per visit. (Reduces privacy)
`sharing.maxDevicesPerLink`	3	1–5 count	Devices per family link (D-14). (Reduces privacy)
`family.showPhotos`	false	boolean	Care-team photos in the family view. (Reduces privacy)
`careTeam.namePolicy`	first_last_initial	first_last_initial, first_only	How non-physician staff names show to patients (physicians always "Dr. First Last"). (Reduces privacy)
`careTeam.allowPhotos`	true	boolean	Staff may opt in to show photos. (Reduces privacy)
`careTeam.photoApproval`	true	boolean	Photos need manager approval. (Reduces privacy)
`careTeam.showOtherRoles`	true	boolean	Show roles beyond physician and nurse. (Reduces privacy)
`patient.showRoomLabel`	false	boolean	Show the room or bed label to the patient. (Reduces privacy)
`careTeam.showTriageNurseName`	false	boolean	Show the triage nurse's name. (Reduces privacy)
`bigBoard.nameDisplay`	initials	initials, first_last_initial	Names on big-board stations. (Reduces privacy)
`privacy.maskConfidentialNamesOnBoard`	true	boolean	Mask confidential names on the board. (Reduces privacy)
`estimates.hideBeforePiaForCtas`	[1,2]	array	CTAS levels whose estimate is hidden before the patient is seen (SR-07).
`estimates.showBoardingEstimate`	false	boolean	Show the boarding estimate (D-32).
`estimates.streamDimension`	true	boolean	Use the stream in triage-to-seen buckets (D-33).
`avs.enabled`	true	boolean	After-visit summaries are available.
`avs.allowVisitReason`	false	boolean	The AVS may state the visit reason. (Reduces privacy)
`avs.medicationsSection`	off	off, prescribers_attested	AVS medicines section with prescriber attestation (D-35).
`analytics.clinicianMetrics`	false	boolean	Clinician-level metrics (EHR §12). (Reduces privacy)
`analytics.namedClinicianMetrics`	false	boolean	Named clinician metrics; requires clinician metrics (D-20). (Reduces privacy)
`analytics.nurseMetrics`	false	boolean	Nurse self-view metrics. (Reduces privacy)
`analytics.minCell`	5	5–20 count	Small-cell suppression threshold. (Reduces privacy)
`security.mfaRequiredForAll`	true	boolean	MFA for every password sign-in (locked on in production, D-13). (Reduces privacy)
`security.mfaRequiredForAdmins`	true	boolean	MFA for manager, privacy and integration roles (locked on everywhere). (Locked, Reduces privacy)
`security.staffIdleLockMinutes`	15	5–60 minutes	Staff idle lock. (Reduces privacy)
`security.staffSessionHours`	12	8–16 hours	Staff absolute session lifetime. (Reduces privacy)
`security.staffEmailDomains`	[]	array	Invite domains that need no approval (D-64). (Reduces privacy)
`security.guestNetworkPrefixes`	[]	array	Guest-network prefixes named in breaker alerts, never hard-blocked. (Reduces privacy)
`sso.allowedDomains`	[]	array	Entra ID sign-in domains. (Reduces privacy)
`sso.allowedTenants`	[]	array	Entra ID tenant ids (guests always refused). (Reduces privacy)
`research.surveyConsentEnabled`	false	boolean	Offer the research consent on the survey. (Reduces privacy)
`training.enabled`	false	boolean	Training mode is available at this site (F-33.3).
`estimates.windowWeeks`	12	4–26 weeks	Sample window for estimates (F-05.3).
`estimates.minSamples`	20	10–100 count	Minimum samples per ladder level.
`estimates.flowDefaults`	[{"dimension":"","metricKey":"flow.arrival_to_triage","p50":10,"p75":15,"p90":30},{"dimension":"1","metricKey":"flow.triage_to_seen","p50":0,"p75":0,"p90":5},{"dimension":"2","metricKey":"flow.triage_to_seen","p50":15,"p75":25,"p90":45},{"dimension":"3","metricKey":"flow.triage_to_seen","p50":60,"p75":90,"p90":180},{"dimension":"4","metricKey":"flow.triage_to_seen","p50":90,"p75":120,"p90":240},{"dimension":"5","metricKey":"flow.triage_to_seen","p50":90,"p75":135,"p90":240},{"dimension":"1","metricKey":"flow.triage_to_pia","p50":0,"p75":0,"p90":5},{"dimension":"2","metricKey":"flow.triage_to_pia","p50":15,"p75":25,"p90":45},{"dimension":"3","metricKey":"flow.triage_to_pia","p50":60,"p75":90,"p90":180},{"dimension":"4","metricKey":"flow.triage_to_pia","p50":90,"p75":120,"p90":240},{"dimension":"5","metricKey":"flow.triage_to_pia","p50":90,"p75":135,"p90":240},{"dimension":"","metricKey":"flow.seen_to_first_order","p50":15,"p75":25,"p90":45},{"dimension":"","metricKey":"flow.seen_to_decision_no_tests","p50":30,"p75":45,"p90":90},{"dimension":"","metricKey":"flow.testing","p50":120,"p75":160,"p90":240},{"dimension":"","metricKey":"flow.results_to_reassessment","p50":30,"p75":45,"p90":90},{"dimension":"","metricKey":"flow.boarding","p50":360,"p75":720,"p90":1440},{"dimension":"","metricKey":"flow.discharge_to_cleared","p50":20,"p75":30,"p90":60},{"dimension":"","metricKey":"flow.cleared_to_departure","p50":5,"p75":10,"p90":20}]	array	Default flow benchmarks (Appendix B.4).
`requests.slaMultiplier.urgent`	1	0.5–2 multiplier	SLA multiplier for urgent requests (F-09.6).
`requests.slaMultiplier.high`	1	0.5–2 multiplier	SLA multiplier for high requests (F-09.6).
`requests.slaMultiplier.normal`	1	0.5–2 multiplier	SLA multiplier for normal requests (F-09.6).
`requests.slaMultiplier.low`	1	0.5–2 multiplier	SLA multiplier for low requests (F-09.6).
`requests.maxPerHour`	12	1–60 count	Non-urgent requests per visit per hour.
`requests.urgentGoingNowMinutes`	5	3–10 minutes	"Going now" pauses escalation this long (D-23).
`requests.excludeTriageFromComfort`	false	boolean	Keep the triage nurse out of comfort routing (D-37).
`codes.notifyThrottleMinutes`	30	15–120 minutes	Delay-notice push throttle per patient.
`codes.autoNotifyFromFeed`	false	boolean	Feed codes post the notice without a prompt (never skips the subject step).
`codes.edRespondsOutside`	false	boolean	Prompt the charge nurse for codes outside the ED.
`codes.pagingEdLocations`	[]	array	Paging locations inside the ED.
`volume.reviewAfterHours`	4	1–12 hours	Prompt to review the volume level.
`volume.acceptFeedLevel`	false	boolean	Apply the feed's volume level directly.
`volume.thresholds.busy.waiting`	12	1–500 count	Volume suggestion threshold: busy waiting (F-08.3).
`volume.thresholds.busy.boarding`	8	1–500 count	Volume suggestion threshold: busy boarding (F-08.3).
`volume.thresholds.busy.occupancy`	0.95	0.1–5 ratio	Volume suggestion threshold: busy occupancy (F-08.3).
`volume.thresholds.busy.waitRatio`	1.25	0.1–10 ratio	Volume suggestion threshold: busy waitRatio (F-08.3).
`volume.thresholds.veryBusy.waiting`	20	1–500 count	Volume suggestion threshold: veryBusy waiting (F-08.3).
`volume.thresholds.veryBusy.boarding`	12	1–500 count	Volume suggestion threshold: veryBusy boarding (F-08.3).
`volume.thresholds.veryBusy.occupancy`	1.1	0.1–5 ratio	Volume suggestion threshold: veryBusy occupancy (F-08.3).
`volume.thresholds.veryBusy.waitRatio`	1.75	0.1–10 ratio	Volume suggestion threshold: veryBusy waitRatio (F-08.3).
`analytics.ontarioTargets.admitted`	480	30–2880 minutes	Ontario target, admitted (D-48).
`analytics.ontarioTargets.nonAdmittedHigh`	480	30–2880 minutes	Ontario target, non-admitted CTAS 1–3.
`analytics.ontarioTargets.nonAdmittedLow`	240	30–2880 minutes	Ontario target, non-admitted CTAS 4–5.
`analytics.ontarioTargets.emsOffload`	30	5–240 minutes	Ontario target, EMS offload.
`notifications.push`	true	boolean	Push notifications (effective only when the provider is configured). (Reduces privacy)
`notifications.patientSms`	true	boolean	Patient SMS updates (US sub-processor, Q-15). (Reduces privacy)
`notifications.familySms`	true	boolean	Family SMS updates. (Reduces privacy)
`notifications.email`	true	boolean	Patient summary-link email. (Reduces privacy)
`notifications.pushPreviewDefault`	generic	generic, detailed	Default push preview (D-11). (Reduces privacy)
`notifications.pushPerHour`	6	1–20 count	Push budget per patient per hour.
`notifications.smsPerDay`	3	0–10 count	SMS budget per patient per day.
`notifications.staffCodePush`	false	boolean	Staff push when a code is called (D-38).
`notifications.staffBedInPush`	false	boolean	Bed label in staff push text. (Reduces privacy)
`notifications.brandedLabelApproved`	false	boolean	The privacy office approved the branded SMS and push label (BR-13). (Reduces privacy)
`languages.safetyLocales`	[]	array	Up to five safety locales (D-52).
`feed.delayedAfterMinutes`	5	1–60 minutes	Feed is "delayed" after this silence (F-16.1).
`feed.downAfterMinutes`	15	2–240 minutes	Feed is "down" after this silence.
`integration.alertEmails`	[]	array	Recipients of feed and integration alerts (≤ 10). (Reduces privacy)
`display.access`	public	public, key	Waiting-room display is public or needs a display key. (Reduces privacy)
`display.showTypicalWait`	false	boolean	Show the official typical wait (D-18).
`display.typicalWaitSource`	feed	feed, manual	Source of the typical wait.
`display.manualTypicalWait`	—	object	Manual typical wait with the time it was set.
`display.languageMode`	alternate	alternate, side_by_side, english_only	Display language mode: English and French in turn, side by side, or English only (owner, 2026-09-26).
`display.orientation`	landscape	landscape, portrait	Display orientation.
`display.allowEmbed`	false	boolean	Allow framing by the embed origins. (Reduces privacy)
`display.embedOrigins`	[]	array	Exact https origins allowed to frame the display (never "*"). (Reduces privacy)
`display.slideSlugs`	[]	array	Display loop slides.
`integration.api.reads`	false	boolean	Allows encounters, care-team, requests and tasks reads at this site (F-34.4). (Reduces privacy)
`integration.api.includeCodeArea`	true	boolean	Code alerts in the API include the area label. (Reduces privacy)
`integration.requestWriteback`	false	boolean	Allows requests:write. (Reduces privacy)
`integration.webhooks.enabled`	false	boolean	Outbound webhook deliveries for this site. (Reduces privacy)
`integration.storeVisitNumberEncrypted`	false	boolean	Exposes externalRef on encounters and webhooks. (Reduces privacy)
`integration.rosterMaxClose`	5	1–50 count	Roster circuit breaker: encounters one roster may close. (Reduces privacy)
`integration.rosterMaxClosePct`	20	5–50 percent	Roster circuit breaker: share of the census. (Reduces privacy)
`ai.enabled`	false	boolean	AI features at this site (F-35.3 layer 4). (Reduces privacy)
`ai.features.patientAssistant`	false	boolean	AI feature: patientAssistant. (Reduces privacy)
`ai.features.familyHelper`	false	boolean	AI feature: familyHelper. (Reduces privacy)
`ai.features.familyCatchUp`	false	boolean	AI feature: familyCatchUp. (Reduces privacy)
`ai.features.testExplainers`	false	boolean	AI feature: testExplainers. (Reduces privacy)
`ai.features.machineTranslation`	false	boolean	AI feature: machineTranslation. (Reduces privacy)
`ai.features.voiceNative`	false	boolean	AI feature: voiceNative. (Reduces privacy)
`ai.features.voiceWeb`	false	boolean	AI feature: voiceWeb. (Reduces privacy)
`ai.features.requestDigest`	false	boolean	AI feature: requestDigest. (Reduces privacy)
`ai.features.quickReplies`	false	boolean	AI feature: quickReplies. (Reduces privacy)
`ai.features.handover`	false	boolean	AI feature: handover. (Reduces privacy)
`ai.features.patientMessageDrafts`	false	boolean	AI feature: patientMessageDrafts. (Reduces privacy)
`ai.features.askData`	false	boolean	AI feature: askData. (Reduces privacy)
`ai.features.insights`	false	boolean	AI feature: insights. (Reduces privacy)
`ai.features.weeklyReport`	false	boolean	AI feature: weeklyReport. (Reduces privacy)
`ai.features.anomalies`	false	boolean	AI feature: anomalies. (Reduces privacy)
`ai.features.mappingAssistant`	false	boolean	AI feature: mappingAssistant. (Reduces privacy)
`ai.features.catalogChecks`	false	boolean	AI feature: catalogChecks. (Reduces privacy)
`ai.features.contentAuthoring`	false	boolean	AI feature: contentAuthoring. (Reduces privacy)
`ai.features.feedbackThemes`	false	boolean	AI feature: feedbackThemes. (Reduces privacy)
`ai.features.commandAssistant`	false	boolean	AI feature: commandAssistant. (Reduces privacy)
`ai.features.auditExplainer`	false	boolean	AI feature: auditExplainer. (Reduces privacy)
`ai.patientLanguages`	[]	array	Machine-translated patient languages (each enabled in aiLanguages). (Reduces privacy)
`ai.monthlyBudgetUsd`	500	0–100000 usd	Site AI budget per month (AI_DEFAULT_SITE_BUDGET_USD).
`ai.conversationRetentionDays`	7	0–30 days	Days AI conversations are kept after the session ends. (Reduces privacy)
`ai.safetyReviewSampleRate`	0	0–1 ratio	Random sampling of unflagged conversations; > 0 only with randomSampleApproval. (Reduces privacy)
`ai.selfHarmAutoAlert`	true	boolean	Self-harm sends a structured urgent alert; off only with selfHarmAlertWaiver (D-AI-03). (Reduces privacy)
`ai.distressAutoAlertSeconds`	60	30–120 seconds	Red-flag distress alert delay (D-AI-03).
`ai.showAssistantByDefault`	true	boolean	Show the assistant entry point by default.
`ai.crossSitePeerRanges`	false	boolean	Cross-site peer ranges (AI-15, Q-AI-06). (Reduces privacy)
`ai.governance.privacyApproval`	—	object	Governance gate record: privacyApproval. (Reduces privacy)
`ai.governance.regulatoryMemo`	—	object	Governance gate record: regulatoryMemo. (Reduces privacy)
`ai.governance.evalSignoff`	—	object	Governance gate record: evalSignoff. (Reduces privacy)
`ai.governance.piaTra`	—	object	Governance gate record: piaTra. (Reduces privacy)
`ai.governance.hazardLog`	—	object	Governance gate record: hazardLog. (Reduces privacy)
`ai.governance.staffBriefing`	—	object	Governance gate record: staffBriefing. (Reduces privacy)
`ai.governance.mappingAssistantPrivacyApproval`	—	object	Governance gate record: mappingAssistantPrivacyApproval. (Reduces privacy)
`ai.governance.randomSampleApproval`	—	object	Governance gate record: randomSampleApproval. (Reduces privacy)
`ai.governance.selfHarmAlertWaiver`	—	object	Governance gate record: selfHarmAlertWaiver. (Reduces privacy)
`ai.governance.safetyReviewers`	[]	array	The designated AI safety review group (§2.4 footnote 8). (Reduces privacy)
`messaging.patientFacingLabel`	neutral	neutral, branded	Neutral or branded SMS and push label; branded needs brandedLabelApproval (BR-13). (Reduces privacy)
`messaging.brandedLabelApproval`	—	object	Recorded privacy approval for the branded label (audited). (Reduces privacy)