Users and access
Manage EDFlow staff accounts: invites, roles and the full permission matrix, approvals for privileged roles, deactivation, unlock and MFA reset, bulk import and SCIM, and the quarterly access review.
Users
The users list shows name, email, roles, clinician type, status (invited, pending approval, active, deactivated, locked), sites, last sign-in, MFA status, SSO link, provisioning source and flags. Search by name or email prefix; filter by role and status.
With users.manage you can:
- edit roles and clinician type (privileged roles need approval);
- deactivate or reactivate (deactivation revokes sessions and unused credentials the user issued at once);
- unlock a locked account, reset MFA, force a password reset, sign out all sessions;
- edit EHR identity links (with confirmation; alerts the privacy officer);
- mark someone hidden from patients, approve a photo or display-name change, and mark a clinical approver.
You can't remove your own manager role if you're the site's last manager. Every change is audited with before and after values.
Invites
Invite up to 20 emails at once with roles, clinician type and an optional message (500 characters, no links or phone numbers). Invites expire after 72 hours; Resend invalidates the previous link. Addresses outside the site's staff email domains need a second manager's approval before anything is sent.
security.staffEmailDomains (default [])
Roles and permissions
The full matrix, generated from the product's permission catalogue:
| Permission | R-TRIAGE | R-NURSE | R-PHYSICIAN | R-CHARGE | R-CLERK | R-SUPPORT | R-MANAGER | R-PRIVACY | R-INTEGRATION | R-INTEGRATION-DEVELOPER | R-SUPER |
|---|---|---|---|---|---|---|---|---|---|---|---|
board.view | Granted | Granted | Granted | Granted | Conditional | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
patient.view | Granted | Granted | Granted | Granted | Conditional | Not granted | Granted | Conditional | Not granted | Not granted | Not granted |
patient.unmask | Granted | Granted | Granted | Granted | Granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
patient.register | Granted | Not granted | Not granted | Granted | Granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
patient.state | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
patient.override | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
patient.lifecycle | Not granted | Not granted | Not granted | Granted | Conditional | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
careteam.assign | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
zones.assign | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
results.release | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
tasks.manage | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
avs.compose | Not granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
avs.medications | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted |
access.card | Granted | Granted | Granted | Granted | Granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
access.revoke | Not granted | Not granted | Not granted | Granted | Granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
share.manage | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
privacy.flag | Granted | Not granted | Not granted | Granted | Granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
patient.restrict | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
updates.pause | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
patient.callback | Granted | Granted | Granted | Granted | Granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
request.view | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
request.act | Granted | Granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
request.bulk | Granted | Granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
code.call | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
code.clear | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
code.notice | Granted | Granted | Granted | Granted | Granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
support.queue | Not granted | Not granted | Not granted | Granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted | Not granted |
volume.set | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
analytics.view | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
analytics.self | Not granted | Conditional | Conditional | Conditional | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted |
analytics.clinician_blinded | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted | Not granted |
analytics.clinician_named | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted | Not granted |
analytics.export | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
users.view | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
users.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
users.import | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
settings.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
config.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
stations.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
approvals.decide | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Conditional | Conditional | Not granted | Not granted | Conditional |
training.manage | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
content.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
content.approve | Not granted | Not granted | Conditional | Conditional | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted | Not granted |
announcements.manage | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted | Not granted |
integration.view | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Granted | Not granted | Granted | Conditional | Not granted |
integration.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted |
audit.view | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
audit.export | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted |
privacy.legal_hold | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted |
privacy.incident | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted |
privacy.emergency_revoke | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
outbox.view | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Granted | Not granted | Not granted |
access_review.run | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Not granted | Not granted | Not granted |
simulator.use | Not granted | Not granted | Not granted | Conditional | Not granted | Not granted | Conditional | Not granted | Conditional | Not granted | Conditional |
seed.reset | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted | Conditional |
platform.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted |
developers.view | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Conditional | Granted | Granted | Not granted |
developers.manage | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Granted | Not granted |
developers.credentials | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Conditional | Not granted |
developers.approve | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Granted | Not granted | Not granted |
developers.attest_pia | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Not granted | Not granted |
developers.accept_affiliation | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Granted | Not granted | Granted | Not granted | Not granted |
ai.safety_review | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Not granted | Conditional | Not granted | Not granted | Not granted |
Separation of duties: a privacy officer can't also hold a manager or clinical role. Granting manager, privacy or integration roles creates an approval request that a different eligible person approves.
Approvals
Approvals lists pending, approved, rejected and expired two-person requests: privileged role grants, external-domain invites, audit and visit-record exports, trust-anchor changes (like the main phone), patient-facing announcements and tenant offboarding. Requests expire after 72 hours. Nobody can approve their own request, and approving needs a fresh sign-in check.
Bulk import and directory provisioning
- Import: upload a CSV (email, given name, family name, roles, clinician type, zone). Every row is validated; if any row fails, nothing is created.
- Provisioning: a SCIM 2.0 endpoint for Microsoft Entra ID or another IdP, with a site-scoped token revealed once. A user disabled in the directory is deactivated within 5 minutes.
Quarterly access review
Review every active membership (roles, last sign-in, MFA, source), mark each keep, change or remove, then attest with your name and date. The page shows Overdue 90 days after the last attestation.
Related
Last updated on