Staff Roles & Two-Person Admin Control

The User management page is where you review your hospital’s staff and control who holds administrator access. Each staff member’s roles are assigned when you invite them (see Staff Invites); changing hospital admin access afterward — whether by granting or revoking it directly, or by an invited person accepting a Hospital administrator invite — goes through a two-person approval flow, so no single administrator can quietly escalate their own access or lock out the rest of the team.

Review your staff

The Staff table lists every active staff member with their Email, Roles, Last login time (“Never” if they haven’t signed in yet), and per-person Actions. From the same row you can select View audit log to open that person’s audit history.

Grant or revoke admin access

1. In the staff member’s row, select Grant admin — or Revoke admin for an existing administrator.
2. If your hospital has two or more active administrators, the change doesn’t apply immediately. You see “Request submitted. A second administrator must approve it before it takes effect.”
3. The request appears under Pending approvals, showing what was requested and who requested it. Any other administrator can select Approve or Reject. You can’t approve or reject a request you submitted yourself — a second administrator must review it.

Once a request is approved, the change applies right away (“Request approved and applied.”). Rejected requests are simply closed.

A hospital with only one administrator can still grant admin access to a second person directly, since there’s no peer available yet to approve — you see “Admin granted. This was applied directly because the hospital had no other administrators.” The Revoke admin action isn’t offered while your hospital has only one administrator, so you can never remove the last one — add another administrator first.

Administrator access granted by invite follows the same rule: when your hospital already has two or more active administrators, an accepted Hospital administrator invite arrives under Pending approvals as a request from the administrator who sent the invite, and a different administrator must approve it before the access takes effect. The person who sent the invite can’t approve their own request.

Reset a staff member’s two-factor authentication

Select Reset MFA in a staff member’s row to clear their two-factor enrollment. You see “MFA reset. The user will re-enroll on next sign-in.” See Two-Factor Authentication (TOTP) for Staff for what re-enrollment looks like on their side.