Users and Roles

AdministrationTenant admin Last updated:

This area is available to tenant administrators and global administrators.

Users are managed from the Users tab inside the tenant detail page. Navigate there by opening your tenant from Tenant Management (global admins), or by selecting the settings gear and choosing Manage Tenant (tenant admins).

Viewing Users

The Users tab shows a list of all users who have access to this tenant, including their name, email address, role information, and account status.

Inviting a New User

  1. On the Users tab, select Invite User.
  2. Enter the new user’s email address and complete the invitation form.
  3. The user will receive an email invitation. They can sign in once they accept and set up their account.

Assigning Roles and Abilities

Access in GEMA is deny-by-default: a user with no roles or abilities assigned can see no features. You must grant at least one role or ability, or make the user a tenant administrator.

Tenant Administrator

Checking Tenant Administrator grants the user every ability in the system. No additional roles or abilities are needed. Use this setting for staff who need full access.

If you have also selected specific roles or abilities for a tenant administrator, those selections are overridden by the administrator grant. To restrict the user to specific features, uncheck Tenant Administrator first.

Role Presets

Roles are presets that expand to a bundle of abilities automatically. Select one or more from the Role presets dropdown. The abilities granted by each preset appear checked in the abilities list below and cannot be individually removed while the role is active.

Individual Abilities

Below the role presets, you will find a list of individual abilities you can toggle on or off. Abilities that are already granted by a selected role preset appear checked and are locked — to remove them, remove the role preset instead.

Patient / PHI access is required for any user who needs to view patient records. Without this ability, patient data is not visible even if other abilities are granted.

Business Unit Assignment

Each user can be assigned to one or more business units. A user can only see and act on data within the business units they are assigned to. You configure business unit access in the same user form where you set roles and abilities.

All Business Units toggle

If you want to grant a user access to every business unit in the tenant without listing them individually, turn on the Access to All Business Units toggle. When the toggle is on:

  • The business unit picker is hidden and replaced with a confirmation badge.
  • The user’s record stores all_bus = true with an empty business unit list.
  • The user can see all data in the tenant, scoped to their roles and abilities, regardless of how many business units exist or are added in the future.

This is useful for staff who need tenant-wide data visibility but should not be made tenant administrators. To return a user to manual business unit assignment, turn the toggle off — the picker reappears and you can assign specific units.

Deactivating a User

To remove a user’s access without permanently deleting their account:

  1. Find the user in the Users tab list.
  2. Open their record and set their status to Inactive (or use the deactivate action).
  3. The user will no longer be able to sign in.

You can reactivate the user later by reversing the status change.