Users and Roles

AdministrationTenant adminLast updated:

This area is available to tenant administrators and global administrators.

Open the tenant detail page and select Users. Global administrators reach it from Tenant Management; tenant administrators select the settings gear and choose Manage Tenant.

The Users tab has two inner tabs:

  • People — the user list, invitations, and per-user editing (roles, abilities, business units, and assignment groups).
  • User Groups — create and manage teams that route task work. User groups are separate from business units and roles; they control who sees which tasks in the queue, not what data a user can access.

User Groups

Select the User Groups sub-tab to define teams that own task work.

Each group has:

  • Group Name — a display name for the team (for example, “Data Request Team”).
  • Task Types Owned — the task categories this group handles. When a new task of one of these types is created, it is suggested to this group automatically. Each task type can belong to only one group in your tenant.
  • Members — the people who see this group’s unclaimed work in My Tasks on the task queue.

Select New Group to create a group, or the pencil icon on a row to edit one. On the edit panel you can rename the group, change its task types, and add or remove members.

Changing a group’s task types does not move tasks that already exist — it only affects work created from that point forward. Tasks already on the queue stay where they are until someone reassigns them.

User groups route work; they do not grant permissions. A member still needs the appropriate roles, abilities, and business units to open patients and act on tasks.

To remove a group, select the delete icon. If members are still listed, you must remove them first (or confirm removal when prompted). Tasks already routed to a deleted group keep their assignment until someone reassigns them.

Viewing Users

On the People sub-tab, you see users who have access to this tenant, including their name, email address, role information, and account status. By default, deactivated users are hidden from the list. Turn on Show deactivated users above the list to include them.

Inviting a New User

  1. On the People sub-tab, select Invite User.
  2. Enter the new user’s email address and complete the invitation form.
  3. Optionally select Assignment Groups — pick one or more existing user groups. You cannot create a new group from this form; create groups on the User Groups sub-tab first. Assignment groups determine which unclaimed team work appears in the user’s My Tasks inbox; they do not grant access to features or data.
  4. The user will receive an email invitation. They can sign in once they accept and set up their account.

When editing an existing user on People, the same Assignment Groups field is available to add or remove group membership.

From a user’s row actions you can also Reset MFA. A confirmation dialog explains that this disables all of that user’s MFA methods; after you confirm, GEMA shows the result in a status dialog.

Assigning Roles and Abilities

Access in GEMA is deny-by-default: a user with no roles or abilities assigned can see no features. You must grant at least one role or ability, or make the user a tenant administrator.

Tenant Administrator

Checking Tenant Administrator grants the user every ability in the system. No additional roles or abilities are needed. Use this setting for staff who need full access.

If you have also selected specific roles or abilities for a tenant administrator, those selections are overridden by the administrator grant. To restrict the user to specific features, uncheck Tenant Administrator first.

Role Presets

Roles are presets that expand to a bundle of abilities automatically. Select one or more from the Role presets dropdown. The abilities granted by each preset appear checked in the abilities list below and cannot be individually removed while the role is active.

Individual Abilities

Below the role presets, you will find a list of individual abilities you can toggle on or off. Abilities that are already granted by a selected role preset appear checked and are locked — to remove them, remove the role preset instead.

Patient / PHI access is required for any user who needs to view patient records. Without this ability, patient data is not visible even if other abilities are granted.

Business Unit Assignment

Each user can be assigned to one or more business units. A user can only see and act on data within the business units they are assigned to. You configure business unit access in the same user form where you set roles and abilities.

Business units control data access. User groups (on the User Groups sub-tab and the Assignment Groups field on user forms) control task routing in the queue. A user needs both the right business units and the right group membership to pick up work on patients they can access.

All Business Units toggle

If you want to grant a user access to every business unit in the tenant without listing them individually, turn on the Access to All Business Units toggle. When the toggle is on:

  • The business unit picker is hidden and replaced with a confirmation badge.
  • The user’s record stores all_bus = true with an empty business unit list.
  • The user can see all data in the tenant, scoped to their roles and abilities, regardless of how many business units exist or are added in the future.

This is useful for staff who need tenant-wide data visibility but should not be made tenant administrators. To return a user to manual business unit assignment, turn the toggle off — the picker reappears and you can assign specific units.

Deactivating a User

To remove a user’s access without permanently deleting their account:

  1. Find the user in the People sub-tab list.
  2. Open their record and set their status to Deleted.
  3. Save your changes. The user disappears from the default list and will no longer be able to sign in.

You can reactivate the user later by turning on Show deactivated users, opening their record, and setting their status back to Active.