Roles and Permissions

Before you start

Each person in your organization has one role. Each role has a set of permissions. A permission lets a person do one thing, for example view patients or invite users.

Kulcare gives each role a set of default permissions. On the Roles & Permissions screen, you can turn a permission on or off for a role.

Owners and admins can open the screen. Only an owner can change it. Admins see it read-only. Other people see "Only owners and admins can view role permissions."
A change applies to every person with that role in your organization.
A change applies to all your facilities. You cannot give a permission for one facility only.
Kulcare checks each action against your settings at once. Other people see their menus and buttons change a short time later. See When others see a change.

The five roles

Role	Who it is for	What you can change
Owner	The people who own the organization. When you sign up with the Facility Owner / Manager card, you become the owner.	Nothing. Owners always have every permission. Nobody can turn off a permission for an owner.
Admin	People who run the practice.	Only an owner can change what admins can do.
Staff	Front desk and support.	Only an owner can change it.
Practitioner	Doctors and other clinicians.	Only an owner can change it.
Marketing	People who run campaigns and follow up leads. They reach the Marketing app and nothing else: no patient record, no bill, no earnings.	Only an owner can change it.

A job title, for example nurse or receptionist, does not change what a person can do. Only the role does.

Some defaults to know

Permission	By default, who has it
Delete care plans, goals, allergies and conditions. Record a medication given to a patient.	Owners and practitioners. An admin can be a person who is not a clinician.
Manage patients assigned to the practitioner. Manage own practitioner appointments.	Practitioners. Owners have it too, because owners have every permission.
Manage users (invite people, see and change their memberships)	Owners and admins.
Manage facilities	Owners and admins.
Change the details of the organization	Owners.

The screen always shows the current state for your organization.

Step 1Open the screen

Account › Organization › Roles & Permissions

The screen shows your apps, one card each: CMS, Marketing, Practice finance, Team and settings, Connect and the Kulcare subscription.

You see only the apps your practice has. If your practice does not have one, the screen leaves it out, because there is nothing to set. Team and settings, Connect and the Kulcare subscription always show. To add an app, speak to Kulcare support.

Inside a card are its areas. An area is one decision you make, for example "Patients and clinical records" or "Payouts". For each area you pick a level for each role: usually None, View or Manage.

You do not set permissions one by one. A level turns on the group of permissions that go together. If you want to see them, open Show every permission at the bottom.

Two cards have no levels. Connect is open to everyone, including vendors and technicians. The Kulcare subscription belongs to the owner alone.

Two areas have no levels either: Payouts and Tax identity. Each is given to a named person rather than to a whole role, because a release of money and a change to your registered legal name are decisions about one person you trust. Use Account › Organization › Users for those.

What "Custom" means

An area shows Custom when the permissions that role holds do not match any single level. That is not an error. It usually means someone set a permission by hand earlier.

Kulcare leaves a Custom area exactly as it is until you pick a level for it. When you do pick one, the screen tells you first what it will take away.

Step 2Find a permission

The permissions are in groups, for example Patients or Care plans. Each group has a heading.

Type a word in Search permissions.
The table shows only permissions whose name or description has that word.
To see all permissions again, clear the search box.

If no permission matches, the screen says "No permissions match" and shows your search word.

Step 3Change what a role can do

You must be an owner to do this step and the steps after it.

Find the app card, then the area inside it.
Find the row of the role.
Select the level you want. The level you pick shows filled in.

Nothing is saved yet. You can set several areas across several roles, then save them together.

If you pick the level a role already has, the change disappears from the count. Kulcare only counts real changes.

Step 4Review, then save

When you change a level, a bar shows at the bottom of the screen. It tells you how many changes are not saved, and across how many roles.

Select Review and save. Kulcare shows you what each role gains and what it loses, before anything is written.
Select Discard to remove all changes that you did not save.

The levels are inactive while the review panel is open and while Kulcare saves. This is on purpose. You approved an exact list of changes, so Kulcare writes that list and nothing else. The levels work again as soon as the save ends. To make a different change, wait for the save, then make it.

Read the "Loses" line

A level is a fixed set of permissions, so a move to one can take access away as well as add it. When a save removes anything, the button says Remove access and save rather than Save changes. That is deliberate: it asks you to decide on purpose.

This matters most for an area showing Custom. Those permissions match no level, so a level you pick replaces them. The review panel lists exactly what goes.

If the save fails

Kulcare saves one role at a time. If a save fails, the screen shows the reason. Roles that Kulcare saved stay saved. Changes for the other roles stay in the bar, so you can try again.

Each save goes into the Audit Trail (Account › Organization › Audit Trail). The record shows who made the change, the role, and the permissions turned on and off. A save that Kulcare refused is also recorded, with the reason.

Step 5See every permission

The levels cover the everyday decisions. When you need the detail, select Show every permission at the bottom of the screen.

The table lists each permission, the area it belongs to, and whether each role has it. It follows any change you have made but not yet saved, so the two views always agree.

This view is read-only. To change what a role can do, use the levels. To change what ONE person can do, use Account › Organization › Users.

What the marks mean

You see	Meaning
Filled level button	The level that role has now.
Custom	The permissions that role holds match no single level. Kulcare leaves them alone until you pick a level.
Open to everyone	The app needs no setting. Connect is open to every member.
Owner only	Only the owner reaches it. No role can be given it here.
Granted to a person, not a role	Payouts and Tax identity are given to one named person, under Users.
Disabled buttons	You cannot change this screen. Only an owner can.

Why only an owner can change permissions

A person who can change this screen can give any role any permission. This includes the permission to cancel the Kulcare plan. So only an owner can change permissions. Admins can see the screen, but they cannot change it. To change a permission, ask an owner.

Who you can invite

Account › Organization › Users

To invite people, you need the Manage users permission. You can invite a role only when both rules are true:

The role does not rank above your own role. Nobody can invite an owner.
You have every permission that the role has in your organization.

In the invite dialog, a role that you cannot invite shows as unavailable, with the reason.

Admins and practitioner invites

By default, an admin cannot invite a practitioner. Practitioners have clinical permissions that admins do not have by default. For example, practitioners can delete clinical records and manage their own patients.

To let this admin invite practitioners, do one of these. An owner invites the practitioner. Or an owner gives the admin each permission that the admin does not have.

Cannot invite with role 'practitioner' -- you lack permissions that role holds: manage_own_patients, ... The list shows the permissions that you do not have. Ask an owner to send the invite.
You do not have permission to manage invites You do not have Manage users. Ask an owner or an admin.

Each invite, and each refused invite, goes into the Audit Trail.

When others see a change

Kulcare applies your change to the next action that each person does. Their menus and buttons update at the first of these times:

when they come back to the Kulcare window or tab;
within 5 minutes, while the Kulcare tab is open;
when Kulcare refuses an action because of a permission.

They do not need to sign out. Your own screen updates after you save.

For a short time, a person can see a button that no longer works for them. If they select it, Kulcare shows "You are not authorized to perform this action". Their screen then updates, and the button goes away.

"Could not check your permissions. Retrying."

This notice shows at the bottom of the screen when Kulcare cannot get your permissions. The cause is usually the network or a short system problem.

While the notice shows, Kulcare hides the buttons that need a permission. Your account and your data do not change.
Kulcare tries again when you come back to the tab, and every 5 minutes. The notice goes away when it succeeds.
If the notice stays, check your internet connection and reload the page. If it still stays, contact Kulcare support.

Sign-in email and phone

Your sign-in email and phone sign you in to every organization that you belong to. So an owner or an admin cannot change the email or phone of another person. Each person changes their own.

Use the Sign-in email field on your profile. It shows in the profile step when you join Kulcare, and on your vendor profile in Connect.

Select Change email.
Type your new email in New email.
If Kulcare asks for it, type your Current password.
Select Send code. Kulcare sends a code to your NEW email.
Type the code in Code, and select Confirm.

The change applies only after the code matches. A wrong or expired code changes nothing. After the change:

Kulcare signs you out on your other devices.
Kulcare sends a notice to your old email or phone.
The change goes into the Audit Trail.

To change your sign-in phone, contact Kulcare support.

Admins can always see this screen

Every admin can open Roles & Permissions and see every column. An admin cannot change any column. Only an owner can. This stays true when you turn off Manage users for admins. After that change, admins cannot invite people or manage users. They can still see this screen.

To take this screen away from one person, that person must not be an admin. The app has no screen to change the role of a current member. Contact Kulcare support to change the role.

You signed up as the owner, but every column is locked

Before a recent fix, sign-up with the Facility Owner / Manager card made you an admin, not the owner. An admin cannot change this screen.

If you are the only person in your organization, Kulcare already made you the owner. Sign out and sign in again.
If you already invited other people, contact Kulcare support. Support can make you the owner.