Add and manage staff users

For: Agency Owner · Time: 5 min per user · Frequency: On hire / role change / offboarding

Trigger

You've hired a new credentialing coordinator, promoted a biller to lead, or someone left and you need to revoke their access TODAY.

Outcome

The right people have the right access. New hires can log in. People who left can't. Roles match responsibilities so a junior biller can't accidentally delete a fee schedule.

Where

• Settings → Users — agency-side user management

Steps

Add a user

1. Settings → Users → Invite User. Fill in email, first/last name, role.
2. Pick the right role:
   • agency / owner — full access. Don't give this to anyone you wouldn't trust with the bank account.
   • staff — full read + write on credentialing, RCM, billing. Can't change agency settings, can't manage users, can't see Stripe/secrets.
   • organization — practice-admin role. Only see ONE practice's data (the one they're tied to). Use this for practice owners you're letting log in to see their own claims.
   • provider — read-only on their own provider record + applications. Rarely used.
3. Send invite. The user gets an email with a one-time link to set a password.

Change a role

1. Settings → Users → find the user → Edit.
2. Change role dropdown, Save. Takes effect on their next request — they don't need to re-log in.

Disable / offboard

1. Settings → Users → find the user → Edit → toggle Active = off. They're immediately blocked from new requests; their current session will fail on next API call.
2. For HIPAA compliance, do NOT delete the user — soft-disable. Their audit trail must remain.
3. If they had MFA enabled, Reset MFA so they can't generate new TOTP codes.
4. Force logout — terminates any active session immediately. Use this for departures-under-stress.

Reset password

1. Settings → Users → user → Reset Password. Sends them a new one-time link.
2. Do NOT type a password for them. The platform doesn't let you and that's intentional.

Watch-outs

• Role changes are silent to the user. They don't get notified. If you demote someone, tell them. Otherwise they'll hit "unauthorized" errors and file support tickets.
• The "organization" role REQUIRES a billing_client_id. When you create an organization-role user, you must also tie them to a specific BillingClient — otherwise they have no scope and see nothing. Settings → Users → New → "Tie to client" dropdown.
• Require two-factor authentication. Users set it up in Profile → Security, and owners can require it for the agency in Admin → Settings → Security. For HIPAA compliance, require it for everyone who handles PHI.
• The audit trail. Sign-ins are recorded as authentication events, every create, update and delete is in the audit log, and every view of patient data is in the PHI access log. If you suspect data exfiltration, search Audit by user.
• Don't share logins. Two staff sharing one account = audit logs are useless. Pay the per-user fee — it's cheaper than a compliance investigation.

Related jobs

• Practice Admin → First login — what the organization role sees

Something on this page doesn’t match what you see in the app? Email support@credentik.com and we’ll fix the guide.