Role-Based Access Control

Role-based access control (RBAC) gives every team member access to the features and data they need, and nothing more.

DPC Pro assigns permissions based on roles rather than individual user settings. Each team member is assigned one role per organization, and that role determines what they can view, create, edit, and delete across the platform. This approach reduces configuration overhead, maintains consistent access boundaries, and helps your practice meet HIPAA access-control requirements.

For step-by-step instructions on assigning roles to team members, see the Staff Roles and Permissions page.

---

How RBAC Works

Every team member in DPC Pro has exactly one role within each organization they belong to. The role is assigned when the account is created or when the team member is invited, and it can be changed at any time by an Owner or Administrator.

The access-control flow:

1. A team member logs in and selects their organization.
2. DPC Pro looks up the role assigned to that team member for that organization.
3. On every page and action, DPC Pro checks whether the assigned role has the required permission.
4. If the permission is granted, the action proceeds. If not, the team member sees an access-denied message.

Roles are evaluated in real time. If a team member’s role is changed, the new permissions take effect on their next page load. No logout or session restart is needed.

One role per organization

Each team member has one role per organization. If a team member belongs to multiple organizations (for example, a provider who works at two practices), they may have different roles in each.

---

Permission Matrix

DPC Pro includes the following built-in roles. Each role grants a progressively broader set of permissions.

Capability	Viewer	Staff	Billing Specialist	Administrator	Owner
View dashboard	Yes	Yes	Yes	Yes	Yes
View patient records	Yes	Yes	Yes	Yes	Yes
Create and edit patient records	—	Yes	—	Yes	Yes
View clinical notes	—	Yes	—	Yes	Yes
Create and sign clinical notes	—	Yes	—	Yes	Yes
View billing and memberships	—	—	Yes	Yes	Yes
Manage billing and payments	—	—	Yes	Yes	Yes
Send messages to patients	—	Yes	—	Yes	Yes
View schedule	Yes	Yes	Yes	Yes	Yes
Manage schedule and appointments	—	Yes	—	Yes	Yes
View reports	—	—	Yes	Yes	Yes
Manage team members	—	—	—	Yes	Yes
Configure practice settings	—	—	—	Yes	Yes
View audit logs	—	—	—	Yes	Yes
Manage SSO and security settings	—	—	—	—	Yes
Transfer or delete organization	—	—	—	—	Yes

Customer role

DPC Pro also includes a Customer role for patient portal users. Customers can access their own records, memberships, messages, and appointments through the patient portal but cannot access the staff application.

---

Principle of Least Privilege

The principle of least privilege means granting each team member only the access they need to perform their job, and nothing more. This is both a security best practice and a HIPAA requirement for access to protected health information (PHI).

Practical guidance for your practice:

• Front desk staff who schedule appointments and check patients in should have the Staff role.
• Billing team members who manage memberships and payments but do not handle clinical records should have the Billing Specialist role.
• Clinicians who need access to clinical notes and patient care should have the Staff role.
• Practice managers who configure settings and manage team members should have the Administrator role.
• Practice owners who need full control, including security settings and data management, should have the Owner role.
• External consultants or part-time support staff who need read-only access should have the Viewer role.

Review roles periodically

When a team member changes responsibilities, update their role to match their new duties. Regular role reviews help prevent permission creep, where users accumulate access beyond what they need.

---

Access Denied Scenarios

When a team member attempts to access a feature or perform an action outside their role’s permissions, DPC Pro handles it in one of two ways:

• Hidden navigation: menu items and buttons for features the team member cannot access are not displayed. For example, a Viewer does not see the Settings menu item.
• Access denied page: if a team member navigates directly to a restricted URL (for example, by using a bookmarked link), they see a message explaining that they do not have permission to access the requested page.

If a team member receives an access-denied error for something they need to do, they should contact their practice manager or administrator to request a role change.

Feature toggles

In addition to role-based permissions, some features in DPC Pro can be enabled or disabled at the organization level (for example, clinical notes, scheduling, billing, messaging, or the AI assistant). If a feature is disabled for your organization, it is unavailable to all roles.

---

Auditing Access

DPC Pro maintains a complete activity log of who accessed what, when, and from where. This audit trail is essential for HIPAA compliance and for investigating security concerns.

What is recorded in the activity log:

• Every login attempt (successful and failed), including the team member’s email, IP address, and timestamp
• Every action taken on patient records, including views, edits, exports, downloads, and prints
• Changes to team member roles and permissions
• Changes to practice settings and configurations

Administrators and Owners can access the audit log from Settings —> Audit Log. For detailed information about the activity log, including how to search, filter, and export log entries, see Audit Logging.

Regular access reviews

Schedule periodic reviews of the audit log to confirm that access patterns match expected job duties. DPC Pro’s patient access report shows which team members accessed which patient records over a given time period.

---

Related Pages

• Your Account and Login
• Single Sign-On
• HIPAA Compliance and Data Protection
• Audit Logging
• Data Ownership and Portability
• Staff Roles and Permissions

Need Help?

If you have questions about access control, reach out to the DPC Pro support team at [email protected] or visit the troubleshooting guide.