Permissions

Control who can access what in Praxi with role-based access control (RBAC). Assign roles to team members and customise permissions as needed.

Overview

Praxi uses a hierarchical permission system:

Level	Description
Roles	Predefined sets of permissions
Permissions	Individual access rights
Scopes	Own records, team records, all records

Default Roles

Praxi includes twelve default roles, each with a priority level that determines hierarchy. Higher levels can manage lower levels.

Role	Code	Level	Category
Practice Owner	practice_owner	100	Admin
Clinical Supervisor	supervisor	80	Clinical
Clinical Governance	clinical_governance	75	Clinical
Practice Manager	practice_manager	70	Admin
EAP Administrator	eap_administrator	70	Admin
Behaviour Support Practitioner	behaviour_support_practitioner	65	Clinical
Practitioner	practitioner	60	Clinical
EAP Coordinator	eap_coordinator	60	Clinical
Intern/Registrar	intern	50	Clinical
Receptionist	receptionist	40	Support
Accountant	accountant	25	External
External Referrer	external_referrer	20	External

Practice Owner

Full administrative access to all features. Level 100.

Area	Permissions
Clients	Create, read, update, delete all
Appointments	Full access
Clinical notes	Write own (org-wide read is NOT granted by ownership -- clinical access follows need-to-know)
Billing	Full access
Settings	Full access
Team	Full access
Reports	All reports

Clinical Supervisor

Oversight of supervised practitioners plus own clinical work. Level 80.

Area	Permissions
Clients	Read all, write assigned
Appointments	Team view, manage own
Clinical notes	Read/review supervisee notes
Billing	View team, manage own
Settings	View only
Team	View supervisees
Reports	Team reports

Practice Manager

Administrative management without full clinical access. Level 70.

Area	Permissions
Clients	Read all, update contact details
Appointments	Full booking access
Clinical notes	No access
Billing	Full financial access
Settings	Administrative settings
Team	Manage team members
Reports	All administrative reports

Practitioner

Standard clinical practitioner access. Level 60.

Area	Permissions
Clients	Own clients only
Appointments	Own appointments
Clinical notes	Own notes only
Billing	View own, create invoices
Settings	Personal settings only
Team	View colleagues
Reports	Own reports

Intern/Registrar

Supervised practitioner with limited access. Level 50.

Area	Permissions
Clients	Assigned clients only
Appointments	Own appointments
Clinical notes	Create drafts (supervisor signs)
Billing	View only
Settings	Personal settings only
Team	View supervisor
Reports	Own activity

Receptionist

Front-desk and administrative access. Level 40.

Area	Permissions
Clients	Create, read, update contact details
Appointments	Full booking access
Clinical notes	No access
Billing	Take payments, basic invoicing
Settings	Booking settings only
Team	View schedules
Reports	Appointment reports

Accountant

Financial access only. Level 25.

Area	Permissions
Clients	View billing details only
Appointments	View for billing purposes
Clinical notes	No access
Billing	Full financial access
Settings	Billing settings
Team	View practitioner billing
Reports	Financial reports

Clinical Governance

Oversight of clinical standards, note quality, and compliance across the practice. Level 75.

Area	Permissions
Clients	Read all client information
Appointments	View all appointments
Clinical notes	Read all notes for quality review
Billing	No access
Settings	Clinical settings
Team	View all practitioners
Reports	Clinical governance reports

EAP Administrator

Manages Employee Assistance Program contracts, allocations, and employer reporting. Level 70.

Area	Permissions
Clients	View EAP client allocation data
Appointments	View EAP-related appointments
Clinical notes	No access
Billing	EAP contract and billing management
Settings	EAP programme settings
Team	Assign practitioners to EAP contracts
Reports	EAP utilisation reports

Behaviour Support Practitioner

NDIS behaviour support plan creation and restricted practices documentation. Level 65.

Area	Permissions
Clients	Own clients and NDIS participants
Appointments	Own appointments
Clinical notes	Own notes plus behaviour support plans
Billing	NDIS claiming for own clients
Settings	Personal settings only
Team	View colleagues
Reports	Own reports and NDIS reporting

EAP Coordinator

Manages EAP referrals, assigns practitioners, and tracks session allocations. Level 60.

Area	Permissions
Clients	View EAP client allocation data
Appointments	Schedule EAP appointments
Clinical notes	No access
Billing	View EAP session tracking
Settings	No access
Team	View practitioners for assignment
Reports	EAP session tracking reports

External Referrer

Limited external access for referral partners. Level 20.

Area	Permissions
Clients	View referred clients status only
Appointments	No access
Clinical notes	No access
Billing	No access
Settings	No access
Team	No access
Reports	Referral reports only

Permission Scopes

Understanding Scopes

Scope	Meaning
Own	Only records created by or assigned to the user
Team	Records for supervised/reporting team members
Organisation	All records in the practice

Scope Examples

Scope	Example
Own	A practitioner viewing their own clients only
Team	A clinical supervisor viewing their supervisees
Organisation	A practice owner or manager viewing all clients

Managing Roles

Viewing Roles

1. Go to Settings → Roles
2. See all roles and their permissions
3. Click role to view details

Creating Custom Roles

1. Go to Settings → Roles
2. Click Create Role
3. Enter:
   • Role name and code
   • Description
   • Priority level
4. Add permissions individually
5. Save role

You cannot create a custom role with a priority level equal to or higher

than your own role. For example, a practice manager (level 70) cannot create a role at level 80 or above. :::

Editing Roles

1. Select role to edit
2. Add or remove individual permissions
3. Review changes
4. Save

Default Roles System-defined roles (Practice Owner, Practitioner,

etc.) cannot have their permissions modified or be deleted. Create custom roles for specific needs. :::

Time-Limited Role Assignments

Roles can be assigned with an optional expiry date for temporary access:

1. Assign a user to a role
2. Optionally set an expiry date
3. When the expiry date passes, the assignment is automatically revoked
4. View expiring assignments at Settings → Roles

This is useful for:

• Locum or sessional practitioners with fixed-term contracts
• Temporary elevated access during staff absences
• Intern rotations with defined end dates

Permission Categories

Client access

Practitioners and interns can view and manage clients on their own caseload. Clinical supervisors can view all clients assigned to their supervisees. Practice owners, practice managers, and clinical governance can view all client information across the practice. Practice owners and practice managers can also edit, archive, merge, and export client records practice-wide.

Appointment access

Practitioners, interns, and behaviour support practitioners can create and manage their own appointments. Receptionists and practice managers have full booking access across all practitioners. Clinical supervisors can view their team's schedule and manage their own appointments. Practice owners have full access to all appointment management.

Clinical note access

Practitioners, interns, and behaviour support practitioners can create and edit clinical notes for their own clients (interns create drafts; a supervisor countersigns). Clinical supervisors can read and review notes written by their supervisees. Clinical governance can read all notes across the practice for quality review. Practice managers and receptionists have no access to clinical notes.

Billing access

Practitioners can view their own invoices and create invoices for their own clients. Accountants, practice managers, and practice owners have full financial access — viewing all invoices, recording payments, processing refunds, and viewing financial reports. Receptionists can take payments and perform basic invoicing at reception. Clinical governance and clinical roles focused on clinical work have no billing access.

Settings access

Practice owners have full access to all settings. Practice managers can manage administrative settings, team members, integrations, and billing configuration. Clinical supervisors and practitioners can view and update their own personal settings. Receptionists can manage booking settings only.

Assigning Roles

Assigning to Team Members

1. Go to Team → [Member] → Access
2. Select role(s) to assign
3. Configure scope if applicable
4. Save changes
5. User receives updated access immediately

Multiple Roles

Users can have multiple roles:

• Practitioner + Supervisor
• Receptionist + Bookkeeper
• Permissions combine (most permissive wins)

Role Inheritance

Role	Inherits From
Practice Owner	None (full access)
Supervisor	Practitioner + supervision
Practice Manager	Administrative management
Practitioner	Base clinical access
Intern	Limited practitioner
Receptionist	Administrative only
Accountant	Financial only
External Referrer	Referral access only

Location-Based Access

Restricting by Location

For multi-location practices:

1. Go to Team → [Member] → Locations
2. Select accessible locations
3. User can only see data from assigned locations

Location Permissions

Setting	Effect
All locations	Access entire practice
Specific locations	Access selected only
Primary location	Default view/booking

Sensitive Data Access

PHI Access Levels

Level	Access
Full	All client information
Clinical	Clinical data only
Administrative	Contact/booking only
Billing	Financial data only

Restricting Sensitive Access

For specific sensitive data:

1. Go to Settings → Roles
2. Configure:
   • Mental health notes
   • Drug/alcohol history
   • Violence history
   • Court-related information
3. Set who can access each category

Audit Trail

Permission Changes

All permission changes are logged:

Event	Logged Details
Role assigned	Who, when, by whom
Role removed	Who, when, by whom
Permission changed	Old/new values
Access denied	Attempted action

Viewing Audit Log

1. Go to Settings → Roles
2. Filter by user, date, action
3. Export for compliance

Best Practices

Principle of Least Privilege

Grant minimum permissions needed:

1. Start with restrictive role
2. Add permissions as needed
3. Review periodically
4. Remove unused access

Regular Reviews

Review	Frequency
User access	Monthly
Role definitions	Quarterly
Permission audit	Annually
Terminated users	Immediately

Documentation

Maintain records of:

• Role definitions and rationale
• Special access grants
• Temporary permission changes
• Access review outcomes

Troubleshooting

User Can't Access Feature

1. Check assigned roles
2. Verify permission exists
3. Check scope (own vs any)
4. Verify location access
5. Check for conflicting roles

Permission Not Working

If permission changes don't take effect:

1. User should log out and back in
2. Clear browser cache
3. Verify change was saved
4. Check for overriding restrictions

Locked Out

If accidentally removed access:

1. Another Practice Owner can restore
2. Contact Praxi support for emergency access
3. Always maintain at least 2 Practice Owners

Security Recommendations

1. Review terminated employees - Remove access immediately
2. Use MFA - Require for sensitive access
3. Avoid sharing accounts - Individual logins only
4. Monitor unusual access - Check audit logs
5. Limit Practice Owners - Minimise full-access users
6. Test role changes - Before applying broadly

Related

• Team Management
• Audit Logs
• Organisation Settings
• Compliance Overview

Was this page helpful?