Access roles

What each person can see and do in Meddesk depends on their roles. A role is a named set of permissions, such as “Read patient profiles” or “Create appointments”. You give each staff member one or more roles in Staff access, and they get every permission from all of their roles combined.

You need the System administrator permission to manage roles. Open Configuration › Access Roles.

The roles your clinic starts with

Every clinic starts with these roles. You can change or delete them like any other role.

Role	Meant for	Starts with
Doctor	Medical staff with patient access	List, read, create and update patients · list staff · read, create and update appointments · assignable to appointments
Nurse	Medical support staff	List, read and update patients · list staff · read appointments · assignable to appointments
Receptionist	Front desk operations	List, read, create and update patients · list staff · read, create and manage appointments · read and update accounts
Manager	Administrative manager	List, read, create and update staff · list, read, create and update patients · read, create and update appointments · read, create, update and delete accounts · manage patient portal users · reset patients’ passwords · approve appointment requests · create, edit and share reports · create, edit and share dashboards · system administrator

Modules add their own suggested permissions to these roles when your clinic is set up. Each module’s page lists them.

The Super Administrator role

There is also a Super Administrator role. It always has every permission, including those of every module that’s turned on, and it can’t be edited, deleted or picked here, so it doesn’t appear in this list. Only the Meddesk platform team can give it to someone.

Create a role

1. Select New role.
2. Under Basic details, enter a Name (required), for example “Front Desk Coordinator”, and optionally a Description of what the role is for.
3. Under Permissions, open each category and tick the permissions this role should have. Each category shows how many of its permissions are ticked, and the top shows the total, for example “5 of 31 selected”.
4. Select Create role.

You see Role created. The new role now appears in the role list, and you can give it to staff in Staff access.

Permissions are grouped into categories: Accounts, Appointments, Dashboard, Patient portal, Patients, Reports, Staff and System, plus one category for each module your clinic has turned on. For what each permission allows, see the Permissions reference.

Role names in several languages

If your clinic uses more than one language, the Basic details section has an Editing language switcher. Pick a language to type the role’s name and description in it. The default language is required, and the other languages are optional. The switcher shows a check mark for languages that are complete.

Edit a role

1. In the role list, open a role’s menu (the … button) and select Edit.
2. Change the name, description or permissions.
3. Select Save role.

You see Role updated. Everyone who holds the role gets the new permissions straight away.

Delete a role

1. Open the role’s menu and select Delete.
2. Confirm with Yes, delete.

You can only delete a role that no one holds. If someone still has it, Meddesk refuses with a message such as Cannot delete a role assigned to 2 staff members - reassign them first. Remove the role from them in Staff access first.

Require two-factor authentication

At the top of Access Roles, the Security policy card has one switch: Require two-factor authentication for all staff.

Turning it on:

1. Switch it on.
2. Read the warning and confirm with Yes, require it.

From that moment, every staff member who hasn’t set up two-factor authentication is blocked from the app until they do. This applies even to people who are signed in right now. The next time they do anything, they’re sent to Set up two-factor authentication. See Two-factor authentication. While it’s required, nobody can turn their own two-factor authentication off.

Turning it off:

1. Switch it off.
2. Confirm with Yes, stop requiring it.

Staff who already use two-factor authentication keep it. Nobody is forced to set it up any more.