Account, team, and security
Team accounts and sign-in problems
What a practice owner controls about team accounts (invitations, supervision, release), how roles work, and what to do about an expired password, a lockout, or a lost authenticator.
What the owner controls
Patients > Providers lists every provider in the practice with their specialty, credentialing status, and supervision. From here you invite a provider (Invite your team), set a supervising provider for an assistant, and release someone who leaves.
Roles
- Owner: the account that created the practice; billing, plan changes, practice export, and team invitations.
- Admin: practice settings, billing, and every clinical surface.
- Staff: scheduling, patient records, and billing queues without administrative settings.
- Provider: clinical documentation plus their own schedule and billing work; assistants carry a supervising provider.
Sign-in problems
- “Your password has expired.” Passwords expire after 90 days by default. Use Forgot password on the sign-in card; the reset restarts the clock.
- Locked out. Too many failed attempts lock the account for a period; it unlocks on its own.
- Lost authenticator. Sign in with a backup code, or open a support ticket; support resets 2FA and the user sets it up again at the next sign-in.
- Still blocked. Open a support ticket from Settings > Support. Sefton support sees Password expired and Locked out on its console and can clear the block with an audited reason; it never touches the password itself.
Every sign-in is its own session
Signing out ends only that session, so a colleague signed in as the same account elsewhere is not affected. Sessions idle out after inactivity.
Frequently asked questions
Can I see a team member's password or set a temporary one?
No. Passwords are never visible to anyone, including Sefton. A team member resets their own password with Forgot password; support can clear an expiry or lockout block but never sets a password.
A therapist left. How do I remove their access?
Release them from the practice on their Providers page. Their sessions end at once; their notes, claims, and audit entries stay attributed to them.