> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# For practice admins

> Everything a practice admin needs — team setup, permissions, settings, compliance, and audit logs.

<Info>
  If you run the practice or manage billing operations, this is your section. Start here to set up your team and lock in HIPAA-appropriate controls on day one.
</Info>

## First week checklist

<Steps>
  <Step title="Complete the practice profile">
    Name, NPI, Tax ID, specialty, primary payers. [Practice settings →](/admins/practice-settings)
  </Step>

  <Step title="Enforce 2FA for all users">
    Required for anyone who touches PHI. [Two-factor auth →](/admins/two-factor-auth)
  </Step>

  <Step title="Invite your team">
    Add users with the right roles. [Team management →](/admins/team-management)
  </Step>

  <Step title="Configure notifications">
    Slack, email, or in-app for deadlines, outcomes, and HIPAA-relevant events. [Practice settings →](/admins/practice-settings)
  </Step>

  <Step title="Review audit logs">
    Confirm PHI access is recorded as expected. [Audit logs →](/admins/audit-logs)
  </Step>

  <Step title="Request a BAA">
    If you're a covered entity, [request the BAA →](/trust/baa) before sending PHI.
  </Step>
</Steps>

## Roles at a glance

| Role          | Typical user                            | Access                                                      |
| ------------- | --------------------------------------- | ----------------------------------------------------------- |
| `user`        | Billing staff                           | Own work; PHI access within the practice                    |
| `analyst`     | Analytics / reporting                   | Aggregated or anonymized data only                          |
| `support`     | Customer-facing support                 | Read-only PHI, scoped                                       |
| `admin`       | Practice admin                          | Full access within the practice; cannot delete the practice |
| `super_admin` | Denialbase internal (not for customers) | Full platform, heavily audited                              |

## Compliance controls

<CardGroup cols={2}>
  <Card title="2FA enforcement" icon="shield-halved" href="/admins/two-factor-auth">
    Require TOTP or passkeys for everyone. Admins can require it at invite time.
  </Card>

  <Card title="Session policy" icon="clock" href="/admins/practice-settings#sessions">
    Idle timeout, max session duration, concurrent session limits.
  </Card>

  <Card title="Audit log export" icon="file-export" href="/admins/audit-logs#export">
    Download PHI access logs for HIPAA audit purposes.
  </Card>

  <Card title="Data export / deletion" icon="database" href="/admins/practice-settings#data">
    Exports for patient data-access requests; full practice deletion on offboarding.
  </Card>
</CardGroup>