HOW TO: User Permissions - Security Roles & Patient Cohorts

CareHub provides flexible, customizable user permission settings that let your organization control access by role, module, and participant. This article walks through user access levels, roles, cohorts, and security roles, and explains how they work together across CareHub and the Clinical EMR.

These features will be rolled out in discussion with each PACE org July 2026.

🎥 See a full video walkthrough: 

Overview of user permissions in CareHub

CareHub provides four levels of user permissions:

• Access — Privilege set to Org Admin, Standard User, or Read-Only.
• Role — Built-in PACE roles and/or IDT roles.
• Security Roles — Access to modules and actions.
• Cohorts — Participant access, assigned by security role.

---

User access

• Org Admin — Full access to Settings, including managing users, roles, cohorts, and security roles. Module and field level permissions are configurable. 
• Standard User — Access based on assigned permissions.
• Read-Only User — Can view information but cannot make edits.

✅ Note: New users default to Basic access in CareHub.  PACE org is responsible for assigning security roles and patient cohorts as applicable.

---

User roles: primary and secondary

Each user is assigned a primary role and may also have a secondary IDT role if needed.

Examples:

• An RN who also functions as a Home Care Coordinator.
• A staff member with dual responsibilities across teams.

How roles are managed:

• New users added to shared user roster will be assigned a primary IDT role. 
• Org Admins can edit roles in CareHub > Settings > Users > Edit 
  • Update a primary role and, if applicable, a secondary IDT role.

---

Security roles vs. access levels

• Access level determines who can administer settings.
• Security roles determine what users can see and do.

Security roles control:

• Module access and permissions
• Report visibility
• Participant (patient) access
• Special field-level permissions

Security roles are fully customizable and can be combined as needed — though best practice is to limit users to as few roles as possible, since CareHub always grants the highest permission level assigned.

---

Patient cohorts and participant access

If access needs to be restricted to specific participants, patient cohorts must be created first.

Step 1: Create patient cohorts in the Clinical EMR

Patient cohorts begin in the Clinical EMR and control chart access.

1. Navigate to Settings → Admin Users Only → Security & Privacy.
2. Choose a chart access control method:
   • Strict Access Control (recommended): Unauthorized users cannot access charts.
   • Warnings & Optional Bypass (optional): Allows users without temporary access to restricted patient chart (this will be logged for administrator review)

✅ Best practice: Use Strict Access Control.

Step 2: Define cohort criteria using patient tags

Criteria options are limited, so patient tags are recommended.

To create or assign patient tags:

1. Open a participant's chart.
2. Select Edit.
3. Add or update the patient tag.
4. Save changes.

Org Admins control which tags are available.

Step 3: Create user groups

User groups define which users will have access to a cohort.

1. Navigate to Settings → Admin Users → User Groups.
2. Create a group (for example, "IDT Blue").
3. Add users from the active user list.
4. Save.

✅ Tip: Use the same naming for patient tags, user groups, and cohorts to avoid confusion.

Step 4: Create patient cohorts in the Clinical EMR

1. Navigate to Reports → Patient Cohorts.
2. Select Create a Patient Cohort.
3. Choose criteria (recommended: patient tags).
4. Preview participants.
5. Save the cohort.
6. Assign the corresponding user group.

Once created, cohorts automatically update as patients meet the criteria.

---

Creating cohorts in CareHub

After Clinical EMR setup is complete:

1. Navigate to CareHub → Cohorts.
2. Select Actions → Add New Cohort.
3. Name the cohort (match Clinical EMR naming).
4. Optionally add a description.
5. Select participants.
6. Select Add Cohort.

Important notes:

• The user adding participants must have full system access.
• Unlike the Clinical EMR, new participants must be manually added to existing CareHub cohorts.

---

Creating and managing security roles

Step 1: Create a security role

1. Navigate to Settings → Security Roles.
2. Select Add Security Role.
3. Enter a name and description (recommended).
4. Assign users individually or by team.

Step 2: Configure module permissions

All users always have access to:

• Tasks*
• IDT Meeting
• Scheduling

Other modules can be set to one of the following levels:

Permission level	What it allows
None	Module is hidden from the user's navigation.
Read	View only.
Write	Full edit access.
Delete	Full edit access, plus the ability to remove items (highest permission).

Some modules behave differently regardless of the level selected:

Module group	Modules	Available access
Always accessible	Tasks, IDT Meeting, Scheduling	Available to all users; cannot be restricted.
Read-only	Timeline, Conditions, Labs, Vitals	View only; these modules cannot be edited in CareHub.
Configurable	All other modules	None, Read, Write, or Delete.

Assessment permissions

Assessment access combines module-level permissions (None/Read/Write/Delete) with two field-level controls: Edit assessment details and Edit all assessments (without being assigned). Role-based section editing is preserved — users can edit only the sections assigned to their role, and unassigned sections remain read-only unless they have the "edit all assessments" permission.

Action	Read	Write	Delete	Edit assessment details	Edit all assessments (without being assigned) FUTURE RELEASE-Q3 2026
View assessments	✓	✓	✓	—	—
Edit who is assigned to an assessment	—	—	—	✓	✓
Edit sections assigned to the user	—	✓	✓	—	—
Edit sections regardless of assignment	—	—	—	—	✓
Remove Standard Assessment or Status Change Assessment	—	—	✓	—	—

Care Plan permissions

Care Plan access combines module-level permissions (None/Read/Write/Delete) with field-level control: Can change care plan due date. 

Action	Read	Write	Delete	Can change care plan due date
View care plans	✓	✓	✓	—
Edit care plan due date	—	—	✓	✓
Edit care plan	—	✓	✓	—
Remove intervention	—	—	✓	✓

SDR permissions

SDR access is module-level permissions only (None/Read/Write/Delete) 

Action	Read	Write	Delete
Add new SDR	—	✓	✓
View SDR	✓	✓	✓
Edit SDR	✓	✓	✓
Apply SDR Extension	—	✓	✓
Withdraw SDR	—	✓	✓
Remove SDR	—	—	✓

Incident permissions

Incident access is module-level permissions only (None/Read/Write/Delete) 

Action	Read	Write	Delete
Add new incident	—	✓	✓
View Incident	✓	✓	✓
Edit Incident	✓	✓	✓
Delete incident	—	—	✓

Medication Administration permissions

Medication Administration access is module-level permissions (None/Read/Write/Delete) with role-based considerations if Co-Signature applies. 

Action	Read	Write	Delete	Registered Nurse role
View Active Medications	✓	✓	✓	—
View Medication Administration	✓	✓	✓	—
Add Medication to MAR (Routine or PRN)	—	✓	✓	—
Record Medication Administration	—	✓	✓	—
Amend Medication Administration *same day only	—	✓	✓	—
Remove Medication from MAR (Routine or PRN)	—	—	—	—
Record Co-Signature for Medication Administration	—	✓	✓	✓

Grievance permissions

Grievances use a dedicated Grievance Permissions section on the security role, separate from the general module levels above. There are two access levels — Admin and Non-Admin. Tasks associated with grievances follow these same permissions.

Action	Admin	Non-Admin
Create grievances	✓	✓
View / edit grievances they created or are assigned to	✓	✓
View / edit all grievances	✓	—
Resolve, close, withdraw, remove, or restore a grievance	✓	—
View / edit tasks for grievances they created or are assigned to	✓	✓
View / edit tasks for all grievances	✓	—

Non-Admin users cannot see grievances they did not create or are not assigned to, and *tasks tied to grievances outside their scope are hidden from them. Admin users see all grievances and all grievance-related tasks regardless of assignment.

Step 3: Configure report permissions

• Determines which reports appear in the left-hand navigation.
• If all are set to None, the Reports module is hidden.

Step 4: Configure participant access

Options include:

• View All Participants — No restrictions.
• Cohort-Based Access — Limit access to assigned cohorts.
• Individual Participants — Extend access beyond a cohort if needed.

⚠️ Reminder: Clinical EMR permissions must also align.

Step 5: Field-level permissions

Optional permissions are

• Viewing Social Security Numbers- this allows user to view in Participant Profile upon "Edit" action. SSN does not appear in the main view. 
• Deleting tasks - delete a task assigned to themselves or another user. *This permanently removes from the system with no ability to restore or track via change log.
• Changing care plan due dates - with a draft open, update the care plan due date for all users
• Mark participant as test -- option within profile or enrollment to designate participant as test, therefore not including them in any reporting
• edit assessment details - re-assign users who are assigned to complete an In Progress assessment

Select Add Security Role to save.

---

Updating user permissions

User permissions can be updated:

• Through the Security Role
• Directly on an individual user record

Changes take effect immediately.

---

What users experience by role

• Basic (permissions enabled, no security role assigned) — Access only to Tasks, IDT Meeting, and Scheduling.
• Read-Only Role — Can view all modules but cannot edit.
• Cohort-Restricted Role — Can only see participants assigned to their cohort.

If a user lacks chart access in the Clinical EMR, they may see an "Access Not Authorized" message when attempting to open a chart.

---

Best practice recommendations

• Assign only one Security Role per user whenever possible.
• If multiple roles are required, remember that the highest permission always overrides lower permissions.
• Use Delete permissions sparingly due to their broad impact.

---

Frequently Asked Questions

A user can't see a module in their navigation. Why?
If a user has no Read access to a module, that module is hidden entirely. If permissions are enabled and the user has no security role assigned, they will only see Tasks, IDT Meeting, and Scheduling. Assign an appropriate security role to restore access.

A user has two roles with different permission levels for the same module. Which one applies?
The highest permission always wins. CareHub grants the highest level assigned across all of a user's roles, so a permissive secondary role will override a more restrictive primary role. If a user needs limited access, avoid assigning an additional permissive role.

A user sees an "Access Not Authorized" message when opening a participant's chart. What's wrong?
This means the user lacks chart access in the Clinical EMR. CareHub cohort access and Clinical EMR permissions must align — confirm the user belongs to the correct user group and cohort in the Clinical EMR.

I enrolled a new participant, but a cohort-restricted user still can't see them. Why?
In the Clinical EMR, cohorts update automatically as participants meet the criteria. In CareHub, new participants must be manually added to existing cohorts. Add the participant to the relevant CareHub cohort to grant access.

How do I give a user access to only a specific group of participants?
Use Cohort-Based Access on the security role and assign the appropriate cohort. If a user needs access to a few participants beyond their cohort, use the Individual Participants option to extend access.

A user needs to view Social Security Numbers or delete tasks. How do I enable that?
These are field-level permissions configured on the security role (Step 5). Field-level permissions also include changing care plan due dates. Enable the specific permission the user needs on their assigned role.

Why can't a Read-Only user edit anything?
A Read-Only role allows the user to view all modules they have access to but not make edits. To allow editing, assign a security role with Write (or Delete) permissions for the relevant modules.

Do permission changes take effect right away?
Yes. Changes made through a security role or directly on a user record take effect immediately.

Need help?

If you have questions about user permissions:

• Pre–Go Live: Discuss with your Implementation Consultant or Training Consultant.
• Post–Go Live: Submit a Support ticket.

Updated July 7, 2026