Roles that match the job
Owner, Admin, Clinician and Staff, each with a fixed set of permissions that Ona checks on every request. Combine roles for the doctor who also runs the practice. Only an owner can hand over ownership.
Team & Security
Roles, access and security for your whole practice
Ona's team and security tools decide who sees what in your practice. Owners, admins, clinicians and staff each get a fixed set of permissions, every chart view and change is recorded in an activity log, and two-step sign-in, automatic sign-out and a signed BAA protect patient data. Timesheets and locations keep the team itself organized.
- Four roles, combinable
- Activity log of chart access
- Two-step verification
- BAA signed at sign-up
Ona Team & Security is the access control and team administration built into Ona, the AI-native practice management platform. Roles decide what each person can open and change. An activity log records who viewed or changed each patient's record, and sign-in protection keeps every account its owner's own. Owners and admins manage it all in Settings.
It's built for practices growing past one clinician: a front desk that shouldn't see settings, a second site with its own rooms and hours, a team whose hours need to reach payroll. Every practice signs Ona's BAA when the workspace is created, and patient data is encrypted in transit and at rest.
01 · Why it matters
Access is part of running a safe practice.
Who can open a chart, export a record or change a setting isn't an IT afterthought. It's part of patient care.
Across a patchwork of tools, access drifts: a shared front-desk login, a former employee who still knows the password, no way to tell who opened which chart.
Ona keeps it in one place. Each person signs in as themselves, their role decides what they see, and the record of what they did stays with the patient.
02 · What you get
Who sees what, and proof of it.
An activity log of chart access
See who opened, searched, exported, signed or changed patient records, by teammate and date range, or on one patient's chart. Search terms and changed values are never stored in the log.
Sign-in that holds up
Two-step verification with an authenticator app, passwords of at least 12 characters, and sign-in with email, Google or Apple. After an hour without activity, Ona signs you out, with a warning first.
Invitations, not shared logins
Invite by email with the roles already set and an expiry you choose. Resend or copy the link, and someone who signs up with the invited, verified email joins automatically.
Timesheets
Teammates clock in and out from the account menu, on a computer or a phone. Admins see every shift with hourly rates and amounts, edits are flagged and kept in history, and the period exports to Excel or CSV.
Locations and rooms
Set up sites with rooms, each with its own hours and booking rules, plus the facility NPI that goes on claims. The team calendar shows the day by clinician or by location.
03 · How it works
Setting up your team.
Invite your team
In Settings → Team Members, invite each person by email with their roles. They join when they accept, or when they sign up with the same verified email.Fill in provider details
Clinicians add their credentials, NPI (checked against the national registry), taxonomy codes and signature, used on claims, letters and signed documents.Turn on two-step verification
Each person sets it up in Settings → Security with an authenticator app. If someone loses their phone, an owner or admin resets it, which signs them out everywhere.Add your locations
Create sites and rooms in Settings → Locations with their own hours, so online booking only offers times when the location and the clinician are both available.Review the activity log
Owners and admins open Settings → Activity Log, or a patient's Record activity panel, whenever they need to know who saw what.
04 · In practice
Run the team, not the passwords.
Practice owner
A front desk without the keys to Settings.
Staff run the schedule, patients and payments. Settings, the team list and the activity log stay with owners and admins.
Group practice
Two sites, one system.
Each site has its own rooms and hours, the calendar switches between clinicians and locations, and claims carry the right facility NPI.
Practice manager
Payroll from the timesheet.
Shifts, breaks and edits in one view, hourly rates applied, and the period exported to Excel for payroll.
Behavioral health
Who saw this chart?
When a patient asks, open their Record activity panel and see which teammates viewed or changed their record, and when.
FAQ
Common questions.
What user roles does Ona have?
Four: Owner, Admin, Clinician and Staff, and one person can hold several. Owners and admins manage settings and the team. Staff work across patients, scheduling, billing and operations. Clinicians work with their patients and visits and sign clinical documents. Each role has a fixed set of permissions; custom roles aren't available.
Can I see who accessed a patient's chart?
Yes. Owners and admins have an Activity Log in Settings showing who opened, searched, exported, signed or changed patient records, filtered by teammate and by the last 7, 30 or 90 days. Each chart also has a Record activity panel. The log can't be exported today.
Does Ona support two-step verification?
Yes, with an authenticator app. Each person turns it on in Settings → Security; it can't be required for the whole practice today. An owner or admin can reset it for a teammate who loses their device, which signs them out everywhere and emails them.
Does Ona sign a BAA?
Yes. Every practice signs Ona's BAA when the workspace is created, and Ona keeps a record of who signed it and when. Patient data is encrypted in transit and at rest, and access is limited by role.
Does Ona sign people out automatically?
Yes. After an hour without activity, Ona signs you out, with a warning five minutes before.
Does Ona support single sign-on?
You can sign in with Google or Apple, or with email and a password. SAML single sign-on through an identity provider such as Okta or Microsoft Entra isn't available today.
Can Ona track staff hours?
Yes, with Timesheets. Turn it on in Settings → Timesheets and set your unpaid-break rule. Teammates clock in and out from the account menu, including on a phone, and admins see every shift with hourly rates and amounts and export to Excel or CSV. There is no approval step.
Does Ona work for practices with several locations?
Yes. Add sites and rooms in Settings → Locations, each with its own hours, booking rules and facility NPI for claims. All sites share the practice's time zone.
Ready when you are
Know who sees what.
Walk through roles, the activity log and two-step sign-in in a short call.