Troubleshooting Roles & Permissions in Elation EHR (Premium)

​

What this article covers

• A user cannot take an action they could take before, or a button has disappeared.
• The Enforce permissions switch is grayed out.
• A role change does not seem to have taken effect.
• A user still cannot delete something even though their role grants it.

Not covered here:

• Sign-in failures and account lockouts. See Troubleshooting account login issues.
• Chart access limited by patient criteria. See Restricting access to patient charts based on patient criteria.

​

How to recognize a permissions problem

Roles & Permissions blocks an action in one of two ways:

• The control is not there. Elation hides most buttons and chart sections a user cannot use, so the user reports something “missing” rather than blocked.
• A message appears: “You do not have permission to perform this action. Contact your practice administrator.”

Both mean the same thing: Enforce permissions is on for your practice and no role reaching that user grants the permission at the level the action needs. Only a practice administrator can change that, from Settings > Roles & Permissions.

​

Quick fixes checklist

1. Confirm enforcement is on. If Enforce permissions is off, roles are not what is blocking the action.
2. Look the user up in Show Users, on the Permission Enforcement card. Their row lists every permission they have, the level, and the role and group it came from — which usually settles whether the role is the problem in one step.
3. Check whether the user is in any group that has a role. A user with no role is blocked from every action a permission controls.
4. Open the role and check the permission’s level. For any action-named permission — deleting, signing, merging — Full is the only level that grants it.
5. Ask the user to reload the page. A permission change takes a few moments to reach a session that is already open.
6. Confirm the group still exists. Deleting a user group removes the role from its former members.

​

The user has no role

The line under Enforce permissions reports how many users get permissions from a role and how many have none. Click Show Users and search for the person: a row reading 0 permissions confirms that no role reaches them. The confirmation dialog you see when you turn on Enforce permissions also names the users with no role. To fix it:

1. Open Settings > User Groups and add the user to a group.
2. Open Settings > Roles & Permissions and confirm a role is assigned to that group.

​

The Enforce permissions switch is grayed out

Elation blocks the switch until at least one role applies to a group that has members. The message under the switch reads: “Assign a role to a group with members before turning this on.” This protects you from a practice-wide lockout — with no role reaching anybody, enforcing would deny everyone. To clear it:

1. Confirm you have a user group with at least one member under Settings > User Groups. Ideally, every active user is in a group with a role.
2. Open a role and select that group in Assigned Groups, then click Save.
3. Return to the role list. The switch is now available.

​

An administrator is blocked

Practice administrators are not exempt from Roles & Permissions. An administrator without a role that grants a permission is blocked from that action. Give administrators a role that grants what they need. Practice administrators can always open Settings > Roles & Permissions regardless of their permissions, so this cannot lock you out of correcting it.

​

A role change has not taken effect

Permission changes reach users within moments, but not instantly. A page that is already open keeps the permissions it loaded with.

1. Ask the user to reload the page.
2. If the change still has not appeared, ask them to sign out and sign back in.
3. Re-open the role and confirm the change saved. Look for the confirmation — “Role saved.” — or check that the role list summary shows the group and permission counts you expect.
4. Click Show Users and open the user’s row. If the permission is listed there at the level you expect, the change has been applied and the user’s session is stale; if it is missing, the role is not reaching them.

​

A user still cannot delete something

Open the user’s row in Show Users and check the matching delete permission. Full is the only level that allows a deletion, and a permission missing from their row means no role grants it at all. Check the row rather than a single role, so every role the user is assigned is accounted for. Deletion of letters, referrals, orders that are not reports, and anything else absent from the permission list is not governed by Roles & Permissions at all. If a role grants the permission at Full and the deletion is still blocked, check whether your practice uses standard or strict delete permissions. That separate Premium EHR feature limits deletion by account level and applies in addition to Roles & Permissions, so a role granting Full does not override it. For example, under the standard tier a staff user can delete only unsigned documents they created themselves, even when a role grants the matching Delete permission at Full. The exception is an unsigned report that arrived from a lab interface, such as an incoming lab result: a user with Delete Reports and Orders at Full can delete it even though they did not create it. Reports created through the Elation API are not covered by this exception. If neither feature explains the block, contact Elation Support.

​

A staff user has a permission but still cannot perform the action

This is expected for permissions marked Provider users only in the role form. Only provider-level users can perform these actions, and a permission cannot grant an action that a user’s account level does not allow. For example, Sign Visit Notes controls which providers can sign visit notes. It has no effect for staff-level users, even at Full. If a staff member needs a note finalized, a provider signs it. See Provider vs staff level account privileges.

​

Safe alternative workflows

While you sort out a role:

• Hand the task to someone who has the permission. This is the intended path, and it is faster than editing roles under pressure.
• Grant the permission to a group the user is already in. Permissions combine and users are granted the highest level of a permission from across all their assigned roles, so adding a grant takes effect without unpicking other roles.
• Turn Enforce permissions off. If the problem affects many people at once, switch Enforce permissions off. Everyone keeps their roles and nothing is restricted until you switch it back on. Use this as a circuit breaker, not a long-term state.

​

When to contact Elation Support

Contact Support if:

• Roles & Permissions does not appear under Settings and you want the feature enabled. It is an Elation Premium EHR feature.
• Roles or the enforcement setting fail to load, and reloading the page does not fix it.
• A user is blocked from an action that no permission in the permission list covers.
• A change saves successfully but never reaches users after repeated sign-outs.

Include:

• Your practice name.
• The name of the affected user and the role and groups they should be getting.
• The exact action that was blocked, and the message shown.
• The date and time it happened.

​

Related Articles

• Roles & Permissions Introduction
• Roles & Permissions Guide — Creating roles and enforcing permissions
• Troubleshooting account login issues
• Administrative privileges