Roles & Permissions
All Users·6 min read·Updated May 2026
CareIncite uses role-based access to control what each team member can see and do within the platform. Roles are assigned during the invitation process and can be changed at any time by a Practice Owner. Every role enforces tenant isolation at the database level — there is no way to access data outside your assigned scope.
Permissions Matrix
| Feature | Owner | Admin | Supervisor | Provider | Billing | Regional | Client | View-Only |
|---|---|---|---|---|---|---|---|---|
| Dashboard | Read/Write | Read/Write | Read | Read | Read | Read | — | Read |
| Clients | Read/Write | Read/Write | Read/Write | — | — | — | — | Read |
| Eligibility | Read/Write | Read/Write | Read/Write | — | Read | — | — | Read |
| Caseload | Read/Write | Read/Write | Read/Write | Read | — | — | — | Read |
| Weekly Billing | Read/Write | Read/Write | — | — | Read | Read | — | Read |
| Staff | Read/Write | Read/Write | Read | — | — | — | — | Read |
| Timesheets | Read/Write | Read/Write | Read | Read | — | — | — | — |
| Reports | Read/Write | Read/Write | — | — | Read | — | — | Read |
| Goals | Read/Write | Read/Write | — | — | — | — | — | Read |
| Settings | Read/Write | Read/Write | — | — | — | — | — | — |
| Client Portal | Read/Write | Read/Write | — | — | — | — | Read/Write | — |
Role Details
Practice Owner (CEO)
What they see
Full visibility into all locations, all providers, all revenue data, all alerts, and all historical trends. The Practice Owner dashboard is the most comprehensive view in CareIncite.
What they can do
Create and manage locations. Add and remove providers. Set practice-wide and provider-level billing targets. Configure billing alerts. Invite and manage team members. Connect and manage integrations including Notenetic. Export data and reports. Generate and schedule reports. Manage the client portal. Upgrade or change the practice tier.
Cannot access
There are no restrictions for this role. Practice Owners have unrestricted access to every feature and data point in CareIncite.
How assigned
The person who creates the CareIncite account is automatically assigned the Practice Owner role. Additional Practice Owners can be designated from Settings by an existing Practice Owner.
Executive Administrator
What they see
All locations, all providers, revenue data, billing alerts, eligibility status, and historical trends. The Executive Administrator view is nearly identical to the Practice Owner view.
What they can do
Monitor provider output and billing performance. Configure and manage billing alerts. Add and edit providers. Update billing targets. Invite team members with Provider, Supervisor, or View-Only roles. Trigger manual data syncs. Generate and schedule reports. Manage client pool and workload assignments.
Cannot access
Cannot change the practice tier. Cannot remove the Practice Owner. Cannot delete the practice account. Cannot manage billing or subscription settings.
How assigned
Assigned by a Practice Owner when inviting a team member. Select the Executive Administrator role from the role dropdown during the invitation process.
Supervisor
What they see
Dashboard, client data, timesheets, staff performance, and caseload information for their assigned team. Supervisors see a team-scoped view rather than practice-wide data.
What they can do
View and manage clients assigned to their team. Review timesheets for supervised staff. Monitor caseload distribution within their team. Access staff performance metrics for their direct reports.
Cannot access
Cannot see providers outside their supervised team. Cannot access practice-wide financial data. Cannot manage billing targets, alerts, or integrations. Cannot invite team members or change roles.
How assigned
Assigned by a Practice Owner or Executive Administrator. When creating a Supervisor, you assign which providers they oversee.
Provider
What they see
Only their own billing data: their weekly, monthly, and annual billing totals, their targets, and their personal performance trends. Providers see a simplified dashboard focused entirely on their individual output.
What they can do
View their own billing history and performance trends. See their current billing target and how they are tracking against it. Access their own performance data across time periods. View their caseload.
Cannot access
Cannot see other providers’ billing data. Cannot see practice-wide revenue totals. Cannot access location comparison views. Cannot manage alerts, targets, team members, or settings. Cannot view any administrative features.
How assigned
Assigned by a Practice Owner or Executive Administrator when inviting a team member. Select the Provider role and assign the user to a specific provider profile in the system.
Billing Lead
What they see
All billing-related data including weekly billing performance, eligibility status, session details, revenue breakdowns, and payer-level data. Billing Leads have deep access to financial data without administrative privileges.
What they can do
Monitor billing performance across all providers. Review eligibility status and sessions at risk. Generate and schedule billing-related reports. Access denial management workflows. View payer mix and efficiency metrics.
Cannot access
Cannot manage team members or roles. Cannot access HR-related data like timesheets or incidents. Cannot modify practice settings or integrations. Cannot manage the client portal.
How assigned
Assigned by a Practice Owner or Executive Administrator. Ideal for dedicated billing staff or external billing consultants who need financial visibility without operational access.
Regional Manager
What they see
All locations assigned to their region, all providers within those locations, and comparative performance data across their assigned sites. The Regional Manager dashboard includes a location comparison view by default.
What they can do
Compare revenue performance across their assigned locations. View provider-level data within their locations. Monitor location-specific targets and identify underperforming sites. Access alert data for their assigned locations.
Cannot access
Cannot see locations outside their assigned region. Cannot change practice-wide settings. Cannot manage the Notenetic integration. Cannot invite or remove team members. Cannot modify billing targets at the practice level.
How assigned
Available only on the Multi-Site tier. Assigned by a Practice Owner or Executive Administrator. When inviting a Regional Manager, you must select which locations they will oversee.
Client
What they see
A personal portal showing their upcoming appointments, shared resources from their provider, and their account details. Clients see only their own information in a trauma-informed, simplified interface.
What they can do
View upcoming and past appointments. Access resources shared by their care team. Update their own account details and contact information.
Cannot access
Cannot see any practice data, billing information, or other client records. Cannot access any administrative features. The client portal is completely isolated from the practice management side.
How assigned
Clients are invited through the client portal management interface. A Practice Owner or Executive Administrator sends an invitation email, and the client creates their own account.
View-Only
What they see
A read-only version of the Practice Owner dashboard. View-Only users can see all locations, providers, and revenue data but cannot make changes to any configuration or settings.
What they can do
View billing performance dashboards. View provider performance data. View location comparisons. View alert history. Export reports for their own records.
Cannot access
Cannot add or edit providers. Cannot modify billing targets. Cannot configure alerts. Cannot manage team members. Cannot access any settings or integrations. Cannot trigger data syncs.
How assigned
Assigned by a Practice Owner or Executive Administrator. Useful for board members, investors, consultants, or other stakeholders who need visibility without the ability to modify configurations.
Tenant Isolation
CareIncite enforces data isolation at the database level using Row-Level Security (RLS). Every query is scoped to the user's account and role. There is no application-layer workaround that could expose data across organizations. This architecture is a core requirement for HIPAA compliance.
Was this helpful?
Next Steps