Skip to main content

​
Overview

The Auditor role gives a user read-only access to all compliance data for a single facility — inspection records, violations, incidents, documents, training logs, assessments, and medication records — without the ability to create, edit, or delete anything. This role is designed for external compliance consultants, state inspectors reviewing historical records with your cooperation, or internal quality-assurance reviewers who should not modify live data.

​
What an Auditor can do

  • View all compliance records across every module
  • Download documents, reports, and version history
  • Export HHSC report PDFs
  • View resident assessments and care plans
  • Review staff training records and background check status

​
What an Auditor cannot do

  • Create or edit residents, staff, incidents, violations, or inspections
  • Upload documents or new document versions
  • Log medications or training completions
  • Invite other users or change facility settings
  • Access billing or trust ledger write operations

​
Inviting an Auditor

  1. Go to Settings → Team (Administrator role required).
  2. Click Invite team member.
  3. Enter the reviewer’s email address.
  4. Select Auditor (read-only) from the role dropdown.
  5. Click Send invitation.
The invited user receives an email with a link to create their account. They will see a Read-Only Access banner in the sidebar so their role is always visible.

​
Revoking access

To remove an auditor’s access, go to Settings → Team, find the user, and deactivate their account. Access is revoked immediately upon deactivation.
Auditor access is enforced at both the database level (row-level security policies block writes) and the application level (write buttons are not rendered). Attempting a write operation via the API will return a permission error.