Staff Members

The permission story is the moat. Every staff member has an organization-level role and permission set. From there, permissions can be overridden at facility level, and again at program level — per individual flag, not as a group. A staff member can have Approve Services granted at the facility level and Take Payments denied at one specific program in that same facility. The override is per flag, the policy is documented, and the audit trail records every change. No more "well, give them admin and trust them" workarounds because the platform's permission model couldn't express what the real-world job actually was.

Staff are assigned to facilities, and within facilities to specific programs. A facility-level assignment grants access to all programs at that facility (subject to the staff member's permissions). A program-level assignment narrows access to just the named programs. The assignment is the connection; permissions are what each connection enables. Add a new facility to your organization and you can assign existing staff to it in seconds, with their full permission set ready to go.

Each staff member's work schedule is set per facility. The schedule isn't just a calendar — it's the source of truth for appointment availability, the gate the patron portal checks before letting a customer book a session, and the data the day scheduler displays. Staff can have a recurring weekly pattern at one facility and a different pattern at another, plus single-day overrides for holidays, training days, or any one-off coverage. When a customer books through the patron portal, only times the staff member is actually working appear — the schedule is the source of truth, not a separate booking calendar.

Each staff member has a "Reports To" relationship for the org chart and a separately-managed list of time approvers — who can approve this person's time entries, and whose time this person can approve. The two are deliberately decoupled because they answer different questions: the org chart is about who you work for; time approval is about who has the authority to sign your timesheet. A program director might approve their direct reports' time, but might also approve cross-team time for staff who work on their program without reporting to them organizationally.

Adding a new staff member sends them an email invitation to set their password and complete profile fields they self-manage. Hire date is recorded for HR tenure tracking. When a staff member is terminated, the termination date is recorded and the platform automatically revokes access — without deleting the record. All of the staff member's history (cases worked, time logged, services delivered, payments processed) stays in the books, accessible to reports, and discoverable for audits. HIPAA-required retention is honored automatically.

When you're hiring a new case worker for an existing program, you don't need to configure 30+ permission flags from scratch. Clone an existing staff member as a template; pick which settings carry over (roles & permissions, facility/program assignments, schedule pattern, time approvers); enter the new person's identity fields fresh. The new staff member is configured in seconds rather than minutes, and the institutional knowledge of "this is how a case worker is set up" is captured in the cloned template, not in someone's onboarding-checklist Google Doc.

Employment agreements, certifications, training records, and HR files attach directly to the staff member record — encrypted at rest, retained per HIPAA, and visible to staff with the right permissions. Signature documents (offer letters, NDAs, policy acknowledgments) can be sent to a staff member from their profile; they sign electronically, the signed copy attaches automatically, and locks from modification. The full document story lives on the Document Storage feature page; the signature flow lives on Signature Documents.

Staff manage their own personal details — address, phone, emergency contact, password recovery options, demographic fields they choose to share. The HR-controlled fields (active status, hire date, termination date, position, reports-to) require admin permission to change. The split is honest: your HR team owns the employment record; the staff member owns their personal record. Neither needs to chase the other down to make routine updates.

The Staff Members module isn't a personnel silo. Every hour logged through Time Entry rolls up here. Every appointment scheduled in Appointments draws from the staff member's work schedule defined here. Reports under Reports pull staff data from here for time entry, schedules, and case work. The staff record is the spine; the rest of the platform attaches to it.