Clinic settings

Open Setup > Clinic > Organization to review your clinic's settings. Anyone can see them; only people whose role can update the organization can change them. Everyone else sees the fields read-only, without a Save Changes button.

Automatic sign-out#

NeatPractice signs a user out after a period without activity, so patient information is not left open on a shared or unattended computer. Two minutes before the sign-out, NeatPractice shows a warning with a countdown and a Stay signed in button.

The delay is set for the whole clinic and starts at 15 minutes. To change it:

1. In Automatic sign-out (minutes), enter the number of minutes, from 5 to 60.
2. Click Save Changes.

The new delay applies to each user the next time NeatPractice refreshes their account, for example when they return to the NeatPractice window or sign in again. Each change is recorded in the security audit log.

Break-glass access#

Break-glass access lets a clinician open a patient outside their caseload in an urgent situation by stating a reason. Access lasts four hours, every use is recorded, and owners and clinic admins are notified.

It is on for every new clinic. To turn it off:

1. Turn off Allow break-glass access.
2. Click Save Changes.

While it is off, people who need a patient outside their access ask an admin to change their care team assignments or roles. Each change to this setting is recorded in the security audit log.

Automatic problem reports#

Under Support, Send automatic problem reports lets NeatPractice tell its support team on its own when the app hits an error, with the technical details and a short screen recording in which typed values are hidden. Members see a We sent a problem report message and can add details. It is on for every new clinic; turn it off and click Save Support to stop these reports. Members can still report problems themselves. See Automatic problem reports.

Data export#

Owners see Data export, where they can download a copy of everything the clinic stores, at any time. See your data export for what the file holds and how to request it.

Agreements#

Agreements lists who accepted the business associate agreement, the clinic terms, the terms of use and the HIPAA confidentiality acknowledgment, and lets you download each one as a PDF. See agreements.

Security#

The Security panel holds two separate choices. Both are off for a new clinic. Change either one, then click Save Changes in the panel. Each change is recorded in the security audit log with the name of the admin who made it.

Require two-step verification to sign in#

When Require two-step verification to sign in is on, every user confirms a code from an authenticator app after their password. A user who has not set one up is asked to do it at their next sign-in and cannot use the rest of NeatPractice until they finish, and nobody can turn their own two-step verification off while the setting is on. See signing in for what users see.

When it is off, each user can still turn two-step verification on for their own account in their profile.

Network access#

The Network Access panel limits sign-in to your offices. Add the public address or range of each office network (for example 203.0.113.0/24), turn on Allow sign-in only from these networks, then click Save Changes. The panel shows the address you are on now and whether it is listed.

A user on any other network sees a page explaining that your clinic allows sign-in only from its own networks, with a button to sign out. Users marked Sign in from any network on the users screen are not limited. NeatPractice refuses to save a change that would sign you out yourself, so add your own network first or mark yourself as allowed from any network. Every change and every refused sign-in is recorded in the security audit log.

Require a verification code to sign documents#

This decides how a provider confirms it is them when they sign, co-sign or add an addendum:

• Off: the provider reads the attestation and checks I agree to this attestation while signed in.
• On: the provider also enters a code from their authenticator app. In Code lasts (minutes), choose how long one code covers further signatures, from 5 to 60 minutes (15 to start). A provider without an authenticator app is pointed to their profile to set one up before signing.
• Let members remember a device for 30 days (shown while codes are on, and on to start): with a code, a provider can tick Remember this device for 30 days, and that browser then signs without a code until it expires. Turn it off to always ask for a code; turning it off also forgets every device remembered in your clinic. The owner's full data export always asks for a code, remembered device or not.

Either way, each signature records how it was confirmed, and the signed copy shows it. See signing for what providers see.