How should user roles and permissions be managed in Phreesia to enforce least-privilege access?

• A. Assign every user full access.
• B. Define roles (Front Desk, Billing, Admin, Clinician), assign specific permissions, regularly review access, and disable accounts when needed.
• C. Only Admin can access patient data.
• D. Permissions are not adjustable.

Answer: (B)

The key idea here is least-privilege access: users should have only the permissions they need to perform their job. In Phreesia, you implement this with role-based access control. Define distinct roles (for example, Front Desk, Billing, Admin, Clinician) and assign a precise set of permissions to each role so that each person’s capabilities align with their duties. Then place users into those roles rather than granting broad, blanket access. Regularly review who has which role and adjust permissions as responsibilities change, and disable accounts when someone leaves or no longer requires access. This minimizes exposure to patient data, supports accountability, and reduces the risk of errors or misuse. The other options miss the point: giving everyone full access ignores the principle of limited exposure; restricting data to Admins alone undermines workflow; and saying permissions aren’t adjustable ignores the practical need to adapt as duties evolve.