eKlotho Nexus — System Administrator Manual

Architecture Summary

Creating a User Account

• Navigate to System Admin → User Management and click + New User.
• Enter the user's legal name, email address (used as login username), job title, department, and phone number.
• Assign one or more roles from the Role picker. Users inherit the union of permissions from all assigned roles.
• Set the user's home organization unit (practice or department) to scope their default data view.
• Click Create & Send Invite. An activation email is sent to the user with a time-limited (24-hour) temporary password link.
• Optionally, enable MFA enforcement for this user immediately by toggling Require MFA on next login before saving.

Deactivating a User

• Search for the user in the User Management list and click their name to open the user detail view.
• Click Deactivate Account in the actions panel. You will be prompted to confirm and provide a reason (e.g., Termination, Leave of Absence).
• All active sessions for this user are immediately invalidated. The user cannot log in until reactivated.
• Reassign any open cases, tasks, or care manager assignments before deactivation using the Reassign Work dialog.

Bulk User Import via CSV

• Download the import template from the User Management page (Import → Download Template).
• Populate the template with required columns: first_name, last_name, email, role_codes, department, npi (if clinical).
• Upload the completed CSV. The system validates all rows before importing — errors are reported per row with specific field descriptions.
• Confirm the import summary (users to create, update, skip) and click Execute Import.

Default System Roles

Creating a Custom Role

• Navigate to System Admin → Roles & Permissions and click + New Role.
• Enter a role name (snake_case recommended, e.g., enrollment_specialist), display label, and description.
• Select a base role to clone permissions from, then use the permission matrix to add or remove individual permissions.
• Set the data scope: All Patients, Assigned Patients Only, or Org Unit Scoped.
• Click Save Role. The new role is immediately available for assignment to users.
• Document custom roles in your internal RBAC policy document for audit purposes.

Enabling Organization-Wide MFA Enforcement

• Navigate to System Admin → MFA and open the Enforcement Policy tab.
• Toggle Require MFA for All Users to enabled. Set a grace period (recommended: 7 days) to allow users to enroll before being locked out.
• Select the allowed MFA methods — for highest security, disable SMS and require TOTP or hardware key only.
• Optionally configure IP allowlist exceptions for internal network access (e.g., clinical workstations on a trusted subnet can bypass MFA).
• Click Save Policy. Users who have not enrolled in MFA will be redirected to the enrollment wizard on next login.

Generating a Bypass Code for a User

• Navigate to the user's profile in User Management and click MFA Settings.
• Click Generate Bypass Code. Confirm the action — only one active bypass code exists per user at a time.
• Securely deliver the 16-character code to the user via a verified out-of-band channel (phone call, in-person). Never send via email.
• The user enters the bypass code in place of their MFA token and is prompted to re-enroll in MFA immediately after login.

Configuring a Practice Location

• Navigate to Organization → Practices and click + New Practice.
• Enter the practice name, address, phone, fax, NPI Type 2, and Tax ID (EIN).
• Configure payer-specific billing IDs under the Payer IDs tab — these override the organization-level IDs for claims submitted by this practice.
• Assign the practice's default clearing house and EDI configuration from the dropdown (configured in EDI Config).
• Click Save Practice. The practice is immediately available for selection on claims, authorizations, and provider assignments.

Adding a Trading Partner

• Navigate to System Admin → EDI Config and click + New Trading Partner.
• Enter the partner name, type (Clearinghouse, Payer, Government), and contact information.
• Configure the ISA envelope: ISA05 (sender qualifier), ISA06 (sender ID), ISA07 (receiver qualifier), ISA08 (receiver ID).
• Set up the GS application sender ID and receiver ID per the partner's specifications.
• Configure the submission endpoint: select protocol (SFTP, AS2, HTTPS API) and enter connection credentials. Use the Test Connection button to verify connectivity.
• Enable the applicable transaction sets (837P, 837I, 834, 278, 270/271, 835) and set processing schedules (real-time or batch).

Creating a Custom Fee Schedule

• Navigate to System Admin → Fee Schedules and click + New Schedule.
• Enter the schedule name, effective date, and end date (leave blank for open-ended). Select the base schedule type.
• Choose the rate method: Percentage of Medicare (e.g., 115%), Flat Rate per Code, or RVU-based calculation.
• Import code-level rates via CSV, or enter manually for small schedules. Required columns: procedure_code, modifier, pos, rate, effective_date.
• Associate the schedule with specific payers and/or provider contract types under the Associations tab.
• Click Activate Schedule. Claims priced after the effective date will use this schedule for matched payer/provider combinations.

Reviewing Audit Logs

• Navigate to System Admin → HIPAA Audit Logs to open the log viewer.
• Use the filter panel to search by user, date range, action type (READ, WRITE, DELETE, EXPORT, LOGIN), or resource type (Patient, Claim, Document, etc.).
• Click any log entry to expand the full detail including field-level before/after values for WRITE events.
• Use the Export Logs button to download filtered results as CSV or JSON for external SIEM or compliance review. All exports are themselves logged.
• Set up automated log alerts for sensitive actions (e.g., bulk exports, DELETE operations, failed logins) via the Alert Rules tab.

Incident Response Using Audit Logs

• On suspicion of unauthorized access, immediately search audit logs for the suspected user or IP address across the past 90 days.
• Export the filtered results and preserve as evidence. Apply a legal hold tag to prevent archival during the investigation period.
• Identify all PHI records accessed by the suspicious session and prepare the breach impact assessment for your Compliance Officer.
• Document findings in the Incident Response Log and notify affected individuals within the HIPAA-mandated 60-day window if breach is confirmed.

Creating an API Key

• Navigate to System Admin → Integrations → API Keys and click + Generate Key.
• Enter a descriptive name (e.g., "EHR Integration - Epic Production"), select the scopes required, and set an expiration date (recommended: 1 year).
• Copy the generated key immediately — it is displayed only once and cannot be retrieved after the dialog closes.
• Store the key in your organization's secrets manager (AWS Secrets Manager, HashiCorp Vault, or equivalent). Never store API keys in source code or configuration files in version control.
• Test the key using the API Tester tab before deploying to the integration system.

Configuring an SLA Rule

• Navigate to System Admin → SLA Config and click + New SLA Rule.
• Select the workflow type (Prior Auth - Standard, Prior Auth - Expedited, Grievance, Appeal - Standard, etc.).
• Set the total SLA duration in hours or business days per regulatory requirements (e.g., CMS requires standard prior auth decisions within 14 calendar days).
• Configure alert thresholds: define the percentage of SLA consumed that triggers each alert level (Warning, Critical, Breach).
• Map each alert level to an escalation group — groups are configured under Admin → User Groups and can include email, SMS, and in-portal notification channels.
• Click Activate Rule. All new requests of the selected type will be tracked against this SLA from creation timestamp.

Managing Feature Flags

• Navigate to System Admin → System Config → Feature Flags.
• Review the list of available features. Features in Beta status should be tested in a non-production tenant before enabling in production.
• Toggle any feature flag and click Save. The change is applied immediately — no restart required.
• For gradual rollouts, use the Percentage Rollout option to enable a feature for a random percentage of users (e.g., 10% for initial testing).

Provisioning a New Tenant

• Navigate to Multi-Tenant → Tenant Dashboard (super_admin only) and click + New Tenant.
• Enter the organization's legal name, short code (used in API paths and database schema name), primary contact, and contract tier.
• Select the data residency region (US-East, US-West, EU) and confirm this matches the BAA and data processing agreement.
• Configure the feature set and user seat limit based on the contracted plan.
• Click Provision Tenant. Infrastructure provisioning completes within 3–5 minutes. The first org_admin user invitation is generated automatically.
• Run the post-provisioning verification checklist to confirm database connectivity, storage bucket permissions, and EDI endpoint reachability.

Configuring Premium Billing Settings

• Navigate to System Admin → System Config → Financial and open the Premium Billing tab.
• Set the billing cycle, invoice generation date (e.g., 1st of each month), and due date offset (e.g., Net 30).
• Configure grace period durations per plan type: individual (30 days per ACA), COBRA (30 days), employer group (per contract).
• Connect the payment processor by entering the API keys from your Stripe dashboard under Payment Gateway. Test with a $1.00 authorization before going live.
• Map revenue GL accounts to plan product categories under GL Mapping to enable automatic journal entry export.

Creating a New Plan Product

• Navigate to Plan Products → Product List and click + New Product (requires org_admin or product_manager role).
• Enter the plan name, plan type (HMO, PPO, EPO, HDHP), metal tier (Bronze/Silver/Gold/Platinum), and effective year.
• Configure benefit categories in the Benefit Design builder. Set deductible amounts, copays, coinsurance rates, and OOP maximums for in-network and out-of-network separately.
• Link the plan to an approved formulary from the Formulary Library. Set drug tier cost-sharing by tier.
• Configure accumulator settings: define which benefit categories count toward the plan deductible and OOP maximum.
• Submit for internal review — the compliance team receives an automated review task. After approval, initiate CMS submission if applicable.

Configuring 834 Processing Rules

• Navigate to System Admin → EDI Config → 834 Processing and select the trading partner to configure.
• Define the member ID source segment (REF*0F or NM1*IL*1) and the effective date segment used by this trading partner.
• Set the duplicate member matching threshold (default: 90% composite score triggers merge review).
• Configure the retroactive change window — define how many calendar days back a transaction effective date can reach before requiring manual approval.
• Enable or disable automatic plan benefit assignment based on benefit option codes in the 834 HD segment.

Configuring the Regulatory Filing Calendar

• Navigate to Regulatory → Filing Calendar → Admin Settings to manage the master filing calendar.
• Add new filing obligations using the + New Filing form — specify the regulator, filing type, statutory deadline, and required data elements.
• Set the internal preparation lead time (days before the statutory deadline) to generate internal prep deadlines.
• Assign default owners by filing category so new filings are automatically routed to the correct department.
• Configure reminder schedules: automated email reminders at 30, 14, 7, and 1 day before each internal deadline.

Creating an Adjudication Rule

• Navigate to Claims → Audit Rules → Admin and click + New Rule.
• Define the rule trigger: procedure code(s), modifier(s), diagnosis code range, place of service, or provider specialty.
• Set the rule action: Auto-deny with denial reason code, Reduce payment by percentage, Route to manual review, or Apply global surgery reduction.
• Set the rule priority (lower number = higher priority). Rules are evaluated in priority order — the first matching rule wins unless Continue Evaluation is enabled.
• Test the rule against historical claims using the Rule Simulation tool before activating in production. Review impacted claim count and financial impact estimate.
• Click Activate Rule with an effective date. Rules apply to claims with a date of service on or after the effective date.

Configuring Risk Stratification Weights

• Navigate to System Admin → System Config → Population Health and open Risk Model Settings.
• Adjust the weight factors for each domain: Clinical Severity (0–1.0), Pharmacy Utilization (0–1.0), ER/Inpatient Utilization (0–1.0), SDOH Score (0–1.0), and Care Gap Count (0–1.0). Weights must sum to 1.0.
• Set the risk tier thresholds: define the composite score cutoffs for High, Moderate, and Low risk bands.
• Enable or disable the predictive hospitalization model (requires minimum 12 months of claims history for accuracy).
• Click Save & Recalculate to apply new weights to the full population. Recalculation runs as a background job — estimated completion time is displayed.

Configuring Auto-Enrollment Rules

• Navigate to System Admin → System Config → Care Coordination and open Auto-Enrollment Rules.
• Click + New Rule and define the trigger criteria: risk score threshold, diagnosis codes (ICD-10), utilization events, or SDOH flags.
• Select the care program to enroll matched patients in and the initial case intensity level (High/Medium/Low).
• Set the assignment logic: Round-robin among available care managers, Assign to primary care manager, or Assign by specialty (e.g., CHF nurse specialist).
• Configure the enrollment notification: patient notification template, care manager alert, and PCP notification settings.

Configuring a Scheduled Report

• Navigate to Analytics → Scheduled Reports → Admin and click + New Schedule.
• Select the report template, configure parameters (date range offset, group filters), and choose the output format (PDF, Excel, CSV).
• Set the recurrence schedule (daily, weekly, monthly) and the delivery time (recommend off-peak hours for large reports).
• Add recipient email addresses or SFTP destinations. For SFTP, enter server details and use the Test Delivery button to verify connectivity.
• Enable Conditional Delivery to suppress the report if no data matches the criteria for that period (avoids empty report emails).

Data Retention Policy Summary

Recommended Security Settings

Configuring IP Allowlisting for Admin Access

• Navigate to System Config → Security → IP Allowlist and toggle Enable Admin IP Restriction.
• Enter your organization's static IP ranges in CIDR notation (e.g., 203.0.113.0/24 for office, 10.0.0.0/8 for VPN).
• Add at least two IP ranges before saving — saving a single range with no fallback could lock all admins out if that IP changes.
• Click Save & Test. The system will verify your current IP is within an allowed range before applying the restriction.

Common Issues & Resolutions

Support Escalation Levels

• Level 1 — Self-Service: Use this manual and the in-portal Page Guide (?). Check the eKlotho Knowledge Base at docs.eklotho.com for step-by-step articles.
• Level 2 — Standard Support Ticket: Submit via support.eklotho.com. Target response time: 4 business hours. Include tenant ID, reproduction steps, screenshots, and affected user list.
• Level 3 — Priority Support: For production-impacting issues affecting clinical workflows. Escalate via phone to your dedicated Customer Success Manager (CSM). Target response: 1 hour.
• Level 4 — Emergency (Security/Breach): Call the 24/7 security incident hotline in your BAA. Concurrent notification: eKlotho security team + your Compliance Officer + Legal Counsel. Do not delay for Level 4 escalations.