Hey everyone, I'm working on a multi-organization architecture for a RPM system using Medplum. I’d love to hear your thoughts on our approach and have a few questions. Here’s an outline: We've structured three levels of access: L1 (Level 1): Super Admin/Platform Owner - oversees the entire platform and all organizations. **L2 (Level 2): **Admins who manage specific health service organizations or provider groups and are associated to Organization resource at L2. **L3 (Level 3): **Hospitals, represented as separate Organization resource, linked to their respective L2 entities using the partOf attribute. Each patient is linked to an L3 organization as their managing organization. Questions 1. Separation of Concerns at L2: How can we ensure that Admins at L2 level can’t access data from other organizations on same level? 2. If we consider each L2 entity has its own project on Medplum, is it possible to allow seamless patient login and password reset across the same mobile/web apps without specifying projectId? Can switching to external identity provider such as Auth0/Okta for authentication impact this? 3. Sub-Admin Access at L3: Is there a way to set up sub-admins at L3 who can only access their assigned organization? Any insights you can provide would be really helpful! Thanks in advance for your help.

@rahul1 need your brain power here, we are bit unclear abt how to approach towards this. Mainly around how to handle within medplum, whether create seperate projects, same projects different client credentials etc. Thanks in advance

Some thoughts: 1. My sense is that each org at L2 could have it's own project for isolation 2. Are all L2s on the same domain? e.g. myhospital.com? There are enterprise features that can potentially help here. 3. This guide might be appropriate for L3 https://www.medplum.com/docs/access/access-policies#healthcare-partnerships

@reshma Yes, all L2s are on the same domain. Currently we have self hosted the app. Are you referring to this? https://www.medplum.com/docs/auth/methods/domain-level-identity-providers

Yup

Hi @chinmay_mb stay tuned for more info. This is a use case we've actively been working to support, and we'll have some more documentation out soon

Thanks @rahul1 , do let us know once you have any details as we need to make architectural changes at our end accordingly, so sooner the better 🙂

We are trying to implement similar, and get your feedback on best practices. Also on the Shared Projects thinking of centralizing for Mapping Organizations, HealthCareServices, AccessPolicyTemplates, Practioner, and Practioner role, so that they could be shared with all other projects. Thoughts?

Hi! Check our our new document on this topic: https://www.medplum.com/docs/access/multi-tenant-access-policy

@rahul1 Thanks! I'll take a look